Health systems inherit the patients that IAL2 proofing turns away

The week

In the summer of 2025, two federal moves set out to change how patients get into their own records online, and by August 2026 the change was starting to show up in practice. Until then, seeing your own test results usually meant a separate username and password for each hospital or clinic, and perhaps a forgotten-password loop or two.

The first move came in July 2025, when NIST finalized Revision 4 of its Digital Identity Guidelines, known as SP 800-63-4. NIST, the National Institute of Standards and Technology, writes the technical rulebooks that federal agencies follow and that much of the private sector borrows. These guidelines cover three things. Identity proofing is checking that you are who you say you are, usually by examining an ID document. Authentication is proving it is still you each time you log in. Federation is letting one trusted service vouch for you to another.

The revision updated all three. It accommodated synced passkeys, a modern replacement for passwords that lives on your phone or computer and can be backed up across your devices. It added controls against forged media, such as fake ID images, and against injection attacks, where a criminal feeds a pre-recorded or synthetic video into a verification system instead of a live camera. And it formalized alternatives for people who cannot complete standard proofing, including trusted referees and applicant references, which we explain below.

The second move came the same month. CMS, the Centers for Medicare & Medicaid Services, launched its Interoperability Framework and asked health networks and apps to pledge to it. Interoperability simply means different systems being able to share information. Under the framework, a patient with a CMS-approved credential at IAL2 or equivalent, such as a mobile driver’s license, and AAL2 authentication, such as a passkey, should get records without a separate portal login.

Those letters matter. IAL2, or Identity Assurance Level 2, means your identity was checked to a fairly high standard, typically against a government photo ID. AAL2, Authenticator Assurance Level 2, means your login uses two factors or something equally strong, so a stolen password alone is not enough.

By August 2026, CMS reported that numerous companies had reached general availability in July, at the ecosystem’s one-year mark. General availability means a product is live for everyone rather than in a pilot. Verified credentials were starting to work as a key to patient records.

One key for many doors, and who is left outside

For most patients, a reusable verified credential is an improvement. It replaces a different portal login at every health system with one proofed identity and a passkey. It works like a single, well-made house key that opens your front door, your doctor’s office and your pharmacy, in place of a heavy ring of keys you can never sort through.

For health systems, it moves much of patient identity verification to outside credential services. Those are companies, and in some cases state motor vehicle agencies issuing mobile driver’s licenses, whose business is to check people’s identity once, carefully, and then let them reuse that check. That is welcome: it reduces the time front-desk and help-desk staff spend resetting passwords and confirming who is calling.

It also has a consequence. IAL2 remote proofing typically relies on three things: a government photo ID, a smartphone that can capture it, and data sources that confirm the person exists at an address. In practice the patient photographs a license, takes a selfie, and the service checks the two match and that the details line up with records such as credit or utility files.

The patients least likely to have all of those include older adults, people experiencing homelessness, recent immigrants, young adults with thin records and some people with disabilities. A “thin record” means little financial or address history for a data service to confirm. Many of these patients have heavy health care needs. They are often the people who most need to see a medication list, message a care team or share records with a new specialist.

As credentials do more of the work, the patients who fail them become the health system’s problem in a concentrated form. When everyone used a hospital’s own portal, everyone had the same clumsy experience. When most people glide through with an outside credential, the ones who cannot are left standing at the door, and the hospital is the only one who can let them in.

There are three routes by which a patient’s identity can be established for digital access: a credential issued by someone else, proofing the health system performs itself, and identity vouched for by another person. Each needs its own design, owner and measure. The sections below take them in turn.

Route one: a credential issued by someone else

The first route is the one the CMS framework promotes. A patient proves identity once to an approved credential service and presents that credential to networks and apps. The health system’s job is mostly to accept it well. Its portal and patient-access endpoints need to trust the approved services, match the verified identity to the right medical record, and log each request for later review. An endpoint, in this context, is the specific digital doorway through which an app or network asks for a patient’s records. The framework itself calls for verifiable logs of identity and authorization requests, meaning a tamper-evident record of who asked for what and on what basis.

The matching problem

Matching is the weak point. A verified name, date of birth and address still have to be linked to a record that may hold a maiden name, an old address or a typo from a busy registration desk. The credential proves who the person is; it does not prove which of the hospital’s millions of records belongs to them.

A strict match fails the patient, and a loose one risks disclosing someone else’s record. Take a regional health system. A patient presents a verified credential showing her full name, including a middle name she rarely uses. The hospital holds her record under a shorter version of that name, at an address she left three years ago. A strict rule rejects her, and she gives up. A loose rule might link her to a different patient with a similar name and the same birth year, which would be a privacy breach and, in a clinical setting, potentially a safety problem.

