White paper
· version 1.0
CoreView is not enough for a CISSS or CIUSSS
Québec is deploying CoreView across the health and social services network. Amid the Dossier Santé Québec rollout, the obligations a CISSS or CIUSSS answers to reach well past Microsoft 365.
- 211
- Requirements in the CCSMTL 2023-1771 RFP grid, excluding PAM, of which 67 are mandatory and eliminatory.
- 35 to 40%
- Share of all criteria CoreView alone would cover.
- $10M
- Maximum administrative penalty under Law 25, or 2% of worldwide revenue.
The situation
The government is progressively deploying CoreView across the health and social services network to strengthen Microsoft 365 governance. It is an important step forward, and it is strictly limited to the Microsoft ecosystem, a subset of the perimeter the law imposes on a CISSS or CIUSSS.
What the law actually requires
Law 5 on health information, Law 25, the MCN directives, the LGGRI, the MSSS normative framework covering BCH/TGV, RPSO and GMVI, and the Access Act require end-to-end identity lifecycle management across all of an establishment’s assets.
That reaches HR and payroll systems such as Logibec, Virtuo and Espresso, the care provider registry, clinical applications for patient records, lab, imaging and pharmacy, LDAP and SQL directories, and ITSM tools such as Octopus, GLPI and C2 Atom.
Where CoreView stops
The 67 mandatory requirements in the reference RFP address a multi-system IGA scope that CoreView does not cover by design. An analysis in the paper puts CoreView’s own coverage at roughly 35 to 40% of all criteria.
What the paper sets out
The white paper argues that RAC/M Identity is the required complement to CoreView rather than a replacement for it, so that an establishment can meet its legal obligations, answer RSSS identity governance specifications, and get full value from the CoreView investment already made.