Privacy implications for single sign-on authentication in a hospital environment

ABSTRACT

Healthcare providers and their IT staff, working in an effort to balance appropriate accessibility with stricter security mandates, are considering the use of a single network sign-on approach for authentication and password management. There is an inherent tension between an authentication mechanism's security strength and the privacy implications of using that authentication technology. This is particularly true with single sign-on authentication. While single sign-on does facilitate authentication, our on-going field work in a regional hospital reveals several unanticipated privacy implications.

REFERENCES

• 1: Anne Adams , Martina Angela Sasse, Users are not the enemy, Communications of the ACM, v.42 n.12, p.40-46, Dec. 1999 [doi>10.1145/322796.322806]
• 2: National Research Council. (2003). Who Goes There? Authentication Through the Lens of Privacy. Washington, DC: National Academy Press.
• 3: Jøsang, A., et al. (2005), Trust Requirements in Identity Management. in Australasian Information Security Workshop. Newcastle, Australia.