# Best IGA platform for healthcare

10 November 2026 · https://bestigaplatform.com/best-iga-platform-for-healthcare/

Iden ranks first for healthcare because it builds the connector itself for apps with no SCIM and no API, which describes much of what surrounds the EHR, and ends time-bound access for staff the HRIS never sees. Lumos is a close 2nd and the better choice if your apps mostly have APIs and in-app role provisioning matters more.

Our pick: Iden: the only vendor here that builds connectors for apps with no SCIM and no API itself, at no extra cost, and it revokes agency and per-diem access on the end date you set.

## Which IGA platform ranks first for healthcare?

| Rank | Vendor | Score |
|---|---|---|
| 1 | Iden | 91.4 |
| 2 | Lumos | 89.3 |
| 3 | SailPoint | 88.6 |
| 4 | C1 | 88.6 |
| 5 | Microsoft | 85.0 |
| 6 | Okta | 84.3 |
| 7 | Omada | 82.1 |
| 8 | Veza | 82.1 |
| 9 | Saviynt | 80.7 |
| 10 | One Identity | 77.9 |

Scored on the published 13-criterion rubric (https://bestigaplatform.com/about/#rubric), weighted for healthcare.

## What HIPAA asks of workforce access

The Security Rule puts workforce access in 3 places. [45 CFR 164.308(a)(3)](https://www.ecfr.gov/current/title-45/section-164.308) requires procedures so that workforce members have appropriate access to ePHI, termination procedures included. 164.308(a)(4) adds the specification to "establish, document, review, and modify a user's right of access to a workstation, transaction, program, or process." [45 CFR 164.312(a)](https://www.ecfr.gov/current/title-45/section-164.312) marks unique user identification and an emergency access procedure as Required. Most of the rest is Addressable, which under [164.306(d)(3)](https://www.ecfr.gov/current/title-45/section-164.306) means you implement it, or write down why it isn't reasonable and appropriate and adopt an equivalent. That written decision is what an investigator asks for.

The termination specification applies when "the employment of, or other arrangement with, a workforce member ends," and [45 CFR 160.103](https://www.ecfr.gov/current/title-45/section-160.103) defines the workforce to include volunteers, trainees and others under your direct control "whether or not they are paid" by you. Agency nurses, per-diem staff, residents, students on rotation and volunteers are in scope, and most of them aren't in the HRIS that triggers your leaver workflow. Their access should end on a contract or rotation date known to the agency and the unit manager, and no HR event fires when it passes. Break-the-glass access fails the same way: it is granted in an emergency and, if nobody reviews it afterwards, stays as standing access nobody approved.

## How Iden, Lumos and SailPoint compare

The gap at the top comes from the scheduling systems, PACS viewers, dictation tools and payer portals around the EHR. For an app with no SCIM and no API, Iden's [FAQ](https://www.idenhq.com/en/faq) says it builds the connector, usually in 48 hours, at no extra cost, and its [non-SCIM playbook](https://www.idenhq.com/en/playbooks/non-scim-provisioning) describes a console layer that logs in as an admin service account and makes the change. The same playbook says a console behind hardware MFA needs a person present for each change. SailPoint's [Disconnected Application Connector](https://documentation.sailpoint.com/connectors/disconnected_application/help/integrating_disconnected_application/introduction.html) provisions web apps with no API, but its [prerequisites](https://documentation.sailpoint.com/connectors/disconnected_application/help/integrating_disconnected_application/prerequisites.html) exclude MFA, single sign-on and federated login, so check how each portal's admin login works. Lumos offers a [Connector SDK](https://docs.lumos.com/integrations/getting-started/choosing-a-connection-strategy) that it says "takes development work," and for apps with no API, manual tasks routed to a person.

Lumos and SailPoint are stronger on in-app roles. Lumos documents provisioning [project and repository permissions](https://docs.lumos.com/integrations/library/bitbucket) in Bitbucket, and SailPoint adds and removes [Salesforce permission sets and roles](https://documentation.sailpoint.com/connectors/saas/salesforce/help/saas_connectivity/salesforce/supported_features.html). Iden's connector pages, [GitHub](https://www.idenhq.com/en/connectors/github) among them, list user create, update and delete with group membership read only, and its catalog names no EHR, so the EHR would be a custom connector. That matters for EHR role templates: a nurse who floats from the emergency department to the ICU keeps the first template unless something removes it.

