Accessing the Stanford Citrix environment is a critical requirement for thousands of faculty, staff, and medical professionals who need to utilize specialized applications remotely. Whether it is for accessing Epic electronic health records, managing finances through Concur, or utilizing research software that requires high-performance computing, the Citrix platform provides a secure, virtualized bridge to Stanford’s internal network.

Because Stanford operates as a complex ecosystem involving the University, Stanford Health Care (SHC), Stanford Children’s Health (SCH), and affiliated partners like the VA and SLAC, there is no single "one-size-fits-all" login page. Navigating to the correct portal based on specific affiliation is the most important step in the process.

Identifying the Correct Stanford Citrix Portal

Before attempting to log in, it is essential to determine which organizational entity issued the credentials. Using the wrong portal often leads to "Access Denied" errors or a blank screen, even if the username and password are correct.

  1. Stanford Health Care (SHC): Primarily used by hospital staff, nurses, and clinicians. Credentials usually consist of a SID (Stanford ID, typically numeric or alphanumeric) and a network password.
  2. Stanford Children’s Health (SCH): Used by personnel at Lucile Packard Children's Hospital. Access is generally through a specific "Go Stanford Children's" URL.
  3. Stanford University / School of Medicine: Used by students, faculty, and researchers. This often utilizes the SUNet ID and is frequently accessed through the "MyApps" service.
  4. VA Palo Alto (PAVA): Used by residents and fellows rotating through the Veterans Affairs system. This requires a specific VA-issued PIV card or an authorized exemption.

Essential Prerequisites for Citrix Connection

Regardless of the department, two components are mandatory for a successful Citrix session at Stanford: the Citrix Workspace application and Duo Two-Factor Authentication.

Installing Citrix Workspace App

While some portals offer a "Light Version" or "HTML5" version that runs directly in a web browser, the full experience—including local printing and multi-monitor support—requires the Citrix Workspace app (formerly known as Citrix Receiver).

For Windows users, the installation involves downloading the latest executable from the official Citrix site. During setup, it is generally advised to leave the "Add Account" prompt blank if the intention is to log in via a web browser portal, as Stanford’s various gateways handle account synchronization automatically.

Mac users must ensure they are running a version compatible with their macOS (especially with the transition to Apple Silicon). In our testing, version 2309 or later provides the best stability for macOS Sonoma. After installation, Mac users may need to grant "Screen Recording" or "Accessibility" permissions in System Settings to allow Citrix to handle window scaling correctly.

Setting Up Duo Security

Stanford mandates multi-factor authentication (MFA) for all remote access points. Most users prefer the "Duo Push" method. Before attempting to log in to Citrix, ensure the Duo Mobile app is installed on a registered smartphone. If working in a high-security environment like the VA, a physical hardware token or a PIV card may be required instead of a mobile push.

Detailed Login Procedures for Stanford Health Care (SHC)

Stanford Health Care staff often need to access the Citrix environment to use Epic, Concur, or the MyTime application. The workflow differs slightly depending on whether the user is on-campus or working remotely.

Accessing Citrix via SHC Connect

For staff on the hospital network or using a shared SHC computer (such as those found in nurse stations or break rooms), the preferred method is through the SHC Connect intranet.

  1. Navigate to the SHC Connect Home Page (the internal SharePoint portal).
  2. Locate the Citrix Login link, usually positioned in the top right-hand corner of the header.
  3. On the login screen, enter the SID and the associated network password.
  4. Once the Citrix storefront opens, users can search for specific apps like "Epic Hyperspace" or "Concur" using the magnifying glass icon.

Remote Access for SHC

When working from home, staff should use the external-facing gateway. In some instances, it may be necessary to connect to the Stanford VPN (Cisco AnyConnect) first, though many SHC Citrix applications are "published" to be accessible directly via the web gateway without a standing VPN connection, provided Duo authentication is successful.

Accessing Stanford Children’s Health (SCH) Citrix

Stanford Children’s Health maintains a distinct portal that is optimized for clinical workflows within the pediatric departments.

Desktop Login for SCH

The primary entry point for SCH staff is the "Go Stanford Children's" portal.

  1. Open a web browser and enter the dedicated URL: go.stanfordchildrens.org.
  2. Enter the SCH-issued username and password.
  3. A Duo prompt will appear. After approving the request on a mobile device, the application dashboard will populate.

Navigating the SCH Applications Portal

The SCH interface often features a "Favorites" tab. For clinicians who frequently use Epic, clicking the "Star" icon next to the application will pin it to the home screen. This prevents the need to search through the "All Apps" folder during every login session.

In our experience, if the application fails to launch and instead downloads a file named launch.ica, it indicates that the Citrix Workspace app is either not installed or the browser is not correctly associated with the Citrix protocol. To fix this, users should go to the "Account Settings" within the portal and select "Change Citrix App" to "Detect Receiver."

Stanford University and School of Medicine Access (MyApps)

For University-affiliated users, the Citrix environment is often referred to as "MyApps." This service allows students and faculty to run high-cost software (like MATLAB, ArcGIS, or SAS) without needing to purchase individual licenses for their personal machines.

  1. Visit the University IT (UIT) software portal.
  2. Log in using the SUNet ID and password.
  3. Complete the WebAuth process with Duo.
  4. Select the desired virtual desktop or individual application.

The University environment is particularly sensitive to session timeouts. If a session is left idle for more than a specific duration (usually 2 to 4 hours depending on the department), the Citrix session will automatically disconnect to reclaim server resources. Always save work to a cloud-based drive (like Google Drive or OneDrive) rather than the "C: Drive" of the virtual machine, as local virtual storage is often wiped upon logout.

