Open source SSO for HIPAA access controls

Export the user directory and show that every clinical user has a single account with a unique username or identifier, with no shared or generic logins. Under 45 CFR 164.312(a)(2)(i), the rule requires a unique name and/or number for identifying and tracking user identity, so the export should list accounts, their source (local, LDAP or Active Directory federation), and their status. Pair it with the process that creates, disables and removes accounts. Keycloak user federation and authentik directory sources both make this list reproducible, and you should confirm the exact export method for your chosen version in its documentation before you rely on it.

Keep dated exports of the configuration that decides who can reach each clinical application and how they prove identity. For Keycloak, this means realm settings and client definitions for every application that handles ePHI, including redirect URIs and protocol type (OpenID Connect or SAML 2.0). For authentik, it means the provider and application objects that bind each clinical system to a flow. Store these exports under change control so you can show what was in place on a given date. Version-controlled configuration makes comparisons between periods straightforward.

Export the authentication flow, MFA policy and session settings, then document the inactivity time you chose. The HIPAA rule at 45 CFR 164.312(a)(2)(iii) requires electronic procedures that end a session after a predetermined time of inactivity, but it does not set that time, so the value and its rationale belong in your own policy. Show which applications enforce MFA, which roles are exempt and why, and when the settings last changed. Confirm with your identity vendor how idle and maximum session lifetimes are expressed in your version, because that determines what the export contains.

Reviewers look for records that show who changed access, when, and from where, along with login activity for ePHI systems. The Security Rule's audit controls standard in 45 CFR 164.312(b) asks entities to record and examine activity in systems containing ePHI, so keep administrative event logs for realm, client, user and policy changes and authentication event logs for logins and failures. Ship them to a log store outside the identity server so an administrator cannot alter them silently. Decide how long you retain them and who reviews them, and record that decision. Confirm which event types your version logs and which need enabling.

Provide a written emergency access procedure, evidence that it was tested, and records of each use. The rule at 45 CFR 164.312(a)(2)(ii) requires an emergency access procedure to obtain necessary ePHI during an emergency, and it is a required specification. Document how break-glass accounts are created, who holds them, how credentials are stored and sealed, how use is detected and reviewed, and when they are disabled afterward. Test records should show the date, scope, participants and outcome of each drill, and any gaps found. Confirm the exact emergency account options in your identity platform before writing the procedure.

Record, for each addressable specification, whether it is reasonable and appropriate, what you implemented, and why. Under 45 CFR 164.306(d)(3), an entity must assess whether an addressable specification is reasonable and appropriate, implement it if so, and otherwise document the reason and implement an equivalent alternative if reasonable. For this topic, automatic logoff and encryption and decryption are addressable, so their decisions need written justification. Link each decision to your risk analysis and risk management records, since OCR will look for that connection. NIST SP 800-66 Rev. 2 offers sample questions you can use to test whether the documentation is complete.

The HHS Office for Civil Rights enforces the Security Rule through complaint investigations, compliance reviews and audits, and it can request documentation during any of them. The exports described here are prepared evidence that your controls exist and were operated, not an audit report, attestation or certification. HHS states that no Security Rule standard requires certification and that it does not recognize private certifications. An independent assessor can review the same evidence, and DeployOpen can prepare the systems, controls and evidence for that review, but it does not issue audit reports or certifications.

Yes, if the exports are scripted, stored under change control and assigned an owner. The main effort is recurring: exporting configurations, reviewing logs, running emergency access drills and refreshing risk decisions when systems change. A one-time setup covers the export tooling, the evidence folder structure and the written procedures. Ask any implementation partner which exports they will build, how often they will run, and which parts remain your staff's responsibility. Cost depends on the number of clinical applications, the size of the directory and how many people review the output.

No public price applies to this work, and DeployOpen does not publish a price list. Cost comes from the written scope, which fixes the number of clinical applications, directories, protocols and environments. The main components are the identity platform infrastructure and database, integration effort per application, MFA rollout, testing, documentation and support. Keycloak is licensed under Apache 2.0 and authentik's core is under MIT, so the software itself has no license fee for the core features. Paid editions carry their own cost. The authentik pricing page lists Enterprise at $5 per user per month billed annually plus $0.02 per external user per month, and it reserves features such as mTLS client certificate authentication and enhanced audit logging for that edition. Ask every bidder to separate one-time build costs from recurring costs.

