Hospital Merger Identity Cutover
Two regional hospitals merge into a 6,500-employee system. Hospital A uses Okta with SAML to 42 apps; Hospital B uses AD FS and on-premises groups. Cutover is fixed at 90 days by the merger agreement. The identity team finds 240 orphan accounts, 18 shared break-glass accounts whose passwords are in a sealed envelope but were used 31 times last quarter, and MFA enforced only for email. Clinical staff share 1,100 workstations across 14 sites and often badge in as a colleague during shift changes. A payer audit starts in 60 days and will sample access reviews for financial and clinical systems. The new CISO must decide whether to consolidate identity providers before cutover or federate temporarily. The CIO wants a single sign-on experience on day one; nursing leadership warns that any extra login step will cause workarounds.
1. Recommend an identity integration approach for the 90-day cutover. Justify the sequencing and what you would defer.
Read the worked answer
Federate first, consolidate later. Ninety days is too short for clean role mining across 42 applications and 240 orphan accounts; a big-bang migration risks clinicians losing access on day one. Use Okta as the primary identity provider and federate the AD FS applications through a trust. Map AD groups to application entitlements, freeze new local accounts, and prioritize financial and clinical applications in the payer audit scope. Defer non-critical application consolidation, password hash migration, and full self-service profile management. Do not defer orphan remediation or MFA expansion, because both are audit-critical. Establish an authoritative HR feed for joiners, movers, and leavers. Success means every clinical user can authenticate on day one, individual actions use unique credentials, and access review evidence exists for in-scope systems. Federation adds a trust to operate, so assign ownership, certificate rotation, and monitoring before cutover.
2. How would you handle shared workstations, shared break-glass accounts, and badge-sharing without stopping clinical work?
Read the worked answer
Separate authentication from session behavior. For shared workstations, use fast user switching or badge tap with individual credentials; if workflow truly requires a shared session, permit shared accounts only inside the clinical application, while order entry and medication actions use unique IDs. Compensate with session recording, physical supervision, and periodic review. For break-glass, replace shared passwords with individually assigned sealed credentials or a privileged access vault with checkout, alerting, and post-use review; reduce 18 accounts to two or four per site. Badge-sharing is an authentication event, so treat it as a policy violation. Enable badge-plus-PIN for medication ordering, but not for reading schedules. Do not rely on awareness alone. Sequence: break-glass in 30 days, shared workstation design in 60 days, audit evidence by 90 days. Keep nursing leadership in the design so controls do not create the workarounds they are meant to prevent.
3. What evidence should the CISO present to the payer audit in 60 days, given the integration is incomplete?
Read the worked answer
Scope the evidence to the audit, not to the full integration. Provide access reviews for in-scope financial and clinical applications with reviewer sign-off and remediation tickets; joiner, mover, and leaver evidence from the HR feed; the privileged access list and break-glass usage log with post-use review; MFA enrollment reports; an orphan account cleanup report showing 240 reduced to a documented residual; an exception register for remaining shared accounts with compensating controls and expiry; and federation trust configuration plus test results. Be transparent about deferred items and the 90-day plan. Auditors accept incomplete remediation with a credible plan when risk is disclosed; they do not accept unsupported claims. Map each control to the audit framework, pre-brief the auditor on the merger context, and make evidence dated, reproducible, and owner-assigned. Do not claim single sign-on if federation is only partial.