IAL and AAL are the two assurance dials defined in NIST SP 800-63, the U.S. government's digital identity guidelines. Identity Assurance Level (IAL) grades how thoroughly a person's real-world identity was proven when their account was created — ranging from self-asserted identity with no checking, up to verified government documents combined with a biometric match. Authenticator Assurance Level (AAL) grades how strong each individual login is — from a single password, up to phishing-resistant hardware factors. They are independent: you can have a weakly-proofed identity logging in with a strong factor, or the reverse.
The value of this vocabulary is precision. Instead of arguing about whether identity verification is "strong enough" using adjectives, a team can specify an exact target — "IAL2, AAL2" — that maps to defined controls. In telemedicine you set those targets by role and by what a session exposes. A prescribing clinician needs high assurance on both dials; electronic prescribing of controlled substances (EPCS) effectively demands IAL2/AAL2-class identity proofing and authentication. A patient joining a low-risk consult can be given friction proportionate to the risk, not the maximum.
For a product team, the practical implication is to design enrollment and login as tiered flows rather than one-size-fits-all, and to record which assurance level each account actually met. The common pitfall is conflating the two dials — assuming that because a clinician logs in with MFA (a high AAL) their underlying identity was rigorously proofed (a high IAL), when in fact identity proofing may have been skipped at signup. EPCS and high-trust integrations care about both, so verify and document each independently.
The handbook · 7 volumes
Fora Soft Video Engineering Handbook
IAL and AAL levels decide how hard it is for patients and clinicians to get in, and the wrong choice either blocks visits or fails an audit. We wrote seven volumes covering the whole video stack, and for IAL / AAL decisions start with Volume 7: regulation, biometrics and production AI. Volume 6 covers face detection and OCR, Volume 3 calls. Written by Nikolay Sapunov, CEO at Fora Soft.
Choosing IAL / AAL levels for patient and clinician sign-in?
We will recommend IAL and AAL levels per user role and design the identity proofing and login flow with vendor options and an estimate. 250+ video products shipped since 2005.
