Blockchain continues to gain traction in the market place as a compelling solution for making identity and access management (IAM) more cost effective by harnessing the power of distributed members in order to “crowdsource” identity services. This session will review an attempt to prove this hypothesis through a proof-of-concept (POC) built for a not-for-profit healthcare consortium. Learning Objectives: 1: Learn what blockchain is and how it can help solve problems within IAM. 2: Understand the intended end-state and key players in the blockchain identity ecosystem. 3: Learn about the key elements and lessons learned from this POC. (Source: RSA Conference USA 2018)

1. SESSION ID:
#RSAC
Kurt Lieber
CAN BLOCKCHAIN ENABLE IDENTITY
MANAGEMENT?
IDY-R12
VP, CISO of IT Infrastructure
Aetna
Prakash Sundaresan
Chief Technical Officer
Trusted Key

2. #RSAC
What we are hearing about IdenIty
1. A poor user experience
ResulIng from the need for
mulIple credenIals and
enrollments when a member:
• Makes an appointment
(Payer/Provider)
• Sees a physician (Provider)
• Files claims (Payer)
• Picks up a prescripIon
(Pharma, other ecosystem
partners)
3. Dependence on for-profit
enJJes for idenJty-proofing
services
IdenIty-proofing services in the
market today are provided by a
few commercial enIIes who can
charge a premium price due to the
lack of compeIIon. This results in
implied trust and “unchecked
power” which may sIfle
innovaIon and increase health
care costs for the member.
4. Provider credenJaling is
repeJJve and Jme-
consuming
The credenIaling process (e.g.,
requests for medical transcripts,
state licenses, background check)
is repeated each Ime a provider:
• Joins a new facility as part of a
float pool
• Moves to a different health
system
2. DuplicaJve IAM efforts
and infrastructure costs
NH-ISAC working group and other
partners in the health ecosystem
each maintain their own idenIty
infrastructure (and bear the
associated costs).
Leading to: Increased costs
2

3. #RSAC
Example: A member has to manage separate idenIIes and NH-ISAC
consorIum partners have to manage separate IAM infrastructure
Provider
Care delivery
CollecIons
Compliance
Customer service
Denials or referrals
PaIent access
PaIent engagement
Telemedicine
Payer
Billing and premium
Care management
Claims
Compliance
Customer service
Membership management
Plan or product
management
Provider
networks
Other ecosystem partners
Pharma, regulatory, retail and telecom.
PaIent portals Mobile
Wearables
Benefits and claims
portal
Social media
Implantables
Self-
service
Sensors and monitors
Care
coordinaIon
Member
1. A member uses different credenIals
across the digital health life cycle.
2. A member provides personal
informaIon mulIple Imes
3. Payers, providers, other partners
(collecIve NH-ISAC consorIum
partners) maintain separate IAM
infrastructure
3

4. #RSAC
A DAY IN THE LIFE OF A MEMBER

5. #RSAC
“Day in the life” of a member video

6. #RSAC
Our vision: Shared idenIty
Users: members (B2C)
and providers (B2E)
ConIngent
workers
Business
partners/
vendors
Employees
Customers Devices Own
Relying parJes: Providers,
Payers, Partners (NH-ISAC
consorJum members)
Access administraIon
IdenIty data services
Access enforcement
Use
Proofers: Providers, Pharmacy, etc.
Data exchange vendors
Government agencies
Health payer/providers (incl. NH-ISAC)
Vet
Document verificaIon apps
Portable idenJty
“Vet once, use many”
Users own a portable
idenIty which is
accepted across the
health ecosystem.
Proofers vet abributes of
a user increasing the
fidelity of a user’s trust
score over Ime.
Relying parIes use the
portable idenIty to
make access decisions.
6

7. #RSAC
The NH-ISAC Portable ID…
Is an idenIty for members or providers
Aims to improve the user experience and lower health care costs through efficiency gains
Is built on open standards (e.g., NIST 800-63)
Has a non-profit moJve where the working group:
— Establishes governance, leading pracIces and guidelines
— Collaborates with other standard bodies (e.g., SAFE Biopharma), privacy working groups
— Shares the cost of infrastructure
Is in proof-of-concept stage
Is a supplement to exisIng IAM infrastructure
7