SLAC and VA Palo Alto Special Requirements

Specialized departments like the SLAC National Accelerator Laboratory and the VA Palo Alto Health Care System have unique security layers.

SLAC Citrix Login

SLAC employees typically use citrix.slac.stanford.edu. The authentication here is tightly integrated with SLAC's internal directory. If users encounter a "Cipher Suite" error, it usually indicates that the local Citrix Workspace app version is too old to support the modern encryption standards used by SLAC.

VA Palo Alto (PAVA) Remote Access

Residents rotating at the VA face the most complex login process. Remote access to the VA's CPRS or specific imaging software requires:

  • A VA-issued PIV card.
  • A USB Smart Card reader.
  • The citrixaccesstoken.va.gov portal.

If a PIV card is lost or not yet issued, residents can request a "1-day PIV Exemption" through the Employee Self-Service (ESS) portal. This generates a temporary windows password that can be used with a standard username/password login on the Citrix Access Gateway (CAG).

Troubleshooting Common Citrix Login Issues

Even with the correct credentials, technical hurdles can prevent a successful login. Here are the most frequent issues and their verified solutions.

The .ica File Download Issue

When a user clicks an application and a file named launch.ica (or boilerplate.asp) downloads instead of the app opening, the browser does not know how to handle the Citrix protocol.

  • Solution (Chrome/Edge): Click the small arrow next to the downloaded file and select "Always open files of this type."
  • Solution (Mac/Safari): Ensure that the Citrix Workspace app is listed in the "Extensions" or "Plug-ins" section of Safari settings. In recent macOS versions, it is often better to use Chrome or Firefox for Citrix access.

Duo Authentication Timeouts

If the Duo prompt does not appear on the phone, the login will eventually hang or time out.

  • Troubleshooting: Check if the smartphone is on Airplane Mode or if "Do Not Disturb" is active. If the "Push" fails, users can manually enter a 6-digit passcode generated by the Duo app by clicking the "Enter a Passcode" button on the Stanford login screen.

Screen Resolution and Multi-Monitor Problems

Users often find that the Citrix window is too small or spans across multiple monitors awkwardly.

  • Adjustment: Within the Citrix session, locate the "Citrix Toolbar" (usually a small tab at the top of the screen). Select "Window" to switch from full-screen to a windowed mode. For multi-monitor setups, drag the window so it spans across both screens, then select "Full Screen" again; the environment should detect the dual-monitor configuration.

Printing from a Citrix Session

Printing from a virtual application to a local home printer can be temperamental.

  • Best Practice: Use the "Citrix PDF Universal Printer." Instead of sending the job directly to a physical device, this creates a PDF of the document within the session and then opens it on the local computer's PDF viewer, from where it can be printed reliably to any local hardware.

Mobile Access: Citrix on iPhone and iPad

For clinicians on the move, accessing Stanford Citrix via iOS is a viable option for quick tasks like checking labs or approving timecards.

  1. Download the Citrix Workspace app from the Apple App Store.
  2. Open the app and tap "Get Started."
  3. Enter the URL: go.stanfordchildrens.org (for SCH) or the specific SHC gateway.
  4. Toggle the "Use Smart Card" option to Off unless you have a mobile-compatible card reader.
  5. Complete the Duo authentication.

Note that using clinical apps like Epic on a phone is significantly different from the desktop experience. The interface is often condensed, and navigation requires using the virtual keyboard and "touch-to-click" gestures.

Summary of Access Links

Entity Portal URL / Method Credential Type
Stanford Health Care SHC Connect Intranet / stanfordhealthcare.org SID / Network Password
Stanford Children's go.stanfordchildrens.org SCH Username
Stanford University uit.stanford.edu/service/myapps SUNet ID
SLAC citrix.slac.stanford.edu SLAC ID
VA Palo Alto citrixaccesstoken.va.gov VA PIV / Username

Conclusion

Successfully logging into the Stanford Citrix environment requires a clear understanding of your organizational affiliation and the proper setup of the Citrix Workspace app and Duo Security. While the process may seem daunting due to the multiple portals and security layers, following the specific workflow for your department—whether it be SHC, SCH, or the University—ensures a stable and secure remote working experience. Always remember to log off completely from the Citrix session rather than just closing the browser tab to maintain the security of Stanford's sensitive data.

Frequently Asked Questions (FAQ)

What is my SID and how does it differ from a SUNet ID?

An SID (Stanford ID) is a unique identifier used primarily by Stanford Health Care and Stanford Children's Health for clinical and HR systems. A SUNet ID is the account name used for University-wide services like email and Canvas. While some users have both, they are usually separate accounts with different passwords.

Can I use Citrix on a public computer?

Yes, but it is not recommended for viewing sensitive patient data. If you must use a public terminal, ensure you do not select "Remember Me" and that you fully "Log Off" and close all browser windows after your session.

Why do I see "No Apps Available" after logging in?

This usually means your account permissions have not been provisioned for the specific applications you are looking for. You should contact the IT Help Desk (650-723-3333 for SHC or 650-725-HELP for the University) to verify your "entitlements."

Does Stanford Citrix require a VPN?

For many web-published applications, a VPN (like Cisco AnyConnect) is not required if you are using the Citrix Gateway. However, some specific high-security research databases or file shares may require you to be on the VPN before the Citrix portal will even load.

How do I fix a "Citrix Workspace Hub" error on a Mac?

This is often a permissions issue. Go to System Settings > Privacy & Security > Permissions and ensure Citrix Workspace has access to "Files and Folders." If the error persists, a clean uninstallation using the "Citrix Uninstaller" tool followed by a reboot and reinstall usually resolves it.