©2015MedImpact,Inc.Allrightsreserved.
ThecontentsofthispresentationareconfidentialandproprietarytoMedImpactHealthcareSystems,Inc.andmaycontainmaterialMedImpactconsidersTradeSecrets.Thispresentationmaynotbereproduced,transmitted,published,ordisclosedtootherswithoutMedImpact’spriorwrittenauthorization.
MedImpactandFIDOACaseStudyofaUAFDeploymentFIDO Alliance SeminarWashington DCOct 6th 2015
Presented by Steven Secker
MedImpactHealthcareSystems,Inc.
©2015MedImpact,Inc.Allrightsreserved.
TopicsforthisCaseStudy
•WhyFIDOforMedImpact?•OurUseCases•DeploymentStrategy:WheretoStart&Why•WhyFIDOUAFratherthanFIDOU2F?• FuturePlans•Discussion/Q&A
©2015MedImpact,Inc.Allrightsreserved.
WhatMedImpactDoes:PBMMedImpactmanagespharmacybenefitsformorethan50millionlivesaroundtheglobe
PharmacyBenefitManager
Claim
ApprovalCopayAmount
Drug-to-DrugWarnings
Invoice
Health InsuranceCompany
PayPharmacyforApprovedClaims
©2015MedImpact,Inc.Allrightsreserved.
SoWhyFIDO?
PharmacyBenefitManager
Claim
ApprovalCopayAmount
Drug-to-DrugWarnings
Invoice
Health InsuranceCompany
PayPharmacyforApprovedClaims
Allofthisstuffisbehindthescenesasfarastheaverageconsumeris
concerned.
SowheredoesFIDOfit?
©2015MedImpact,Inc.Allrightsreserved.
OurBusinessRequiresDataAccess
©2015MedImpact,Inc.Allrightsreserved.
ITSecurityinHealthcare:HIGHPRIORITY!
©2015MedImpact,Inc.Allrightsreserved.
HealthcareDataTargetedSpecifically
“Yourmedicalinformationisworth10timesmorethanyourcreditcardnumberontheblackmarket.”
©2015MedImpact,Inc.Allrightsreserved.
LikeEveryoneElse,We’veReliedonPasswords
Foryearswe’veknowthisisbroken,buttherewasn’taclearlybetterwayuntilFIDO!
©2015MedImpact,Inc.Allrightsreserved.
UseCasesforMedImpact
MembersofHealthInsurancePlans:
• Whatdrugsarecovered?• What’smycopayforthisdrug?• DoIneedaPriorAuthorization?• HaveImetmydeductible?• Whatpharmaciesareinmynetwork?• HowmuchdidIspendonprescriptionsfortaxesor
FlexSpendingAccount(FSA)reimbursement?• HowgoodhaveIbeenabouttakingmymaintenance
meds(gettingthemrefilledontime)?
©2015MedImpact,Inc.Allrightsreserved.
UseCasesforMedImpact
HealthcareProviders:
• Whatotherdrugsismypatienttakingthatotherdoctorsprescribed?
• Hasmypatientbeentakinghisorhermaintenancemeds(gettingthemrefilledontime)?
©2015MedImpact,Inc.Allrightsreserved.
UseCasesforMedImpact
Pharmacists:
• HaveIbeenaccuratelyreimbursedforalltheclaimsI’vesubmitted?
©2015MedImpact,Inc.Allrightsreserved.
UseCasesforMedImpact
HealthInsuranceCompanies,MCOs,HMOs,Self-InsuredPlans:
• ManageMemberEligibility• BenefitDesign• FormularyManagement• PriorAuthorizationManagement• ManageDeniedClaimsAppeals• Allmanorofreporting
©2015MedImpact,Inc.Allrightsreserved.
UseCasesforMedImpact
MedImpactEmployeesauthorizedtoaccessproductiondata
©2015MedImpact,Inc.Allrightsreserved.
UserCommunityProfiles– WheretoStart?#ofUsers FrequencyofUse OS/Browser Mobile
BrowerApp
PotentiallyMillions
+90daysbetweenvisits
AllUncontrolled Yes Future
PotentiallyThousands
VariesGreatly
WindowsIE11/Firefox
No NoPlans
TensofThousands
WeeklytoMonthly WindowsIE11/Firefox No
NoPlans
Thousands Daily WindowsIE11/Firefox
No Future
Thousands Daily WindowsIE11/Firefox
NoPlans
NoPlans
©2015MedImpact,Inc.Allrightsreserved.
SecurityandUsability– ROIforUserCommunities
©2015MedImpact,Inc.Allrightsreserved.
UAFvs.U2F• Followtheleadofearly
deployments (Google,Dropbox)
• Userexperience buildsontopofongoodold,familiarusernamepassword
• Lesspotential forconfusionaboutusingmultiple computers
U2F
UAF
• Getsridofthepasswordcompletely
• Usersalwayshavetheirphones,andmillions ofthosephoneshavefingerprintreaders
Arguably,U2Fwouldhavebeenaneasierpathgivenourtargetusercommunityandtheirusecasesforthe initialdeployment. Butyoustill forceuserstochoseandrememberapassword
“Getsridofthepasswordcompletely”wonthedayforus
©2015MedImpact,Inc.Allrightsreserved.
DeviceKnowsYou,WebsiteKnowsYourDevice
AccessWebsite1
SwipesFingerprint3
FIDOAuthenticationRequest Sentto
Laptop
2
©2015MedImpact,Inc.Allrightsreserved.
DeviceKnowsYou,WebsiteKnowsYourDevice
AccessGranted
5
Cryptographicallysignedmessage
confirmsuserbacktowebsite
4
©2015MedImpact,Inc.Allrightsreserved.
LongTermVision:WorkswithPhoneToo
AccessWebsite1
SwipesFingerprint3
FIDOAuthenticationRequest Sentto
Phone
2
©2015MedImpact,Inc.Allrightsreserved.
Challenges/DiscussionPoints
• Prioritization:gettingthebusinesstoagreetoallocatedevelopmentcyclestoaddingFIDOsupportrequireseducation,internalandexternalmarketing,evangelismandhigh-levelexecutivesponsorship
• FallbackSolution:whatdousersdoiftheyneedtologinanddon’thavetheirlaptop(orinthefuture,phone)withthefingerprintreader?
• Messaging:howdoyouexplainthistouserswhoarenotlikelytogoreadwww.fidoalliance.organdrealizewhatagreatsolutionthisis?DoyoucallattentiontotheFIDObrand?Howdoyouovercomefearslike“Icanresetapasswordifit’sstolenfromyourserver,butIcan’tresetmyfingerprint!”
• Client-SideObstacles:Lackofbuilt-insupportforFIDOclientatOSlevelmeansusersneedinstall/configureaFIDOclientfortheirbrowser(FIDO2.0IbelieveaimstosolvethisandalreadyWin10hasbuilt-insupport)
• Support:RollingoutFIDOsuccessfullyrequireseducatingtheentireITsupportteam,fromfront-linecallcenterstafftoLevel2and3engineers.
©2014MedImpact,Inc.Allrightsreserved.
Questions
Recommended