The practical step is to measure match failures for credential-based requests, route them to a trained queue, and fix the underlying registration data. Health information management should own that queue, because it already owns record integrity. Health information management, often called HIM, is the department responsible for the accuracy and completeness of medical records. Every failed match it resolves also cleans up the record for the next request.

The recovery problem

Account recovery is the other weak point. A patient who loses the phone holding a passkey, or whose credential lapses, needs a way back in that is no weaker than the original proofing. If the fallback is a set of knowledge questions answered over the phone, such as a mother’s maiden name or a previous address, an attacker will use the fallback, because those answers are often easy to find or buy. Recovery should route to one of the stronger paths below, and the help desk script should say so.

Route two: proofing the health system does itself

The second route covers patients who cannot or will not use an outside credential. Health systems already verify identity in person every day at registration. Anyone who has handed over a license and insurance card at a check-in desk has been through a version of it. SP 800-63-4 gives that a defined place. On-site attended and remote attended proofing, where a trained operator checks evidence live in person or over a secure video session, are both recognized options at IAL2.

That matters because it means a hospital does not have to buy a product to offer high-assurance identity. It can turn something it already does into a recognized service, provided it does it consistently.

From registration desk to proofing service

Turning registration into a proofing service takes more than policy. Three pieces are needed.

• A short procedure. Staff need a short procedure that says which evidence counts, how it is checked and how the result is recorded against the patient’s account.
• Enrollment on the spot. The portal needs an activation path that issues a passkey at the desk, so the patient leaves enrolled. A patient handed a printed code and told to “set it up at home” often never does.
• A remote option. For patients who cannot travel, a scheduled video session with a trained staff member can serve the same purpose.

The cost is staff time, so the process should be aimed at patients who have already failed remote proofing or who are flagged at intake as likely to. That might be a patient without a smartphone, one who registers without a current photo ID, or one who has called the help desk twice about access.

Watching for fakes

Revision 4 also expects proofing processes to resist forged documents and injected video. Forged documents can now be produced cheaply and convincingly, and injected video means a fraudster can present a synthetic face to a camera feed rather than appearing live. Attended sessions help, because a trained person is watching in real time, but staff need to know what to look for, and the procedure should state when to escalate. Escalation might mean asking for a second document, involving a supervisor, or ending the session and asking the patient to come in person.

Route three: identity vouched for by another person

The third route is the one the revision formalized most clearly. It recognizes that some people cannot produce standard evidence at all, and that a trusted human judgment can stand in for a document.

A trusted referee is a trained agent of the organization who can make a risk-based decision about someone without standard evidence. An applicant reference is a person who vouches for the applicant, such as a caregiver or case worker. The referee is the organization’s own trained judge; the reference is a witness who knows the person.

In a health system, natural candidates already exist. Social workers, care managers, community health workers and clinic staff who know a patient over time can play the referee role under a written procedure. A social worker who has helped a patient experiencing homelessness through three hospital stays is in a far better position to confirm who that person is than any database.

Where vouching meets proxy access

This route overlaps with proxy access, which carries its own risks. Proxy access is when one person is allowed into another person’s record. Parents of minors, adult children of older patients and legal representatives often need access to someone else’s record. The danger is obvious: a person with bad intent, such as an estranged partner, can pose as a helpful relative.

Access rights and minors’ confidentiality differ by state, so the vouching procedure and the proxy procedure should be designed together with counsel. Broader rights, such as full record access for an adult’s representative, should require stronger verification than limited ones. Seeing appointment times is one thing; reading every clinical note is another.

Three patients, three routes

Suppose a health system has been accepting outside credentials for a few months, and three patients try to reach their records in the same week.

The first is a working professional with a recent smartphone and a current driver’s license. She sets up a verified credential through an approved service in a few minutes, adds a passkey, and opens her records through a health app she already uses. Behind the scenes, the health system’s endpoint trusts the credential, matches her verified details to her record and logs the request. She never thinks about identity at all.

The second is a man in his eighties with an older phone and a license that expired after he stopped driving. Remote proofing fails twice. Under the old arrangement he would simply have called his daughter or given up. Here, the failed attempts flag his account, and at his next appointment the registration clerk follows the written procedure: she checks the evidence he does have, records what was checked, and issues a passkey on a simple device before he leaves. If he could not travel, a scheduled video session with a trained staff member would do the same job. His daughter, who helps manage his care, applies separately for proxy access, and because she wants to see full clinical notes rather than appointment times, the procedure asks for stronger verification of her identity and his consent.

