立即与支持人员聊天
与支持团队交流

Identity Manager 9.1.1 - Epic Healthcare System Administration Guide

Managing an Epic health care system Setting up synchronization with an Epic health care system Basic Data for managing an Epic health care system Epic EMP template Epic SubTemplate Epic Connection Epic EMP User Accounts Security Matrix Configuration parameters for managing Epic health care system Default project template for Epic

Managing an Epic health care system

One Identity Manager Epic health care system module provides the ability to connect to Epic health care systems and help manage the health care system identities and their access policies from One Identity Manager. Identity and Access Governance processes such as attesting, Identity Audit, user account management and system entitlements, IT Shop, or report subscriptions can be used for Epic health care systems. The integration provides a one stop shop for managing Epic health care identities, their access policies and ensures a strong identity governance.

One Identity Manager provides company employees with the necessary user accounts. You can use different mechanisms to connect employees to their user accounts. You can also manage user accounts independently of employees.

Architecture overview

To access Epic health care system data, the Epic health care system connector is installed on a synchronization server. The synchronization server ensures that the data is compared between the One Identity Manager database and Epic health care system. The Epic health care system connector uses the Epic web services for accessing Epic health care system data.

At a high level, the Epic health care module provides the following two features leveraging the Epic web services

  • Provisioning: Provision Epic EMP user accounts along with their entitlements (EMPTemplate and SubTemplate) created in One Identity Manager on to the target Epic health care system.
  • Synchronization: Synchronize Epic EMP user accounts along with their entitlements including Epic EMPTemplates and SubTemplates into One Identity Manager.

One Identity Manager users for managing an Epic health care system

The following users are used in Epic health care system administration.

Table 1: Users used in Epic health care system administration
Users Task
Target system administrators

Target system administrators must be assigned to the Target systems | Administrators application role.

Users with this application role

  • Administrate application roles for individual target systems types
  • Specify the target system manager
  • Set up other application roles for target system managers if required
  • Specify which application roles are conflicting for target system managers
  • Authorize other employee to be target system administrators
  • Do not assume any administrative tasks within the target system
Target system managers

Target system managers must be assigned to Target systems | Epic or a sub-application role.

Users with this application role

  • Assume administrative tasks for the target system
  • Create, change or delete target system objects, like user accounts
  • Edit password policies for the target system
  • Prepare EMPTemplate and SubTemplate for adding to the IT Shop
  • Configure synchronization in the Synchronization Editor and define the mapping for comparing target systems and One Identity Manager
  • Edit the synchronization's target system types and outstanding objects
  • Authorize other employees within their area of responsibility as target system managers and create child application roles if required
One Identity Manager administrators
  • Create customized permissions groups for application roles for role-based login to administration tools in Designer as required
  • Create system users and permissions groups for nonrole- based login to administration tools in Designer as required
  • Enable or disable additional configuration parameters in Designer as required
  • Create custom processes in Designer as required
  • Create and configures schedules as required
  • Create and configure password policies as required
Administrators for the IT Shop

Administrators must be assigned to the Request & Fulfillment | IT Shop | Administrators application role.

Users with this application role

  • Assign to IT Shop structures
Product owner for the IT Shop

Product owners must be assigned to the Request & Fulfillment | IT Shop | Product owner application role or a child application role.

Users with this application role

  • Approve through requests
  • Edit service items and service categories under their management
Administrators for Organizations

Administrators must be assigned to the application role Identity Management | Organizations | Administrators.

Users with this application role

  • Assign to departments, cost centers and locations
Business roles administrators

Administrators must be assigned to the application role Identity Management | Business roles | Administrators.

Users with this application role

  • Assign to business roles

Setting up synchronization with an Epic health care system

Epic health care system prerequisites

The following are the Epic health care system prerequisites

Epic version supported: May 2019, August 2020, May 2020, February 2020, November 2020, Feb 2021, May 2021, August 2021.

NOTE: Prior Epic versions should also be supported but not officially tested against those versions.

Epic web services: Epic’s SOAP 1.1 version of web services should be enabled and accessible. Epic system’s Personnel management and demographics (user) web services should be enabled for access

Epic web services credentials: Valid credentials that has access to the Epic web services

Client ID: Valid Epic Client ID that has access to the Epic’s personnel management and demographics (user) web services. One Identity's Production and Non-Production Epic Client IDs can be used if they are enabled for accessing the Epic web services. One Identity's Epic Client IDs can be found in the EPCEpicConfig.xml file in One Identity Manager workstation.

EMP User, EMPTemplate and SubTemplate reports: The master list of all EMP users, EMPTemplates and SubTemplates need to be exported from Epic in to separate CSV files and provided to Epic connector. Please contact Epic on how to automate the report generation process.

Epic EMP Items need to be un-locked: Epic EMP user attributes that need to be managed from One Identity Manager need to be un-locked by Epic’s Data Courier team. The list of attributes along with the EMP item number are provided in the section Epic EMP User Accounts. Un-lock the EMP user items that you want serviced from One Identity Manager.

For more information about report format, see

To load One Epic EMP users, EMPTemplates and SubTemplates into the One Identity Manager database for the first time

  1. Make sure Epic health care system prerequisites are met
  2. The One Identity Manager components for managing Epic health care system are available if the TargetSystem | Epic configuration parameter is set.
    • Check whether the configuration parameter is set in the Designer. Otherwise, set the configuration parameter and compile the database.
    • Check the configuration parameters and modify them as necessary to suit your requirements.
  3. Install and configure a synchronization server and declare the server as Job server in One Identity Manager.

    NOTE: Ensure that the Job server has the machine role of Epic and job server function of Epic connector.

  4. Create a synchronization project with the Synchronization Editor.

For more information, see

自助服务工具
知识库
通知和警报
产品支持
下载软件
技术说明文件
用户论坛
视频教程
RSS订阅源
联系我们
获得许可 帮助
技术支持
查看全部
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级