Gartner®, Deepfake Identity Threats: Mitigate Risk in Identity Verification and Face Biometrics, Akif Khan, Nayara Sangiorgio, James Hoover, 11 May 2026
Gartner® is a trademark of Gartner, Inc. and/or its affiliates.
Share
Share
Key Takeaways
- HIPAA requires covered entities to verify both the identity and authority of anyone requesting protected health information, but it doesn't prescribe a single method.
- Identity proofing establishes who someone is at enrollment. Authentication checks that the same person returns later.
- IAL2 is a NIST identity assurance level that uses reliable evidence, source validation, biometric comparison, presentation-attack detection, and records that can be reviewed later.
- Not every interaction needs IAL2. The right level depends on the information involved and the consequences of an incorrect decision.
- A certified platform like CLEAR1 can help health systems adopt stronger verification without building every underlying verification, fraud-resistance, and compliance capability themselves.
Before a patient opens a portal, requests a record, or begins a virtual visit, the health system needs a reliable way to confirm who is requesting care or information.
A name, date of birth, or password can help staff locate an account, but none can, on its own, confirm that the requester is the individual linked to the record. Patient identity proofing adds that missing step, using evidence rather than assumption to establish who someone is.
HIPAA establishes the requirement: verify identity and authority before disclosing protected health information. NIST provides a framework for defining how much proof is enough. For higher-risk patient and workforce workflows, IAL2 offers a practical standard without requiring every health system to build the underlying infrastructure itself.
This distinction reflects the importance of identity verification in healthcare: access decisions need to connect a person to the record, not just a set of credentials.
What is Identity Proofing, and How is It Different from Authentication?
Identity proofing establishes that a person is who they claim to be by collecting and validating evidence about them from the real world. That evidence may include a government-issued ID, biometric comparison, authoritative data, device signals, or a set of complementary checks.
Proofing happens during enrollment. Authentication happens when someone returns. A password, one-time code, or passkey can protect an account, but it can’t confirm that the person signing in is the patient represented by the profile. Without proofing, the system may accept the sign-in without confirming the person behind it.
Identity assurance levels, or IALs, describe how much confidence an organization has that someone is who they claim to be. Authentication assurance levels, or AALs, describe how confidently it can confirm that the same person is returning with an approved authenticator.
A strong patient access program needs both: reliable enrollment and protected sign-in.
What HIPAA Actually Requires for Patient Identity Verification
HIPAA requires covered entities to verify the identity and authority of a person requesting protected health information. The requirement appears in 45 CFR 164.514(h), but the rule leaves the method open. It doesn't name a vendor, biometric, document, or assurance level.
That leaves each covered entity to decide what “verified” means for a given workflow, document the rationale, and defend the approach after an incident, audit, or disputed disclosure.
The practical challenge of HIPAA identity verification is knowing when a password or demographic match is enough—and when the requester needs to provide stronger evidence. A password reset may suit a low-risk service. It may not be enough when the request opens a complete medical record, releases protected health information, or changes the sign-in method protecting an account.
HIPAA doesn't require IAL2 by name. For workflows involving patient records, account recovery, or release of sensitive information, however, IAL2 provides a clear, defensible standard for stronger verification.
NIST 800-63 and the Identity Assurance Levels, Demystified
The NIST identity assurance levels describe a progression: more reliable proof, stronger validation, and greater confidence that the information belongs to the person presenting it.
IAL1: Self-Asserted Identity
IAL1 means a person’s identity attributes are self-asserted and not checked against an issuing or authoritative source. It can fit a newsletter signup, general educational content, or another interaction that doesn't expose protected health information.
A portal login alone, however, doesn't establish who enrolled behind it. IAL1 is a reasonable baseline for low-risk access, not a substitute for proofing when a patient will view records or take a high-impact action.
IAL2: Remote Proofing Against Real Evidence
IAL2, or identity assurance level 2, is remote proofing against reliable evidence. It requires more than collecting a name and date of birth. The organization must validate the evidence, confirm that the presenter is its rightful holder, use controls such as biometric comparison and presentation-attack detection where applicable, and keep records that can be reviewed later.
IAL2 commonly involves a government-issued photo ID or another accepted combination of evidence, validation against an issuing or authoritative source, and a live biometric comparison that connects the document to the person holding it. Presentation-attack detection helps defend against photos, replays, masks, and deepfakes.
