Body
Purpose
The HIPAA Identity Pattern defines the approved implementation model for authentication, authorization, privileged access, service identities, and identity governance for HIPAA workloads hosted in University-managed Azure environments.
This pattern provides a consistent identity architecture that supports security, operational management, auditability, and compliance requirements for workloads that create, store, process, transmit, or provide access to Protected Health Information (PHI).
Use Cases
This pattern applies when:
- Hosting applications that contain PHI
- Hosting databases that contain PHI
- Deploying HIPAA landing zones
- Deploying HIPAA subscriptions
- Implementing administrative access to HIPAA resources
- Implementing service-to-service authentication
This pattern does not apply to:
- Non-regulated development environments
- Sandbox environments without PHI
- Non-regulated workloads
Design Principles
Centralized Identity
HIPAA workloads use approved enterprise identity services as the authoritative identity provider.
Workloads should not implement independent identity systems when approved enterprise identity capabilities satisfy business requirements.
Role-Based Access Control
Access should be assigned through roles and groups rather than directly to individual users whenever practical.
Least Privilege
Users, administrators, applications, and automation receive only the permissions necessary to perform approved business functions.
Identity Lifecycle Management
Identity creation, modification, and removal should align with approved organizational lifecycle processes.
Auditable Access
Authentication events, authorization changes, and administrative activities must be observable through approved monitoring and auditing services.
Logical Architecture
User
↓
Enterprise Identity Platform
↓
Authentication
↓
Authorization
↓
HIPAA Workload
Application
↓
Application Identity
↓
HIPAA Resource
Automation
↓
Service Identity
↓
HIPAA Resource
Identity Types
Workforce Identities
Used by faculty, staff, researchers, administrators, operators, and support personnel.
Responsibilities include:
- Application access
- Administrative access
- Operational access
- Support activities
Privileged Identities
Used to administer HIPAA resources and services.
Examples include:
- Cloud administrators
- Platform administrators
- Database administrators
- Service administrators
Application Identities
Used by applications requiring access to other services.
Examples include:
- API-to-API communication
- Application-to-database access
- Application-to-service access
Automation Identities
Used by automation, deployment pipelines, orchestration platforms, and scheduled processes.
Examples include:
- Infrastructure deployment
- Operational automation
- Data movement
- Integration workflows
Access Model
Authentication
Authentication is performed through approved enterprise authentication services.
Workloads should leverage enterprise identity services rather than maintaining local credentials whenever practical.
Authorization
Authorization should be assigned using approved role-based access models.
Group-based assignment should be used whenever possible.
Platform Access
Administrative access should be separated from standard user access.
Administrative access must follow approved privileged access processes.
Identity Boundaries
HIPAA Workload Boundary
HIPAA workloads remain isolated within approved HIPAA subscriptions and hosting patterns.
Enterprise Identity Boundary
Approved enterprise identity services may operate as shared enterprise services supporting HIPAA workloads.
Identity services do not need to be duplicated within every HIPAA subscription provided approved governance and security controls are maintained.
Identity Governance
Provisioning
Access is granted through approved onboarding and access management processes.
Modification
Identity changes should follow approved governance and change processes.
Removal
Access should be removed when business need no longer exists.
Monitoring and Auditability
Identity activities should be observable through approved monitoring solutions.
Monitoring should support:
- Authentication activity review
- Access review activities
- Administrative activity review
- Security investigations
- Compliance activities
Operational Responsibilities
Platform Team
- Identity architecture
- Identity pattern management
- Platform identity services
Security Team
- Identity governance requirements
- Security reviews
- Security investigations
Workload Owner
- Application authorization design
- Business role definitions
- Access approval processes
Automation Pattern
Identity configuration should be deployed through approved platform automation whenever practical.
Typical automation areas include:
- Role assignments
- Identity integration
- Workload onboarding
- Service identity deployment
- Landing zone deployment
Reference Architecture Outcomes
A workload implementing this pattern should provide:
- Centralized authentication
- Role-based authorization
- Privileged access separation
- Identity auditability
- Identity lifecycle governance
- Consistent identity implementation across HIPAA workloads
Reference Architecture Capabilities
The HIPAA Identity Pattern provides the following identity capabilities for regulated workloads.
Authentication
Provides:
- Workforce authentication
- Administrative authentication
- Application authentication
- Service authentication
- Federated authentication
Authorization
Provides:
- Role-based access control
- Group-based authorization
- Least privilege enforcement
- Separation of duties
- Granular access management
Privileged Access Management
Provides:
- Administrative access governance
- Elevated access controls
- Privileged role management
- Administrative access separation
- Time-bound privileged access
Workload Identity Management
Provides:
- Application identities
- Service identities
- Non-human authentication
- Service-to-service trust relationships
- Automated workload authentication
Identity Governance
Provides:
- Identity provisioning
- Identity modification
- Identity removal
- Access review processes
- Lifecycle management
Audit and Accountability
Provides:
- Authentication auditing
- Authorization auditing
- Administrative activity auditing
- Security investigation support
- Compliance reporting support
Platform Integration
Provides:
- Integration with enterprise identity services
- Integration with enterprise monitoring services
- Integration with enterprise governance processes
- Integration with HIPAA hosting services
- Integration with approved automation platforms
Reference Architecture Services
The HIPAA Identity Pattern is implemented through the following logical identity services.
Identity Provider Service
Responsibilities:
- Authenticate users
- Authenticate applications
- Establish identity trust
- Provide authoritative identity information
Authorization Service
Responsibilities:
- Evaluate access permissions
- Enforce authorization decisions
- Manage role assignments
- Manage group memberships
Privileged Access Service
Responsibilities:
- Govern administrative access
- Control elevated permissions
- Support privileged access workflows
- Support administrative accountability
Workload Identity Service
Responsibilities:
- Provide application identities
- Provide service identities
- Support service authentication
- Eliminate dependency on shared credentials
Identity Governance Service
Responsibilities:
- Provision identities
- Modify identities
- Remove identities
- Support access reviews
- Support identity lifecycle management
Identity Audit Service
Responsibilities:
- Collect authentication events
- Collect authorization events
- Collect administrative activity
- Support investigations
- Support compliance activities