Introduction

Epic Systems is one of the largest providers of health information technology, used primarily by large U.S. hospitals and health systems to access, organize, store and share electronic medical records. It enables medical organizations and individuals to perform actions such as medication scheduling, ordering, dispensing and e-prescription downloading. Hyperspace is legacy client application and they are now moving to a Chromium web-based framework, Hyperdrive.

The SafeNet Agent for Epic is a client-side agent that supports Direct authentication against a user ID. The agent is a best-in-class authentication solution, providing maximum security and performance, certified to the highest security standards. It enables to:

• Apply access management features to manage and control user accesses.
• Take advantage of the industry-leading SafeNet solution to provide secure Two-Factor Authentication (2FA).

This release follows a template-based setup and is a scalable, customizable and a more productive agent solution. Critical application management and policy tasks, now handled at the service level, ensures that the agent's manager console is reduced, resulting in better productivity and faster processing.

Supported Use Case

The SafeNet Agent for Epic enables seamless integration with Hyperspace, Epic's legacy client application and Hyperdrive, a Chromium web-based framework. Deploying the SafeNet agent in Epic's environment provides a capability to verify identities and sign records before accessing health records and performing related actions.

The supported use case is presently limited to the application of 2FA while signing the controlled substances patient records. The agent's functionality, though can be extended, to support Epic's other use cases with future releases.

Agent Authentication Methods

Authentication methods allows to combat online fraud activities (such as phishing) and help maintain password integrity by making it more difficult for customers to lose or share passwords.

The SafeNet Agent for Epic supports the Direct method, meaning an ID is needed to authenticate users. The device determines whether the object being authenticated corresponds to the provided ID, or not.

User Flow

The following steps broadly depict the flow of actions for the agent solution:

1. A user logs in to the Epic using username and password.
2. If the user proceeds to sign the controlled substances patient records, the SafeNet solution is called (through the agent) for elevated access check.
3. The configured authentication for the second factor is displayed.

4. Once authenticated, the user is allowed to sign and download the records.

   

Prerequisites

• Ensure that the Epic Hyperspace or Hyperdrive application is already installed on the system where the agent is proposed for the installation.
• Ensure that the user has administrative rights for installing and configuring the SafeNet Agent for Epic.

• To successfully configure and implement the SafeNet Agent for Epic, the administrator must be familiar with SafeNet Authentication Service (SAS) Cloud or SAS Service Provider's Edition (SAS SPE) or SAS Private Cloud Edition (SAS PCE) and the SafeNet Trusted Access (STA).

  Create an account in SAS Cloud or SAS PCE 3.9.1 (and above). For more information, refer to Support Contacts.

Security Recommendations

If you are using the Transport Layer Security (TLS) to secure requests between Token Validator Proxy (TVP) [recommended: TVP v2.0] and the SafeNet Agent for Epic, follow the steps to enable the TLS:

1. To enable TLS on TVP server in the Internet Information Services (IIS) Manager, you need to create a Hypertext Transfer Protocol Secure (HTTPS) binding for the Default website, by following the steps:

   a. Click Start > Control Panel > Administrative Tools > Internet Information Services (IIS) Manager.

   b. In the left pane of the IIS window, right-click the Default Web Site and click Edit Bindings.

   c. Create an HTTPS binding by using either a self-signed or a Certificate Authority (CA) certificate.

   Note

   The certificate name should match the Uniform Resource Locator (URL) address of the token validator site.

2. Navigate to the following Registry Editor path: HKLM\Software\CryptoCard\Token Validator

   Change URL of the token validator to include HTTPS.

3. On the Client side, import the root CA certificate in the trusted root CA store.

Environment

Interoperability

Supported operating systems:

• Windows 11
• Windows Server 2016 (64-bit)
• Windows Server 2019 (64-bit)
• Windows Server 2022 (64-bit)
• Windows Server 2025 (64-bit)

Software Component

• Microsoft .NET Framework 4.6

Configuration Component

• SafeNet Epic Management Console utility

Supported Web Browsers

• Internet Explorer 11
• Microsoft Edge
• Mozilla Firefox
• Google Chrome

Supported Tokens

• All tokens supported by SafeNet Trusted Access