Hi,

No HIPAA experience but as stated here you have to support logout.

To manage logout with JWTs, you’ll need… to manage states! Also some links on JWTs for authentication sessions that have already been posted here:

• http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/
• http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-for-sessions-part-2-why-your-solution-doesnt-work/

Pow uses sessions by default: GitHub - pow-auth/pow: Robust, modular, and extendable user authentication system · GitHub

PowAssent provides multi-provider support (ueberauth alternative): GitHub - pow-auth/pow_assent: Multi-provider authentication for your Pow enabled app · GitHub

I deal with HIPAA at work, and I use session based to our SSO and it is time based logout, and if an early logout is performed it logs out of everything else that uses the SSO as well (and vice-versa). I just verify with the SSO on-access if the account is still logged in or not.

So… I put the onus on the people that manage the SSO (other contractors). ^.^