By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Identity Proofing
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
Identity proofing is the process of providing and checking enough information, such as identity history, credentials, and documents, to establish a person’s identity with a registrar or credentialing authority before an identity is issued.
The HIMSS Dictionary frames the term using the federal Personal Identity Verification context, where an applicant gives evidence to a registrar. The same idea applies throughout health care: before a clinician receives a login, a prescriber receives an electronic signing credential, or a patient receives portal access, someone must decide whether the person is who they claim to be.
| Step | Question | Healthcare Example |
|---|---|---|
| Identity Proofing | Is this person who they claim to be? | Checking photo ID for a new employee badge |
| Credential Issuance | Which credential does this verified identity receive? | Account created and token issued |
| Authentication | Is the person using the credential the same person? | Password plus phone prompt at login |
| Authorization | What is this person allowed to do? | Role-based permissions to sign orders |
| Accounting | What did the person do? | Audit trail of chart access |
⚠️ Exam Alert: Identity proofing happens once, at enrollment, to establish identity. Authentication happens each time someone signs in, to confirm the credential’s holder. Authorization decides what the person can do. Strong authentication cannot compensate for weak proofing, because a credential issued to an impostor is still a valid credential.
🌐 Why It Matters: Real-World Healthcare IT Context
Everything downstream in identity and access management relies on the first step. If a new account is created for the wrong person, no password policy, token, or audit log can undo the original mistake. In health care, those mistakes carry serious consequences: impersonators with access to records, prescriptions, or financial information.
NIST provides the most widely referenced framework. Its digital identity guidelines, SP 800-63 Revision 4, published in July 2025, replaced Revision 3 and cover identity proofing, authentication, and federation. The identity proofing volume describes identity assurance levels that scale with the risk of a fraudulent identity. At the lowest level, the goal is to limit highly scalable attacks such as automated enrollment and to protect against synthetic identities and compromised personal information. At the middle level, more evidence and more rigorous validation and verification are required, and proofing can be remote or on-site, attended or unattended. At the highest level, a trained representative interacts directly with the applicant in an attended, on-site session that includes collecting a biometric characteristic.
Electronic prescribing of controlled substances shows proofing in a regulated setting. DEA rules require individual practitioners to obtain a two-factor credential after identity proofing by an approved credential service provider that meets Assurance Level 3 or higher under the NIST guidance the rule incorporates, or from a qualifying certification authority. Institutions can have a credentialing office check government-issued photo identification against the person and confirm current DEA and state authorization.
Patient-facing proofing is harder. Health systems want portals and apps to be easy to join, yet portal accounts expose sensitive information. Common approaches include confirming identity at registration with photo identification, using one-time codes sent to contact information already on file, knowledge-based questions, remote document and selfie verification, or in-person activation. Each trades convenience against risk, and organizations should match the method to the sensitivity of what the account can do. Proxy access for family members or caregivers adds another layer, since the proxy’s identity and relationship must both be established.
HIPAA includes a related requirement. Before disclosing protected health information, a covered entity must verify the identity and authority of the person requesting it, using reasonable measures that depend on the situation. Front desk, release of information, and call center staff apply this principle every day.
Workforce onboarding depends on proofing as well. Human resources, credentialing, and security teams verify identity and licensure before granting access to clinical systems, and contractors, vendor staff, and students need the same discipline. Remote hiring has increased the need for strong verification.
Medical identity theft shows what happens when proofing fails. Using another person’s identity to obtain care or prescriptions can pollute the victim’s record with wrong diagnoses, medications, and balances.
Common identity proofing weaknesses:
- Accounts created on the word of the requester alone
- Weak knowledge-based questions based on public information
- Inconsistent checks for contractors, students, and vendors
- No distinction between low-risk and high-risk accounts
- Proxy access granted without verifying the relationship
- Proofing records not retained or reviewed
What supports strong identity proofing:
- Risk-based assurance levels for different accounts
- Government-issued photo ID checks with trained staff
- Separate, documented processes for workforce, prescribers, and patients
- Verification of licensure and authority, not only identity
- Safeguards for remote proofing, such as document and liveness checks
- Periodic reviews of accounts and credentials
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses encounter identity proofing at several points: when they are hired, when they ask for access, and when they help patients and families.
At the Bedside
Patients and families often ask nurses how to get portal access or why identity must be confirmed before information is shared. Explaining that verification protects the patient’s privacy, and pointing to the registration or portal help desk, supports trust.
Callers who ask for information about a patient should be directed to the organization’s verification process rather than receiving details on the basis of a name or a claim of relationship.
In Clinical Workflow
Staff who help patients enroll in portals or complete forms can reinforce good habits, such as bringing photo identification and never sharing activation codes.
Accounts belong to individuals. Nurses should not let colleagues, students, or temporary staff use their login, even briefly, because the account was proofed for one person.
Nurse informaticists contribute by reviewing how proofing steps affect clinical roles, such as the time students and agency nurses wait for access, and by highlighting the patient experience in portal enrollment.
In EHR Implementation (Go-Live Perspective)
An Epic Go-Live requires accounts for large numbers of staff, including providers who need prescribing credentials, super users, and temporary support staff. Access requests depend on identity and role verification completed early, so training can begin without delay.
At-the-elbow support analysts see the effect of proofing gaps when a user cannot log in or lacks prescribing authority. Quick, accurate routing to the security and access teams prevents lost clinic time.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Identity proofing appears in security, access, and registration questions:
| CAHIMS Domain | How Identity Proofing Appears |
|---|---|
| Healthcare & Technology Environments | NIST digital identity guidance, DEA and HIPAA requirements |
| Clinical Informatics | Patient identification, portal enrollment, proxy access |
| Healthcare Information & Systems Management | Identity and access management, credential issuance, remote proofing |
| Management & Leadership | Risk-based policy, onboarding governance, fraud prevention |
Key Terms to Know Alongside Identity Proofing
- Authentication — confirming that a person using a credential is the credential’s rightful holder
- Authorization — deciding what an authenticated person may do
- Identity Assurance Level (IAL) — NIST measure of confidence in an identity proofing process
- Credential Service Provider (CSP) — organization that proofs identity and issues credentials
- Identity and Access Management (IAM) — policies and tools for managing digital identities and access
- Medical Identity Theft — use of another person’s identity to obtain care or benefits
HIMSS Organizational Position
HIMSS supports patient identification, privacy, and cybersecurity through its Healthcare Cybersecurity Community, policy work, and education. Members can find related resources through the HIMSS Resource Center.
🔗 Explore Further: External References
- NIST — SP 800-63-4, Digital Identity Guidelines https://csrc.nist.gov/pubs/sp/800/63/4/final
- NIST — SP 800-63A-4, Identity Proofing and Enrollment https://pages.nist.gov/800-63-4/sp800-63a.html
- eCFR — 21 CFR 1311.105, Requirements for Obtaining an Authentication Credential, Individual Practitioners https://www.ecfr.gov/current/title-21/chapter-II/part-1311/subpart-C
- eCFR — 45 CFR 164.514, Other Requirements Relating to Uses and Disclosures (Verification) https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514
- ONC — Patient Identity and Patient Record Matching https://healthit.gov/standards-and-technology/patient-identity-and-patient-record-matching/
- ONC — Individuals’ Access and Use of Patient Portals and Smartphone Health Apps, 2022 https://healthit.gov/data/data-briefs/individuals-access-and-use-patient-portals-and-smartphone-health-apps-2022/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply