Health systems inherit the patients that IAL2 proofing turns away
A year after NIST’s identity rewrite and CMS’s interoperability pledge, verified credentials were starting to open patient records across networks. Patients who cannot obtain one still depend on their health system, which needs designed routes for in-house proofing and vouching.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
In July 2025, NIST finalized Revision 4 of its Digital Identity Guidelines, SP 800-63-4. The revision updated identity proofing, authentication and federation. It accommodated synced passkeys, added controls against forged media and injection attacks, and formalized alternatives for people who cannot complete standard proofing, including trusted referees and applicant references. The same month, CMS launched its Interoperability Framework and asked networks and apps to pledge to it. Under the framework, a patient with a CMS-approved credential at IAL2 or equivalent, such as a mobile driver’s license, and AAL2 authentication, such as a passkey, should get records without a separate portal login. By August 2026, CMS reported that numerous companies had reached general availability in July, at the ecosystem’s one-year mark. Verified credentials were starting to work as a key to patient records.
For most patients, a reusable verified credential is an improvement. It replaces a different portal login at every health system with one proofed identity and a passkey. For health systems, it moves much of patient identity verification to outside credential services. That is welcome, and it has a consequence. IAL2 remote proofing typically relies on a government photo ID, a smartphone that can capture it, and data sources that confirm the person exists at an address. The patients least likely to have all of those include older adults, people experiencing homelessness, recent immigrants, young adults with thin records and some people with disabilities. Many of them have heavy health care needs.
As credentials do more of the work, the patients who fail them become the health system’s problem in a concentrated form. There are three routes by which a patient’s identity can be established for digital access: a credential issued by someone else, proofing the health system performs itself, and identity vouched for by another person. Each needs its own design, owner and measure.
A credential issued by someone else
The first route is the one the CMS framework promotes. A patient proves identity once to an approved credential service and presents that credential to networks and apps. The health system’s job is mostly to accept it well. Its portal and patient-access endpoints need to trust the approved services, match the verified identity to the right medical record, and log each request for later review. The framework itself calls for verifiable logs of identity and authorization requests.
Matching is the weak point. A verified name, date of birth and address still have to be linked to a record that may hold a maiden name, an old address or a typo from a busy registration desk. A strict match fails the patient, and a loose one risks disclosing someone else’s record. The practical step is to measure match failures for credential-based requests, route them to a trained queue, and fix the underlying registration data. Health information management should own that queue, because it already owns record integrity.
Account recovery is the other weak point. A patient who loses the phone holding a passkey, or whose credential lapses, needs a way back in that is no weaker than the original proofing. If the fallback is a set of knowledge questions answered over the phone, an attacker will use the fallback. Recovery should route to one of the stronger paths below, and the help desk script should say so.
Proofing the health system does itself
The second route covers patients who cannot or will not use an outside credential. Health systems already verify identity in person every day at registration. SP 800-63-4 gives that a defined place. Onsite and remote supervised proofing, where a trained operator checks evidence live, are both recognized options at IAL2.
Turning registration into a proofing service takes more than policy. Staff need a short procedure that says which evidence counts, how it is checked and how the result is recorded against the patient’s account. The portal needs an activation path that issues a passkey at the desk, so the patient leaves enrolled. For patients who cannot travel, a scheduled video session with a trained staff member can serve the same purpose. The cost is staff time, so the process should be aimed at patients who have already failed remote proofing or who are flagged at intake as likely to.
Revision 4 also expects proofing processes to resist forged documents and injected video. Supervised sessions help, but staff need to know what to look for, and the procedure should state when to escalate.
Identity vouched for by another person
The third route is the one the revision formalized most clearly. A trusted referee is a trained agent of the organization who can make a risk-based decision about someone without standard evidence. An applicant reference is a person who vouches for the applicant, such as a caregiver or case worker. In a health system, natural candidates already exist. Social workers, care managers, community health workers and clinic staff who know a patient over time can play the referee role under a written procedure.
This route overlaps with proxy access, which carries its own risks. Parents of minors, adult children of older patients and legal representatives often need access to someone else’s record. Access rights and minors’ confidentiality differ by state, so the vouching procedure and the proxy procedure should be designed together with counsel. Broader rights, such as full record access for an adult’s representative, should require stronger verification than limited ones.
Each route needs a measure. The useful one is enrollment completion by route and by patient group, including age, language and payer. If a population fails remote credentials and never appears in the in-house or vouched routes, the health system has found the patients its digital front door excludes.
With hindsight
By October 2026, credential-based access is real but early. Networks and apps have announced CMS-aligned status, and identity providers have promoted IAL2 credentials that work across them. We have not seen published data on how many patients use credentials to retrieve records, or on who fails proofing. The NIST guidelines remain mandatory only for federal agencies. In health care they shape practice through the CMS framework, network rules and vendor products. The trusted referee and applicant reference provisions have drawn less attention than passkeys, partly because they require staff procedures rather than a product purchase. That makes them easy to defer. As more record access runs through outside credentials, though, the patients those credentials miss will need these routes most. Health systems should confirm specific identity requirements under network agreements and prescribing rules with counsel.