2008 InfoWorld CTO 25: Jim Lowder, OhioHealth

Jim Lowder wanted to roll out biometric technology -- laptops that recognize fingerprints -- to augment passwords at his newly opened Dublin Methodist Hospital, but first he had to convince the Ohio Board of Pharmacy to recognize the devices.

"We needed two-factor authentication for physicians and nurses placing orders on the computer for medications or lab tests," says Lowder, vice president of technology at OhioHealth, a regional health care system that opened Dublin Methodist in January. "So we implemented single sign-on and biometric authentication."

[ Discover what insights you can take advantage of from the other 2008 InfoWorld CTO 25 winners. ]

Lowder wanted to use biometric devices to make it easier for some 600 clinicians to order online. He chose keyboards with built-in fingerprint recognition over a separate USB fingerprint reader device, because the former seemed easier for the user.

The problem was that the Ohio's pharmacy board didn't recognize biometric devices as a way to satisfy its unique-identification requirements. Lowder and his team spent months making their case and demonstrating the technology in action. The board was most concerned that the biometric devices could be compromised.

It helped that Lowder had worked with the board in the past on technology such as bar-code scanning. One way he was able to sway the board in favor of biometric devices was by comparing biometric devices with age-old passwords. With passwords, security can be compromised simply when someone looks over a doctor's shoulder or when a doctor shares his password either by accident or in casual conversation. Biometric devices, on the other hand, require the user's physical presence.

For the first time in the state’s history, the board agreed to recognize biometric devices as a bona fide method of authentication. Lowder also helped convince the board to accept mobile phones as a secondary identification factor for remote doctors. When a remote doctor enters a password to order drugs online, she'll receive a phone call on her cell phone for proof of identity before the order can be processed.

The technology side proved to be equally challenging. Lowder wondered: Would fingerprint recognition be accurate enough? If doctors and nurses couldn’t order prescriptions or if the system went down, the hospital might be brought to its knees.

And so Lowder vigorously tested the biometric devices. He tried them out in test-bed emergency departments at other hospitals before Dublin Methodist's grand opening. Everything seemed to work well. Even if the authentication system goes down, Lowder says, "the [biometric] device itself will store credentials for a short period of time, so it doesn’t have to go back to the server to authenticate."