Provides an enterprise-wide capability for managing individual authorizations for access to protected information. An Individual Authorization is an abstract concept and can be realized by different possible instances of concrete authorization types. Currently, the supported authorization types are Personal Representative Delegation (PR Delegation) and VA Healthcare Proxy delegation (VAHP Delegation). Delegations are a type of authorization whereby a delegator,typically a Veteran or Beneficiary, delegates specific access privileges to a delegaten such as Caregivers, Family members, Legal guardians, etc.

Provides the capability to monitor integrated applications and services to produce reports and generate alerts triggered by events or breach of predetermined event thresholds.

Beginning with the Government Paperwork Elimination Act of 1998 (GPEA), the Federal government has encouraged the use of electronic / digital signatures to enable electronic transactions with agencies, while still providing a means for proof of user consent and non-repudiation. To support this capability, some means of reliable user identity management must exist. Currently, Veterans have to physically print, sign, and mail various documents that, in turn, need to be processed by VA. This process creates a huge inconvenience on the part of the veteran and a financial burden on VA. eSig enables veterans and their surrogates to digitally sign forms that require a high level of verification that the user signing the document is a legitimate and authorized user. In addition, eSig provides a mechanism for VA applications to verify the authenticity of user documents and data integrity on user forms. This capability is enabled by the eSig service. The eSig service signing process includes the following steps: 1. Form Signing Attestation: The user affirms their intent to electronically sign the document and understands re-authentication is part of that process. 2. Re-Authentication: The user must refresh their authentication by repeating the authentication process. 3. Form Signing: The form and the identity of the user are presented to the eSig service, where they are digitally bound and secured. 4. Form Storage: The signed form must be stored for later validation. In this process, the application is entirely responsible for steps 1, 2, and 4. In step 3, the application must use the eSig web service to request signing of the document. The following table lists the detailed functions offered by the eSig service.

Provides single sign-on solution for external facing VA applications. Authenticates users with CSP credentials and other externally-issued credentials (including mapping of credential to VA identity) (IBM tools)

The authoritative source for person identity data. Maintains identity data for persons across VA systems. Provides a unique universal identifier for each person. Stores identity data as correlations for each system where a person is known. Provides a probabilistic matching algorithm. (Includes MPI, PSIM, and IdM TK) Maintains a gold copy known as a Primary View of the persons identity data. Broadcasts identity trait updates to systems of interest. Maintains a record locator service.

Provides single sign-on solution for internal facing VA applications. Allows internal users access to a variety of VA systems and applications using a reduced set of login credentials, including VA-issued PIV cards (LOA 4) and credentials generated by the VA Active Directory (LOA 2). Supports application implementation of PIV requirement

User provisioning is the process of associating a digital identity with one or more resource access accounts, which may serve as records for user data and permissions. This may include the creation, modification, deletion, suspension, or restoration of such accounts and also synchronizing user data. Managing user accounts locally creates redundancy in collecting and managing user information. This may lead to inaccuracies and inconsistencies with user data that is stored in authoritative sources, and this may also create security vulnerabilities by maintaining accounts for terminated users. By leveraging Provisioning, VA applications are able to centrally manage user information, attributes, roles, and accounts using data from authoritative identity sources. Once a manually intensive and disjointed process, VAs Provisioning (Prov) service leverages automated and centralized workflows to enhance security and bolster efficiency. As a result, application administrators, who previously had to manually manage user administration, now have services available to automate the process. Provisioning assigns the Security Identifier (SecID) as a unique user identifier for integrated applications to use for user authorization and audit. SecID is a unique ID assigned to a user when they are added to the Provisioning system via an on-boarding event. SecID, once assigned, remains the same even if the user status with VA changes over time (i.e., a Veteran becomes a contractor and then later becomes an employee). SecID is the identifier used to correlate Provisioning records to MVIs integration control number (ICN), which is the unique person identifier. Provisioning automates the on-boarding and off-boarding flows. Applications leveraging Provisioning gain an added benefit of automated account removal (deprovisioning) during off-boarding. The following table lists the detailed functions offered by the Provisioning service. Additionally, the Provisioning service includes a Role Engineering and Compliance Tool (RECT) that can help applications: Conduct Role Analysis: Provides the ability to analyze current roles and permissions to rapidly build and deploy an enterprise role model Certify User Roles: Provides the ability to have access privileges reviewed and managed by designated reviewers

The Department of Veterans Affairs is providing a Veterans Health Identification Card (VHIC) for veterans to use at VA medical facilities. The VIC will be issued only to veterans who are eligible for VA medical benefits and only for the purpose of identification and check-in for VA medical appointments. The new card protects personal privacy by not showing Social Security Numbers or dates of birth on the front of the cards