OpenText™ Identity Manager Driver for Epic Implementation Guide

Epic is an Electronic Medical Records (EMR) management system that maintains medical records and provides providers and patients with access to said medical records. Epic is the leading EMR system in use throughout the healthcare industry. Epic contains PHI and PII and is therefore required to meet HIPAA regulatory requirements.

Driver Concepts

The Identity Manager (IDM) Driver for Epic is a connector that allows for identity life cycle management of Epic EMP (login account) and Epic SER (provider) records.

Since Epic does not have an event system or full database query facility, the driver operates on the Subscriber channel only.

Epic does not utilize groups as part of its security architecture. Instead, Epic utilizes the concept of security templates to assign access within the application. The Epic driver takes advantage of this architecture and allows the assignment of these templates and sub-templates within Epic via the assignment of IDM entitlements. A user may only have a single active template, but the assignment of sub-templates provides for supplemental security access within the Epic system.

Due to user associations, the best practice is to have a separate driver instance for EMP and SER communications.

Data Transfer Between Systems

The Epic driver communicates with Epic using Epic’s Web Services.

Thus, an Epic Interconnect Web Server must be licensed and enabled within each customer’s deployment Epic environments. Contact the Epic administrator to enable this service.

Publisher Channel

Due to the Epic architecture, the publisher channel is not supported on this driver.

Subscriber Channel

The Epic driver synchronizes the User class and attributes from the Identity Vault to Epic, via the subscriber channel. Attributes synchronized are specific to each implementation but typically contain the CN, Given Name, Surname, Login Disabled, and other user-level attributes.

How the Driver Works

The Epic driver shim is a Java shim that communicates with Epic environments via an Epic Interconnect server and Epic REST web services.

The manually exported CSV files contain the entitlement data (such as Linkable Templates, Sub-Templates, External Identifiers, In Basket Classifications, and Blueprints) that needs to be regularly exported by your Epic Security team and copied to the Identity Manager server.

Standard Use Cases

The following is a list of standard use cases and benefits of the Epic driver:

  • Automatic record creation in Epic.

  • Automatic updates in Epic on managed records and attributes.

  • Mapping of Epic security template assignment to job or business roles in IDM.

  • Mapping of Epic security template assignment to business roles or technical roles in Identity Governance.

  • Security templates may be assigned via driver policy in the Epic driver.

  • Security templates may be assigned via role and resources in IDM Dash.

  • Security templates may be assigned via role and resources in Identity Governance.

  • Ability to re-evaluate Epic security when roles change within the organization.

  • Ability to enforce least level of security within Epic.

  • Management of external account assignments within Epic.

  • Management of SER record assignments within Epic.