8. #RSAC
What it is NOT
Meant to store Personal Health InformaIon (PHI).
A replacement for electronic medical records (EMR).
A replacement for industry frameworks (e.g., SAFE Bio-pharma Trust Framework, NIST).
A replacement for exisIng individual NH-ISAC consorIum IDs (e.g., Aetna ID, CVS ID etc.).
A replacement for all exisIng IAM infrastructure.
Set in stone. This is a proof-of-concept and we are conInually incorporaIng feedback from the
field.
Meant to exist in a silo. IntegraIon with other standards bodies, idenIty working groups is key.
8

9. #RSAC
An example of how the POC would work
On day 1 and ongoing basis
FirstName
LastName
DLN (High trust level if selfie verified)
DOB
Address
Trust Level
Portable idenJty (blockchain)
2. Providers verify a user (on day 1 and during regular touch points with members)
1. Member performs iniIal idenIty capture and form fill (with web form if needed)
AbestaIons of abributes
Verified idenIty
Blockchain-based
ledger
Scan driver’s license and
(take selfie for facial
recogniJon)
IdenIty requestor and exisIng IAM
infrastructure (NH-ISAC relying parIes)
Complete web form (import
IDs from NHISAC partners as
appropriate)
Verify last name Verify DOB
Verify addiIonal
abributes
Acquired user abributes
9

10. #RSAC
TECHNICAL DEMO

11. #RSAC
IntroducIon – How will the member get the app?
• Mobile friendly
• Something that will always be carried with the member
• Discoverable through app stores
• Member to be made aware of the app during the insurance
enrollment process
11

12. Day 1 - Member Enrollment

13. #RSAC
On Day 1 - Enrollment
• Seamless enrollment on Day 1 by:
• ImporIng exisIng IDs with NH-ISAC partners
• Form fill thru driver’s license scan
• Trust Level 1 verificaIon with self asserted abributes
• Trust Level 2 with remote driver’s license verificaIon
13

14. Going to the provider

15. #RSAC
When going to the provider
• “Passwordless” login through biometrics (e.g., FaceID)
• Easy check-in at provider’s office by QR code scan
• Similar to a mobile boarding pass
15

16. #RSAC
Wearable check-in – for those with their hands full…
• Added convenience without having to reach for your phone
16

17. Checking the member in

18. #RSAC
Provider’s perspecIve – whattherecepIonistattheproviderdoes…
• Provider has a companion app in
the office
• On an iPad
• Provider verifies the ID
concurrently with check-in
• Trust Level 3 – in-person
verificaIon with provider
• Usage / asserIon history can be
used by insurance provider for
proofing (opIonal)
18

19. #RSAC
Can Blockchain enable IdenIty? – Sniff Test
19
Are the answers to any of these “Yes”?
Portability
Are there mulIple parIes that could benefit from sharing idenIty data?
Can we enhance the user experience by enabling a single idenIty at different
places?
Cost Savings
Is there a duplicaIon of idenIty infrastructure across the ecosystem?
Is there a reliance on commercial enIIes for proofing services?
Persistence
Is the use case "write once - read many"?

20. #RSAC
Lessons Learned
20
Driving adopIon from stakeholders is key, non-profit moIves help
Maturity of blockchain tools are sIll evolving
Front-end, UI/UX design is key:
The end-user should not know that Blockchain was used
Don’t try to change consumer behavior
PHI should not be put on the blockchain (tough sell)
Co-existence with IAM tools is necessary

21. #RSAC
Apply What You Have Learned Today
21
IdenIty + Blockchain = Portability
Enable digital trust across
untrusted parIes.
Decentralized, sovereign,
immutable fabric
IdenIty Management
plaporms (e.g., AuthN,
authZ, directory)

22. #RSAC
Apply What You Have Learned Today
22
Next week you should:
IdenIfy idenIty issues related to portability, duplicaIon and costly proofing
In the first three months following this presentaIon you should:
Summarize your idenIty pain points, interested business partners
Explore a proof-of-concept
Socialize the vision with key sponsors, customers and gauge interest
Within six months you should:
Expand the proof-of-concept to other business partners
Conduct a roadshow at industry consorIums to drive awareness and
adopIon