ADSelfService Plus in action

How to protect ePHI and meet HIPAA password requirements with ADSelfService Plus

Ensure healthcare information security with strong password policies

It's common knowledge that most healthcare organizations rely heavily on passwords to secure access to their sensitive data, including ePHI. Hackers only need one compromised credential to get into an organization's network and wreak havoc. One challenge of HIPAA compliance is ensuring that doctors and other medical staff use strong passwords to secure their accounts. Organizations need an ePHI security solution that ensures data security by improving password complexity requirements.

How to protect ePHI and comply with HIPAA

Section § 164.308(a)(5)(ii)(D) of HIPAA mandates that admins enforce "procedures for creating, changing, and safeguarding passwords." The HIPAA security rule is vague, calls password management "addressable," and gives no specific details on password complexity, so we look to the Department of Health and Human Services Office for Civil Rights for guidance. They ensure that their employees' passwords:

1. Include American Standard Code for Information Interchange (ASCII) characters.
2. Be between eight and 64 characters.
3. Not follow any particular pattern or be easy to guess (e.g. "1234567"). Learn more about weak passwords.
4. Not be identical to a user’s 10 previous passwords (the password history rule).

Password Policy Enforcer

ADSelfService Plus, a password management solution, offers the Password Policy Enforcer that provides advanced password policy settings and helps ensure healthcare data security. Admins can create multiple custom password policies based on users’ privileges, and enforce these policies based on OUs and groups.

How to configure advanced password policy settings with ADSelfService Plus

1. Log in to the ADSelfService Plus admin portal.
2. Navigate to the Configuration tab. Under the Self-Service section, select the Password Policy Enforcer.
3. Enable Enforce Custom Password Policy.

   

4. In this section, the administrator can manage:
   1. Characters: Restrict the number of special characters, numbers, and Unicode characters that users can use.
   2. Repetition: Enforce a password history check during password reset, and restrict the consecutive repetition of a specific character from the username (e.g. “aaaaa” or “user01”).
   3. Patterns: Restrict keyboard sequences, dictionary words, and palindromes.
   4. Length: Specify the minimum and maximum password length.
5. Admins can also enable users to bypass complexity requirements when the password length exceeds a predefined limit (say, 20 characters).
6. Enter the number of policy settings the user’s password must comply with during self-service password reset and password change operations.
7. Enforce the configured password policy settings during password resets from the ADUC console and the change password screen.
8. To help users create passwords that comply with the enforced policy settings, admins can display the password policy requirement on the reset and change password pages.

   Tip: Offer visual feedback on user password strength by employing the Password Strength Analyzer. To enable it, open the Configuration tab → Self-Service section → Policy Configuration. Click Advanced. In the window that opens, go the Reset & Unlock tab. Enable Password Strength Analyzer.

Highlights