Remote proofing is permitted, but it still demands rigorous controls. That is what makes it acceptable at patient scale—and why a certified platform can be more practical than building every component independently.
IAL3: In-Person or Supervised Proofing
IAL3 requires stronger evidence and in-person or supervised remote proofing, with a trained operator checking the session. It fits a narrow set of high-risk moments where the consequences of an error are especially severe.
It isn't the right answer for every portal login, check-in, or record request. The goal isn't to add friction for its own sake; it's to apply the right level of verification to the information and action involved.
Why IAL2 is Becoming the Bar for Patient Record Access
Patient record access carries consequences that extend beyond a single login. A mistake can expose protected health information, enable medical identity theft, disrupt care, or create lasting administrative and financial work.
The industry is moving toward a stronger standard. TEFCA requires IAL2 for individual access services, and the Joint Commission’s updated identity standards reinforce the need for reliable patient identification across care delivery. Together, they point in the same direction: patient access should rest on more than a self-asserted profile and a password.
That doesn't mean IAL2 belongs in every interaction. It means health systems need a consistent way to decide where stronger verification belongs.
Where Identity Proofing Happens in a Health System
In healthcare, identity proofing should begin with the moments the organization controls.
Patient Portal Account Creation
An account can attach to the wrong record or enroll the wrong person. When it will expose medical records or support high-impact actions, IAL2 gives the health system a stronger starting point than a demographic match alone.
Account Recovery
Account recovery can reopen access through weaker checks. If the process relies on a phone, inbox, or help desk interaction, someone may regain control without being the legitimate account holder.
A stronger recovery flow confirms the requester before resetting a password or sign-in method. It can also reduce the manual work that slows recovery for patients and staff.
Medical Record Access and Release of Information
A record request may expose diagnoses, medications, claims, or other protected health information. The health system must verify both identity and authority before release, with stronger proofing for more sensitive requests.
Telehealth Intake and Check-In
During remote intake or an in-person visit, demographic and coverage details help staff find the appropriate chart. They don't confirm that the person seeking care is the individual linked to it. Biometric and document signals can add evidence that connects the requester to the verified record.
Workforce Access and Reauthentication
Care teams need trusted access, too. A compromised clinician or staff account can expose patient data and clinical systems. Strong authentication, step-up verification, and reusable identity can support workforce recovery and reauthentication without forcing staff through disconnected processes.
Lower-Risk Content Access
Not every interaction needs IAL2. General health education content or another low-risk experience may work with IAL1 or a baseline control. Matching verification to risk helps health systems avoid adding friction where it provides no meaningful security benefit.
A reusable identity can support the full journey. A patient can enroll once and re-verify with a selfie for portal entry, account recovery, medical record requests, or office check-in. A provider or staff member can use the same verified identity for workforce account recovery and reauthentication.
From the waiting room to the workforce, a consistent approach to patient identity management can support those who receive care as well as those who deliver it.
Meeting IAL2 Without Building It
Meeting IAL2 requires more than an integration. Health systems need evidence collection, document and source validation, biometric comparison, presentation-attack detection, fraud controls, privacy safeguards, testing, and reviewable records. Together, these requirements can become a substantial internal program.
A certified platform can reduce that burden. When it meets IAL2 and AAL2 requirements, supports HIPAA-compliant workflows, and carries PAD2 certification, a health system can evaluate those controls during procurement instead of building them internally. The health system still owns its policies, workflows, consent, and deployment decisions.
CLEAR1 applies this model by combining biometric verification, document authenticity, source validation, and device signals to confirm the person—not just the device. Patients can complete guided setup once, then use a selfie to reverify.
With low-code implementation, native mobile support, and out-of-the-box healthcare integrations with EHRs, CLEAR1 healthcare identity solutions help health systems deploy stronger verification without building the underlying system from scratch.
How Health Systems Are Meeting the Standard Today
At Community Health Network, CLEAR1 helped increase MyChart verification success from 62% to 93%. Account-related support calls also fell by more than 54%, reducing manual recovery pressure while giving the organization a clearer way to confirm who was requesting access.
At Surescripts, CLEAR1 helps meet NIST IAL2 requirements with a government-issued ID, facial biometrics, backend data checks, and selfie re-verification. Verification success rose from 41% to 80%, while the process became 40% faster and 50% more providers completed onboarding.
