Lab Identity Governance Fabric · reference

Healthcare Identity Governance — Epic EMR Acute Facility

who owns what across the identity lifecycle in an acute-care hospital running Epic — a reference RACI and swimlane that the lab fabric maps onto one-to-one

The load-bearing idea

In healthcare, providers aren't hired — they're credentialed. The Medical Staff Office is a second authoritative source alongside HR, and Epic role/template assignment is its own governed step. So the ownership map has more lanes than a typical enterprise — but it is exactly the shape the lab's HRIS → IGA → ITSM → PACS + Duo fabric already governs. This page is the customer-facing reference a technical leader brings to a healthcare Duo engagement.

The provider lifecycle — ownership swimlane

Joiner is credential-driven; leaver inverts to disable-first, notify-after, with a single signed SSF/CAEP event pulling logical and physical access together.

sequenceDiagram
  participant HR as HR / Workforce
  participant MSO as Medical Staff Office
  participant IAM as IAM / Identity
  participant EPIC as Epic Security
  participant DUO as Duo · MFA / SSO
  participant IGA as IGA / Governance
  participant PACS as Physical Access
  Note over HR,MSO: JOINER — credential-driven
  MSO->>MSO: credential + privilege → SER record
  HR->>IAM: staff worker record
  MSO->>IAM: provider identity
  IAM->>DUO: enroll MFA + tap-and-go
  IAM->>EPIC: request Epic template
  EPIC->>EPIC: assign role / subtemplate
  IAM->>PACS: badge to assigned units
  IGA->>IGA: baseline access cert + SoD
  Note over HR,PACS: LEAVER — disable-first, notify-after
  MSO->>IGA: privilege end / termination
  IGA->>IAM: disable identity
  IGA->>DUO: session-revoked (SSF / CAEP)
  DUO-->>EPIC: kill EHR session
  DUO-->>PACS: revoke badge

Who owns what — identity RACI

Nine lifecycle activities across the seven owners in an Epic acute facility. Clinicians invoke break-glass and the data/application owner approves access requests — both fold into Consulted below.

Activity	HR	Med Staff	IAM	Epic Sec	IGA	SOC/ITDR	Compliance/HIM
Onboard staff (nurse / tech)	A	—	R	C	I	—	I
Credential + onboard provider	C	A	R	C	I	—	C
Epic role / template assignment	—	C	C	A	C	—	C
Access request (add'l system)	—	C	R	C	A	—	I
Mover (unit / role / locum)	A	C	R	C	C	—	I
Leaver + real-time revoke	C	C	A	R	R	C	I
Break-glass emergency access	—	C	I	R	I	R	A
Access certification / recert	I	C	C	C	A	—	C
HIPAA access audit / ITDR	—	—	I	C	C	R	A

R Responsible — does the work A Accountable — owns the outcome C Consulted — two-way input I Informed — one-way notice

How it maps to the fabric

Every owner lane above is a component the lab already runs — the rehearsal is the customer's org chart in miniature.

HR / Workforce → HRIS-Lite (Workday-style SoR · JML authority)

Medical Staff Office → IGA-Lite (credentialing as a second source)

IAM / Identity → AD / Entra / Duo (provisioning · MFA · tap-and-go)

Epic Security → application owner, governed via ITSM-Lite change gate

IGA / Governance → IGA-Lite (recert · SoD · access review)

SOC / ITDR → SSF/CAEP + CII risk feed (real-time revoke)

Compliance / HIM → ITSM-Lite hash-chain audit + access review

Physical Access → PACS-Lite (SCIM badge · SSF revoke)

The "so what" for a Duo customer

The point isn't a new product — it's that this ownership map already exists in the customer's org. The fabric just makes each lane a governed, auditable step on the identity they already run: Duo as the decision point, the same joiner/mover/leaver, extended to Epic roles, break-glass, and the door. A technical leader can walk a healthcare customer from "we govern access by hand across HR, the Medical Staff Office, and Epic" to "one identity truth, continuously governed, with real-time revoke."