The Implications of a Merger or Acquisition on EPCS

    November 2019 | Todd Johnson, Manager of Identity Management Solutions

    Expert Insights, Identity & Access Management

    Welcome to the third installment of our EPCS blog series!

    My first post provided a breakdown of best practices for a successful EPCS implementation (also see our EPCS Planning Guide). The last post described the authentication methods available for EPCS according to EMR. The below diagram provides a quick refresher…Remember you need to use two factors:

    EPCS-Something you know,are,have-Blog Post FINAL (1)

    Now it's on to part three, which is planning for an acquisition or merger if you already have (or are anticipating) EPCS...


    Step 1-Notify Vendors Upfront 

    In our line of work, it’s common to see smaller organizations picked up by larger ones. This means merging of different hospital environments, which can have far-reaching implications with a lot of rebuilding work. This is no exception for EPCS. If I stress anything in this post, it's the importance of notifying all associated vendors as soon as possible  (whether you're already doing EPCS or planning on doing EPCS).

    Vendors that should be notified up front include: 

    • Forward Advantage 

    • Your EMR vendor

    • DrFirst (if you are a MEDITECH or McKesson customer)

    •  SureScripts 


    Step 2-Consider the Implications 

    Changes to Active Directory User Names

    A hospital that is getting acquired must plan for Active Directory (AD) user names to change to that of the parent organization. For instance, todd@acquiredhospital.com could change to todd@parentorganization.net. If you have MEDITECH (and, therefore, DrFirst) all of this is tied together with an AD account for EPCS signing. This user name is tied to all systems at the hospital and creates several issues when merging with a parent organization. Changes to AD accounts impact EPCS signing, EMR, and associated systems.

    Imprivata OneSign Implications:

    With regards to Imprivata, consider the following:

    • Who currently supports Imprivata OneSign? For instance, does the acquired hospital use Forward Advantage and the parent organization utilizes Imprivata’s support?

    • Does the acquired hospital and parent organization have different sets of Imprivata appliances?

    Involve all parties up front! There will be discussions around: architecture and appliances, number of physicians and licensing, and the future support model (whether that’s with Forward Advantage or Imprivata).


    Step 3- Ask Questions

    A merger or acquisition involving EPCS is a complex project that will touch on many different systems and people. Start the conversation early so the appropriate questions can be asked to help you achieve your goals.  Ask yourself the following:

    1. Are you already using Imprivata appliances?

    2. Will you be using the Imprivata appliances at the parent organization, or will the Imprivata appliances at both organizations remain separate?

    3. What will happen to AD accounts?

    a. Is the UPN (fully qualified user name) going to change? If the UPN changes in AD, then it will have a substantial impact all the way down through the disparate systems.

    4. How will all of the user passwords and fingerprints from existing Imprivata appliances get to the parent organization?

    a. Data Migration?

    b. Will physicians have to manually re-enroll?


    Step 4-Talk to us

    If you have EPCS or are considering EPCS, an acquisition or merger has a huge impact. Organizations need a full understanding of what will happen with regards to the individual user for a successful transition. This may sound overwhelming, but by involving Forward Advantage and associated vendors up-front, you will be well positioned for a successful transition.



    Subscribe to Our Blog

    Stay up-to-date on Forward Advantage News, Customer Success Stories, Industry Trends and Expert Insights.