Together, these results show how health systems can establish stronger proof at the right moment, then reuse it where policy allows. The organization gains a more consistent control, while patients and staff avoid repeating the same steps.
Case Study: See How Leading Health Systems Are Meeting the Identity Standard
The State of Identity in Healthcare whitepaper offers a lower-commitment look at the same trends, while healthcare identity solutions from CLEAR1 show how the standard can translate into implementation.
Meet the Standard with CLEAR1
CLEAR1 meets IAL2 and AAL2 requirements, supports HIPAA-compliant workflows, and carries PAD2 certification.
CLEAR1 also has its own assurance framework—Vertix, Apix, and Helix—that aligns with NIST’s IAL standards while enriching each level with additional controls and signals beyond the baseline requirements.
- Vertix is designed to align with NIST 800-63 Rev. 4 IAL1 requirements. Formal certification is in progress.
- Apix builds on Vertix with enhanced controls and expanded source validation designed to meet IAL2 requirements. CLEAR currently maintains IAL2 certification under NIST 800-63 Rev. 3, with Rev. 4 certification in progress.
- Helix is designed to align with NIST 800-63 Rev. 4 IAL3 requirements. Formal certification is in progress.
Together, these levels give health systems a reusable identity framework for patients, providers, and staff. Across healthcare workflows, CLEAR1 applies a multi-layered approach using biometrics, document checks, device signals, and trusted data sources. This helps verify the person beyond the device, match the level of proofing to each moment, and reduce friction for legitimate users.
Frequently Asked Questions
What is patient identity proofing?
Patient identity proofing establishes that someone is who they claim to be before granting access to records, services, or sensitive workflows. It uses evidence such as a government-issued ID, biometric comparison, authoritative data, or device signals. Proofing establishes who someone is at enrollment; authentication confirms that individual when they return.
What does HIPAA require for patient identity verification?
HIPAA requires covered entities to verify the identity and authority of a person requesting protected health information under 45 CFR 164.514(h). The rule doesn't prescribe a specific technology or assurance level. Each health system must choose controls that match the risk, document its approach, and be prepared to explain how it verified the requester.
What is IAL2?
IAL2 is a NIST identity assurance level for remote proofing against reliable evidence. It requires more than self-asserted information: validated documents or data, a confirmed link to the presenter, and controls such as biometric comparison and presentation-attack detection may strengthen the result. The process should also produce records for later review.
What is the difference between IAL1 and IAL2?
IAL1 relies on self-asserted attributes that are not validated against an issuing or authoritative source. IAL2 uses reliable evidence, validation, and stronger proof that the presenter is its rightful holder. IAL1 can fit low-risk interactions, while IAL2 is better suited to patient record access and other high-impact workflows.
Does HIPAA require IAL2?
HIPAA requires covered entities to verify identity and authority when protected health information is requested, but it doesn't name IAL2 or another NIST level. IAL2 is a defensible interpretation for higher-risk workflows because it gives health systems a measurable standard for remote proofing, evidence validation, biometric comparison, presentation-attack controls, and reviewable records.
What are the 5 patient identifiers?
There is no single universal list of five identifiers used by every health system. Common identifiers include a patient’s full name, date of birth, address, phone, and medical record number. Organizations should define how these details are collected, matched, and validated—and should not treat a list of attributes as proof of identity without an appropriate verification process.
How do you verify a patient’s identity?
Start by matching the verification level to the workflow. For access to protected health information, use evidence-based patient identity verification that connects the requester to a real person, such as a validated government-issued ID, biometric comparison, authoritative data, and presentation-attack detection. Then apply strong authentication and reusable re-verification for future access.
Before a patient opens a portal, requests a record, or begins a virtual visit, the health system needs a reliable way to confirm who is requesting care or information.
A name, date of birth, or password can help staff locate an account, but none can, on its own, confirm that the requester is the individual linked to the record. Patient identity proofing adds that missing step, using evidence rather than assumption to establish who someone is.
HIPAA establishes the requirement: verify identity and authority before disclosing protected health information. NIST provides a framework for defining how much proof is enough. For higher-risk patient and workforce workflows, IAL2 offers a practical standard without requiring every health system to build the underlying infrastructure itself.
This distinction reflects the importance of identity verification in healthcare: access decisions need to connect a person to the record, not just a set of credentials.
