Healthcare
Healthcare needs two kinds of identity at once: patients who sign in rarely and must never be locked out, and clinicians who sign in constantly and must be provable. LumoAuth covers both, with relationship-based access for caregivers and approval workflows for emergency access.
Patients forget passwords; clinicians share them
Portal lockouts fill the help desk. Shared workstation logins destroy the audit trail. Emergency access either does not exist or is permanent.
How LumoAuth solves it
Patient sign-in
Passkeys and magic links with careful recovery. Docs
Clinician SSO
Federate from the hospital's identity provider; provision from the directory. Docs
Caregiver and proxy access
Model "parent of", "guardian of" and "delegate of" as relationships with scoped permissions. Docs
Break-glass access
Request elevated access with a reason, get it for a bounded time, with an approver notified and everything logged. Docs
Push approval for mobile clinicians
Approve sign-ins and sensitive actions from a phone. Docs
Audit retention and privacy
Long retention, SIEM export, data-subject requests and consent records. Docs
Setting it up
Separate patient and staff organizations
Connect the hospital identity provider and SCIM
Define caregiver relationships
Set up break-glass approvals
Standards involved
Plain names on the left, the specification on the right. The full map is in the standards reference.
- Sign-in
- OpenID Connect, SAML 2.0
- Passkeys
- WebAuthn
- Provisioning
- SCIM 2.0
- Authorization API
- OpenID AuthZEN
Which plan you need
Patient and clinician sign-in are on every plan. Relationship-based access is the Fine-grained authorization add-on. Break-glass approvals need Agent Governance on Pro or the Business plan. Long audit retention is in the Audit & Compliance add-on.
Documentation
Questions
Will you sign a BAA?
Ship passwordless sign-in this week. Put guardrails on your agents today.
The Developer plan is free for 10,000 monthly users and ten agents, with no card. Everything speaks open standards, so moving in or out is a config change.