In 2025, healthcare data breaches exposed the protected health information of roughly 379,000 people a day, according to HHS Office for Civil Rights data compiled by the HIPAA Journal. Behind almost every one of those numbers is a system that trusted someone it couldn’t confirm was real.
This becomes a major problem for security and compliance leaders in healthcare. A patient signs up from a phone. A clinician logs in to move records between systems. In both moments, the organization has to answer: Is this person who they claim to be?
In June, the Kantara Initiative granted Vouched Ready-to-Operate (RTO) approval for NIST Special Publication 800-63A at Identity Assurance Level 2 (IAL2). Here’s what that means, and why it should matter to anyone responsible for security in a regulated health setting.
IAL2 approval from Kantara carries more weight because an independent source did the checking. NIST 800-63A is the federal government’s standard for how to prove a person’s identity remotely. Kantara is the body accredited to assess vendors against it.
To reach Ready to Operate, Vouched submitted its identity verification to an accredited assessor. That assessor confirmed it meets the standard across document verification, biometric matching between a selfie and an ID, liveness detection to confirm a real person is present, and fraud controls.
That outside review means security teams no longer have to take the vendor’s word for it.
Vouched is the eighth digital identity provider to ever earn this Kantara approval, according to Biometric Update. For a healthcare buyer comparing options, the standard is demanding enough that few providers have met it, and the ones who have are part of a small group a security leader can name.
“IAL2 is the gold standard for remote identity proofing,” says Vouched CEO Peter Horadan. “Achieving Kantara’s Ready to Operate approval positions Vouched to serve our customers in the most demanding, regulated environments with full confidence.”
Vouched’s IAL2-approved verification is already running in production in healthcare today.
Epic, the electronic health record vendor used across much of U.S. healthcare, integrated Vouched earlier in 2026 to verify patients at sign-up with an ID document and a selfie. That integration now carries the IAL2 distinction.
Since March 2026, Abstractive Health has used Vouched to verify clinicians inside patient pre-charting and handoff workflows. The result is HIPAA-compliant clinician verification that replaces fax-based record transfers and reduces the risk of records reaching the wrong people. “[It’s] identity verification that healthcare can rely on,” says Vince Hartman, Abstractive Health CEO and Co-founder.
Even though strong identity proofing is vital to security, it can have a reputation for slowing people down. In some cases, that strength can cause those people to drop off entirely. This verification proves that a security team can meet a federal-grade standard while still verifying a patient in seconds. It supports the access controls HIPAA expects, stops a stranger who claims to be a known patient or provider, and protects onboarding conversion while keeping fraud out.
Identity is the first control in any healthcare workflow. Vouched now holds independent, federal-grade proof that its first control works.
To see IAL2-approved verification in your environment, request a demo.