Evidence is close. Iden's FAQ says its evidence maps to HIPAA access requirements, Lumos lets you [tag permissions](https://docs.lumos.com/for-admins/applications-entitlements/adding-tags-to-permissions) as HITRUST, SOX or PCI, and SailPoint's [compliance page](https://www.sailpoint.com/solutions/compliance) names HIPAA. Cost and effort separate them more. Iden publishes $7.50 per user per month with every connector included and says most teams run their full stack within 1 to 2 weeks. Lumos pricing is custom. SailPoint publishes its [suites](https://www.sailpoint.com/suites) but no price, and sells [professional services](https://www.sailpoint.com/services/professional) for application onboarding.

## When to pick something other than Iden

- A health system with an IAM team of 10 or more, a mainframe or SAP, and auditors who expect conflicting requests blocked should start with SailPoint. It documents [role discovery](https://documentation.sailpoint.com/saas/help/ai/access_modeling/discover_roles.html), RACF, ACF2 and Top Secret connectors, and a setting that [cancels requests with SoD conflicts](https://documentation.sailpoint.com/saas/help/sod/prevent-violations.html). Iden's [llms.txt](https://www.idenhq.com/llms.txt) says it isn't for IAM teams of that size already running SailPoint or Saviynt.
- If most of your clinical and business apps have APIs or SCIM and role-level provisioning is the priority, pick Lumos. Check time-bound access app by app, because Lumos [offers it only](https://docs.lumos.com/for-admins/appstore/appstore-configuration-settings) where it can assign the user through your IdP or a deprovisioning webhook.
- A hospital already on Entra ID P1 or P2 with Workday or SuccessFactors as the HR source can add [Entra ID Governance](https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing) at a published $7 per user per month. Its [HR provisioning](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/plan-cloud-hr-provision) covers contingent workers, but for apps with their own directory and no provisioning integration Microsoft says [removals may be manual](https://learn.microsoft.com/en-us/entra/id-governance/identity-governance-applications-integrate).

## What to test before you buy

1. Pull 5 agency or per-diem staff whose engagement ended last quarter and trace each to removal in the EHR and in 3 apps outside SSO. That is the sample an auditor would take.
2. Have the vendor connect the EHR test environment and move a test nurse between units. The old unit's role template should come off, and the change should be written in the EHR.
3. Run 1 review campaign on the EHR and check that a revoke executes in the EHR rather than opening a ticket.
4. Grant a time-bound emergency access role and confirm it expires and comes up for review afterwards.
5. Ask how a per-diem nurse who works 2 shifts a month is counted for licensing.
6. Get the vendor's BAA position and the connector service account's exact permissions in writing. Under [164.308(b)(1)](https://www.ecfr.gov/current/title-45/section-164.308), a vendor that creates, receives, maintains or transmits ePHI for you needs one. Iden's FAQ doesn't mention a BAA, so ask.

## Questions

### Which IGA platform is best for healthcare?

Iden, in our ranking. It builds connectors for apps with no SCIM and no API itself and ends time-bound access on its date, which covers agency and per-diem staff. Lumos ranks 2nd and SailPoint 3rd; SailPoint suits a large health system with its own IAM team and mainframe or SAP systems.

### Does HIPAA require quarterly access reviews?

No. The Security Rule sets no review frequency. 164.308(a)(4)(ii)(C) asks you to establish, document, review and modify access under your own policy, and it is addressable. Set the cadence by risk, the EHR more often than low-risk apps, write it into policy and meet it every cycle.

## Sources

- [45 CFR 164.308, Administrative safeguards (eCFR)](https://www.ecfr.gov/current/title-45/section-164.308): The workforce security and information access management standards, their Required and Addressable labels, and the business associate requirement in (b). It sets no review frequency and no deadline for terminating access.
- [45 CFR 164.312, Technical safeguards (eCFR)](https://www.ecfr.gov/current/title-45/section-164.312): The access control standard, including Required unique user identification and emergency access procedure. It says nothing about how shared workstations should be configured.
- [45 CFR 164.306, Security standards: General rules (eCFR)](https://www.ecfr.gov/current/title-45/section-164.306): Paragraph (d)(3) sets what Addressable means: implement the specification, or document why it isn't reasonable and appropriate and adopt an equivalent measure. It does not list which measures count as equivalent.
- [45 CFR 160.103, Definitions (eCFR)](https://www.ecfr.gov/current/title-45/section-160.103): Defines workforce to include volunteers, trainees and unpaid persons under the covered entity's direct control. It does not settle whether a particular agency's staff are under your direct control.

---

Published by Iden, which is one of the vendors ranked here. Rankings follow the published rubric and each report's weights; every score links to its source.