The third is a woman staying in a shelter, with no current photo ID and no stable address for a data service to confirm. No automated check will ever pass her. But a community health worker at the health system has seen her regularly for a year. Acting as a trusted referee under a written procedure, he makes a documented, risk-based decision that she is who she says she is, and the portal account is activated. The decision is recorded, the referee is accountable for it, and the procedure sets limits on what access that route can grant.

At the end of the month, the health system’s report shows enrollment completion by route and by patient group. It shows the first patient’s route carrying most of the volume, as expected. It also shows that one group, patients whose preferred language is not English, appears in the remote numbers at a low rate and hardly at all in the other two routes. That is the finding that matters, and it leads to a concrete action: translated instructions at the desk and interpreters available for video sessions.

Cost, risk, patients and regulators

Patients who fail identity proofing still need care, so they phone, come back in person and ask for paper records, each at a higher cost to the health system.

• Patients and equity. If the patients with the heaviest needs are the ones who cannot get through the digital front door, the organization’s digital investment widens the gap it is trying to close.
• Privacy risk. Loose matching or weak recovery can expose one patient’s record to another person. Those incidents carry regulatory, legal and reputational cost.
• Operating cost. Unresolved match failures and failed enrollments turn into phone calls, repeat visits and paper requests, which cost more than doing it right once.
• Regulators and partners. The NIST guidelines and the CMS framework shape what networks, vendors and partners expect. A health system that cannot show sound procedures will find itself explaining why.

Measuring who gets through

Each route needs a measure. The useful one is enrollment completion by route and by patient group, including age, language and payer. Payer means who pays for the patient’s care, such as Medicaid, Medicare or a commercial insurer, and it is often a useful proxy for income. If a population fails remote credentials and never appears in the in-house or vouched routes, the health system has found the patients its digital front door excludes.

In a system that works, outside credentials are accepted smoothly, with match failures counted and fixed by HIM; recovery never falls back to weak questions; registration staff can proof and enroll a patient at the desk or by video; named referees work under a written procedure designed with proxy rules and counsel; and leadership sees a simple monthly report of who is getting through and who is not.

The failures are just as recognizable.

• Assuming the outside credential solves identity, and ignoring the matching step that still sits with the hospital.
• Leaving a weak phone-based recovery path in place, which undoes the strength of the credential.
• Proofing patients at the desk but sending them home to enroll later.
• Treating vouching as informal favors by kind staff rather than a documented process with training and limits.
• Reporting only total enrollments, which hides exactly the groups that are being left out.

Where the digital front door is still shut

• How many credential-based requests fail to match a record, and who works that queue?
• When a patient loses their phone, what exactly happens next, and could a stranger with a few personal details get in that way?
• Can our registration staff proof a patient and issue a passkey before the patient leaves the building?
• Have we named and trained any trusted referees, such as social workers or care managers, and is there a written procedure?
• Can we see enrollment completion by route, age, language and payer, and which groups are missing?

The point of all three routes is the same: every patient who is entitled to their record should have a defined, safe way to reach it, including those without the right phone and the right paperwork.

With hindsight

Credential-based access has become real, if early. Networks and apps have announced CMS-aligned status, and identity providers have promoted IAL2 credentials that work across them. The plumbing is going in, and the marketing has started.

What is missing is evidence. We have not seen published data on how many patients use credentials to retrieve records, or on who fails proofing. Without that, nobody can yet say whether the new front door is widening access overall or simply making it smoother for people who were already well served.

The legal status needs stating clearly. The NIST guidelines remain mandatory only for federal agencies. In health care they shape practice through the CMS framework, network rules and vendor products. A private health system is not ordered to follow SP 800-63-4, but the partners, networks and products it relies on increasingly assume it does.

The trusted referee and applicant reference provisions have drawn less attention than passkeys, partly because they require staff procedures rather than a product purchase. Passkeys come with vendors, demos and launch announcements. A vouching procedure comes with training sessions, sign-offs from counsel and a social worker’s time. That makes them easy to defer.

As more record access runs through outside credentials, though, the patients those credentials miss will need these routes most. The longer a health system waits, the more its digital channel becomes something that works well for the majority and fails the minority who most need it.

The practical reading is to treat identity as a patient-access service with owners and measures, not as a technology feature. Ask for the numbers by route and by patient group, and treat a missing group as a finding. Health systems should confirm specific identity requirements under network agreements and prescribing rules with counsel.