Delivering care at home means connecting patients, healthcare professionals, medical devices and healthcare systems. Cuviva’s digital health platform brings these together, enabling care teams to monitor health data remotely, communicate with patients and coordinate personalized care pathways.
As Cuviva moves into larger deployments and new markets, access needs to work across different users, organizations and applications while meeting the security, regulatory and hosting requirements of healthcare organizations in different markets.
Making access work for patients and care teams
Healthcare leaves little room for compromise on access. Cuviva needs to meet stringent requirements for protecting sensitive health data and support strong authentication, while keeping access straightforward for the people using its services.
Some of its patients are people living with multiple chronic conditions who may be unfamiliar or uncomfortable with digital technology. A simple login experience is essential. Healthcare professionals have different needs. Regions and other healthcare organizations often operate their own login systems and want staff to continue using them when accessing Cuviva.
The challenge is to accommodate these differences across mobile and web applications without making each application team responsible for implementing and maintaining individual authentication methods and flows.
With the Curity Identity Server, Cuviva can bring these requirements together in one place. Patients and healthcare professionals can access services in ways suited to their needs, while Cuviva can centrally manage the authentication and access requirements behind those experiences.
Taking control of access
Cuviva’s original platform was built on Microsoft Azure, with Azure Active Directory providing authentication. As the company and its platform developed, its requirements changed. Cuviva needed broader support for healthcare-specific authentication methods and integrations with customers’ existing login systems. At the same time, security, regulatory and customer requirements were shaping where and how the platform could be operated.
Requirements around the use of cloud providers were particularly important. Cuviva moved its platform from Azure to a Kubernetes-based environment hosted in Swedish data centers, giving the company greater control over its infrastructure and helping it meet the requirements of healthcare customers.
Its access layer needed to offer the same level of deployment control. Cuviva needed a solution that could run alongside the rest of its platform without tying access to a particular cloud environment. The Curity Identity Server could be hosted within Cuviva’s own infrastructure while providing the flexibility to connect different authentication methods and customer systems.
This allowed Cuviva to retain control over where its access infrastructure runs while continuing to support the different technical, security and hosting requirements of its customers.
Bringing different ways to log in together
Cuviva connects healthcare organizations’ existing login systems using standards such as OpenID Connect and SAML. Healthcare professionals can authenticate through their organization’s existing arrangements, supporting a single sign-on experience without requiring Cuviva to build a separate solution for each partner.
Cuviva can also connect specialist providers when additional electronic identity methods are required. For example, it uses Signicat to accommodate local authentication requirements while keeping Curity at the center of its setup.
This means customers do not need to conform to a single authentication method. Cuviva can connect an organization’s existing system or introduce another authentication provider while maintaining a consistent approach across its applications.
That flexibility is particularly important in healthcare, where technical choices need to accommodate customer policies, security requirements and regulatory obligations. Instead of building those differences into individual applications, Cuviva can manage them through a common approach to access.
More time to build what matters
For Cuviva’s product teams, this approach changes where engineering effort goes. Rather than building custom authenticators and authentication flows separately within individual applications, teams can reuse capabilities already available across the platform.
Joakim Wingård, CTO at Cuviva, describes the value as:
A reusable identity foundation instead of treating authentication as an application-specific concern.
Engineering time saved is one of the main benefits. Centralized access control and configurability also make it easier for Cuviva to respond to different customer requirements without solving the same access challenges repeatedly.
This becomes increasingly valuable as Cuviva takes on larger deployments. New healthcare organizations bring their own systems, policies and authentication requirements, but accommodating them does not have to mean rebuilding access from the ground up. Product teams can spend more of their time developing healthcare functionality while existing access capabilities can be configured and reused.
Supporting access across new markets
The same flexibility becomes important as Cuviva expands beyond Sweden. Entering a new healthcare market means accommodating not only different authentication ecosystems, but also local regulatory, security and customer requirements. Cuviva therefore needs to adapt to local conditions without creating a different access architecture for every market.
Standards such as OAuth, OpenID Connect and SAML provide a common foundation, while specialist providers can be added where local authentication methods are required. Standards do not make a healthcare service compliant by themselves. They do, however, give Cuviva a consistent way to integrate the authentication methods and systems required in different environments.
This gives the company a model it can continue to build on as its international footprint grows.
From patients and healthcare professionals to AI agents
The types of actors accessing Cuviva’s services are also beginning to change. Cuviva is developing AI capabilities for its products and internal teams. As agents interact with systems and perform actions, controlling what they can access and what they are authorized to do becomes part of the access architecture.
In a regulated environment such as healthcare, giving an agent broad access to systems and sensitive information is not an option. Cuviva is already applying access controls to these new use cases, and the Curity Identity Server already plays a role in this developing architecture by providing authentication and tokens.
The actors may be changing, but the principle remains the same: access should be based on who or what is making a request, what they are allowed to do and the context in which they are acting.
For Cuviva, that creates continuity between what the platform needs today and what comes next. Whether supporting a new healthcare organization, adapting to requirements in another market or introducing AI-enabled services, Cuviva can evolve how access works without turning each new requirement into a separate engineering project.