What is Identity Proofing, and How is It Different from Authentication?
Identity proofing establishes that a person is who they claim to be by collecting and validating evidence about them from the real world. That evidence may include a government-issued ID, biometric comparison, authoritative data, device signals, or a set of complementary checks.
Proofing happens during enrollment. Authentication happens when someone returns. A password, one-time code, or passkey can protect an account, but it can’t confirm that the person signing in is the patient represented by the profile. Without proofing, the system may accept the sign-in without confirming the person behind it.
Identity assurance levels, or IALs, describe how much confidence an organization has that someone is who they claim to be. Authentication assurance levels, or AALs, describe how confidently it can confirm that the same person is returning with an approved authenticator.
A strong patient access program needs both: reliable enrollment and protected sign-in.
What HIPAA Actually Requires for Patient Identity Verification
HIPAA requires covered entities to verify the identity and authority of a person requesting protected health information. The requirement appears in 45 CFR 164.514(h), but the rule leaves the method open. It doesn't name a vendor, biometric, document, or assurance level.
That leaves each covered entity to decide what “verified” means for a given workflow, document the rationale, and defend the approach after an incident, audit, or disputed disclosure.
The practical challenge of HIPAA identity verification is knowing when a password or demographic match is enough—and when the requester needs to provide stronger evidence. A password reset may suit a low-risk service. It may not be enough when the request opens a complete medical record, releases protected health information, or changes the sign-in method protecting an account.
HIPAA doesn't require IAL2 by name. For workflows involving patient records, account recovery, or release of sensitive information, however, IAL2 provides a clear, defensible standard for stronger verification.
NIST 800-63 and the Identity Assurance Levels, Demystified
The NIST identity assurance levels describe a progression: more reliable proof, stronger validation, and greater confidence that the information belongs to the person presenting it.
IAL1: Self-Asserted Identity
IAL1 means a person’s identity attributes are self-asserted and not checked against an issuing or authoritative source. It can fit a newsletter signup, general educational content, or another interaction that doesn't expose protected health information.
A portal login alone, however, doesn't establish who enrolled behind it. IAL1 is a reasonable baseline for low-risk access, not a substitute for proofing when a patient will view records or take a high-impact action.
IAL2: Remote Proofing Against Real Evidence
IAL2, or identity assurance level 2, is remote proofing against reliable evidence. It requires more than collecting a name and date of birth. The organization must validate the evidence, confirm that the presenter is its rightful holder, use controls such as biometric comparison and presentation-attack detection where applicable, and keep records that can be reviewed later.
IAL2 commonly involves a government-issued photo ID or another accepted combination of evidence, validation against an issuing or authoritative source, and a live biometric comparison that connects the document to the person holding it. Presentation-attack detection helps defend against photos, replays, masks, and deepfakes.
Remote proofing is permitted, but it still demands rigorous controls. That is what makes it acceptable at patient scale—and why a certified platform can be more practical than building every component independently.
IAL3: In-Person or Supervised Proofing
IAL3 requires stronger evidence and in-person or supervised remote proofing, with a trained operator checking the session. It fits a narrow set of high-risk moments where the consequences of an error are especially severe.
It isn't the right answer for every portal login, check-in, or record request. The goal isn't to add friction for its own sake; it's to apply the right level of verification to the information and action involved.
Why IAL2 is Becoming the Bar for Patient Record Access
Patient record access carries consequences that extend beyond a single login. A mistake can expose protected health information, enable medical identity theft, disrupt care, or create lasting administrative and financial work.
The industry is moving toward a stronger standard. TEFCA requires IAL2 for individual access services, and the Joint Commission’s updated identity standards reinforce the need for reliable patient identification across care delivery. Together, they point in the same direction: patient access should rest on more than a self-asserted profile and a password.
That doesn't mean IAL2 belongs in every interaction. It means health systems need a consistent way to decide where stronger verification belongs.
Where Identity Proofing Happens in a Health System
In healthcare, identity proofing should begin with the moments the organization controls.
Patient Portal Account Creation
An account can attach to the wrong record or enroll the wrong person. When it will expose medical records or support high-impact actions, IAL2 gives the health system a stronger starting point than a demographic match alone.
Account Recovery
Account recovery can reopen access through weaker checks. If the process relies on a phone, inbox, or help desk interaction, someone may regain control without being the legitimate account holder.
