Imo, the defining problem in healthcare and EMR security is twofold in that 1. physicians delegate tasks, often in real time, and the current identity and authN

Imo, the defining problem in healthcare and EMR security is twofold in that 1. physicians delegate tasks, often in real time, and the current identity and authN protocols themselves just don't support that delegation workflow pattern, and 2. healthcare is almost never an enterprise, it's a federation, so until we solve federated authorization in open systems, we're going to suck for the same old reasons. Health care workers workaround was password sharing, but MFA breaks that by design. I have worked on custom delegation schemes that used obo attributes, but then it's just that - some proprietary system you have to convince EMR vendors to write an integration for. There are a few startups doing authorization as a service, and decoupling authZ from authN, but the adoption pace in health is so slow I'd bet on that being almost a decade away from normal use. I've implemented my own delegation schemes in apps (similar to just how you invite people to a document in google docs or office), but that also presumes a document-centric application, where EMR's and a number of clinical systems instantiate a patient profile from disparate data sources using an integration facility (not unlike an SOA service bus or microservices architecture), where we're just happy to have achieved coarse grained access control, but haven't yet figured out pervasive identity for fine grained control like say, attribute level consent directives. e.g. The legacy Oracle DB or Tandem mainframe you're pulling a test result from doesn't have an integration for a XACML(hah!) or UMA2 policy definition point, and where do you put the policy enforcement points - in the app service, an integration facility, a topology manager, or said wrapper over a legacy service? I know there are startups doing this, but as a market, healthcare is a quagmire that makes it really hard for a startup depending on traction to survive. Delegation is solvable in a closed system or platform, but once you add federation, you need a protocol and platforms that speak it. Personally, I don't think we need new IAM platforms (the best ones do something close to what we need), we need new protocols that support things like delegation, data tokenization, consent directives on data and other fine grained policies. Even though there are people who correctly will say, "some of these are solved problems, clearly you haven't heard of X," but I'd argue without traction with the staff in agencies who make architecture decisions about it, e.g. people whose job to know about your solution don't know about it, it's not part of the conversation. Super interesting topic. Would love to be corrected on the current availability of something like federated delegation though.