No duration applies to every organization, so the timeline depends on the scope agreed in writing before work starts. The biggest variables are how many clinical applications need SSO, how many use SAML, OpenID Connect or neither, and how many directories must be federated. A pilot with a few applications on a single directory is much shorter than a phased rollout across an EHR, imaging, pharmacy and reporting tools on shared workstations. Testing and change control in clinical environments usually add time. Ask the partner to present the timeline as phases with named exit criteria, and to state which applications are excluded from the first phase.

Effort rises with the number of clinical applications, the share of legacy systems without modern login support, and the number of directories and identity sources. Each application needs its own protocol configuration, attribute mapping and test cases, so a large EHR estate costs more than a handful of web tools. Legacy systems that only accept local accounts, or that use LDAP binds or fixed service accounts, often need a gateway, a proxy or a decision to keep them out of scope. Multiple Active Directory forests, HR-driven provisioning and high availability requirements also add work. Shared workstation behavior, such as fast user switching and emergency access, needs separate design and testing in each clinical workflow.

An internal team can build it if it has engineers who know the chosen platform, can run it in production and can maintain the integrations over time. Keycloak documents three high availability architectures and requires a synchronously replicated database for the supported designs, so the platform team must own database operations, upgrades and monitoring. Keycloak also recommends manual approval for operator updates, which means someone must review each release. Teams often underestimate the application integration work and the documentation that a risk analysis and audit will request. Estimate the internal hours against your own staffing, and compare them with a fixed-scope quote that lists the same deliverables.

The work needs named clinical owners for each application, who confirm workflows, roles and acceptable session behavior at shared workstations. It needs read access to the directories and identity sources, plus a sandbox or test environment for each clinical application. The risk analysis inputs are important: the asset inventory, the list of systems that hold ePHI, the current access model and the known gaps. Security and compliance leads must agree on the unique user identification scheme, the emergency access procedure and the inactivity timeout values, since the HIPAA rule leaves the timeout to the covered entity. Without these inputs, the partner cannot produce a reliable scope or test plan.

Recurring costs include the infrastructure and database hosting, backups, monitoring, patching and upgrades, and the staff or partner time needed to handle onboarding, offboarding and new application integrations. Paid editions or per-user subscriptions recur if you choose them. Keycloak releases four minor versions a year, and authentik publishes security releases with at least 24 hours of notice, so routine maintenance is ongoing. One-time costs include the initial architecture, integration of each application, MFA enrollment design, testing, evidence preparation and documentation. Ask whether ongoing support is a retainer and what it covers, including upgrade testing and after-hours response.

Ask for a written scope that lists each clinical application, its protocol, its directory source and its test environment, plus the applications excluded from the first phase. The quote should separate one-time work from recurring support, and it should name deliverables such as architecture documentation, configuration exports, test evidence, runbooks and the access control procedure text. Confirm who handles the MFA rollout, the emergency access test and the automatic logoff test, and whether those tests run in production or in staging. Request the acceptance criteria, the change control process and what happens if a legacy application cannot integrate. Compare bids on the same scope list, not on headline totals.

No. HHS states that no Security Rule standard requires certification and that it does not endorse private certifications, so a vendor or partner cannot provide HIPAA certification. DeployOpen prepares systems, controls and evidence for compliance assessments, including configuration exports and test records that support access control requirements. Independent auditors and certification bodies issue audit reports and attestations, and OCR enforces the Security Rule through complaints, compliance reviews and audits. Use the engagement to produce evidence that your own compliance program can review, and confirm with your privacy and compliance counsel what documentation your organization must keep.

A pilot covers a small set of applications, one directory and the core SSO and MFA settings, so it validates the platform before large scope is committed. The full rollout adds the remaining applications, legacy workarounds, clinical training, shared workstation testing and the documentation set. Effort rarely scales in a straight line, because the first integrations establish patterns, and later integrations are often faster if the applications share protocols. The pilot's results should show how many applications need custom work and which ones need a different approach. Ask the partner to include a pilot exit review in the written scope so the second phase is priced from real findings.