A stronger recovery flow confirms the requester before resetting a password or sign-in method. It can also reduce the manual work that slows recovery for patients and staff.
Medical Record Access and Release of Information
A record request may expose diagnoses, medications, claims, or other protected health information. The health system must verify both identity and authority before release, with stronger proofing for more sensitive requests.
Telehealth Intake and Check-In
During remote intake or an in-person visit, demographic and coverage details help staff find the appropriate chart. They don't confirm that the person seeking care is the individual linked to it. Biometric and document signals can add evidence that connects the requester to the verified record.
Workforce Access and Reauthentication
Care teams need trusted access, too. A compromised clinician or staff account can expose patient data and clinical systems. Strong authentication, step-up verification, and reusable identity can support workforce recovery and reauthentication without forcing staff through disconnected processes.
Lower-Risk Content Access
Not every interaction needs IAL2. General health education content or another low-risk experience may work with IAL1 or a baseline control. Matching verification to risk helps health systems avoid adding friction where it provides no meaningful security benefit.
A reusable identity can support the full journey. A patient can enroll once and re-verify with a selfie for portal entry, account recovery, medical record requests, or office check-in. A provider or staff member can use the same verified identity for workforce account recovery and reauthentication.
From the waiting room to the workforce, a consistent approach to patient identity management can support those who receive care as well as those who deliver it.
Meeting IAL2 Without Building It
Meeting IAL2 requires more than an integration. Health systems need evidence collection, document and source validation, biometric comparison, presentation-attack detection, fraud controls, privacy safeguards, testing, and reviewable records. Together, these requirements can become a substantial internal program.
A certified platform can reduce that burden. When it meets IAL2 and AAL2 requirements, supports HIPAA-compliant workflows, and carries PAD2 certification, a health system can evaluate those controls during procurement instead of building them internally. The health system still owns its policies, workflows, consent, and deployment decisions.
CLEAR1 applies this model by combining biometric verification, document authenticity, source validation, and device signals to confirm the person—not just the device. Patients can complete guided setup once, then use a selfie to reverify.
With low-code implementation, native mobile support, and out-of-the-box healthcare integrations with EHRs, CLEAR1 healthcare identity solutions help health systems deploy stronger verification without building the underlying system from scratch.
How Health Systems Are Meeting the Standard Today
At Community Health Network, CLEAR1 helped increase MyChart verification success from 62% to 93%. Account-related support calls also fell by more than 54%, reducing manual recovery pressure while giving the organization a clearer way to confirm who was requesting access.
At Surescripts, CLEAR1 helps meet NIST IAL2 requirements with a government-issued ID, facial biometrics, backend data checks, and selfie re-verification. Verification success rose from 41% to 80%, while the process became 40% faster and 50% more providers completed onboarding.
Together, these results show how health systems can establish stronger proof at the right moment, then reuse it where policy allows. The organization gains a more consistent control, while patients and staff avoid repeating the same steps.
Case Study: See How Leading Health Systems Are Meeting the Identity Standard
The State of Identity in Healthcare whitepaper offers a lower-commitment look at the same trends, while healthcare identity solutions from CLEAR1 show how the standard can translate into implementation.
Meet the Standard with CLEAR1
CLEAR1 meets IAL2 and AAL2 requirements, supports HIPAA-compliant workflows, and carries PAD2 certification.
CLEAR1 also has its own assurance framework—Vertix, Apix, and Helix—that aligns with NIST’s IAL standards while enriching each level with additional controls and signals beyond the baseline requirements.
- Vertix is designed to align with NIST 800-63 Rev. 4 IAL1 requirements. Formal certification is in progress.
- Apix builds on Vertix with enhanced controls and expanded source validation designed to meet IAL2 requirements. CLEAR currently maintains IAL2 certification under NIST 800-63 Rev. 3, with Rev. 4 certification in progress.
- Helix is designed to align with NIST 800-63 Rev. 4 IAL3 requirements. Formal certification is in progress.
Together, these levels give health systems a reusable identity framework for patients, providers, and staff. Across healthcare workflows, CLEAR1 applies a multi-layered approach using biometrics, document checks, device signals, and trusted data sources. This helps verify the person beyond the device, match the level of proofing to each moment, and reduce friction for legitimate users.
