Substantial requires at least two authentication factors from different categories under the person’s control. High goes further by requiring resistance to duplication and tampering, and protection against capable attackers. For healthcare access, that difference usually pushes organisations away from copyable credentials and toward hardware-rooted possession with tighter identity governance.
What the assurance levels mean in practice
eIDAS substantial and high are both strong identity assurance levels, but they are not the same bar. Substantial is designed to make impersonation difficult through multi-factor authentication and a trustworthy identity process. High adds a stronger resistance requirement: the credentials and authenticator must be much harder to copy, tamper with, or replay, which matters when the relying party cannot tolerate a plausible clone.
In healthcare, that distinction matters because access often protects clinical records, prescribing, referrals, and administrative workflows where misuse can affect care delivery as well as privacy. Substantial may be adequate for many routine access cases, but high is the better fit where the organisation needs stronger confidence that the presenting user is the same person every time and that the credential itself is not easily duplicated.
For the underlying identity model, the practical difference is not just “more factors.” High assurance changes the trust assumption from “the user has met a strong login test” to “the authenticator and enrolment process are resilient against capable attackers.” That usually pushes implementations toward stronger device binding, hardware-backed authenticators, and tighter proofing and recovery rules.
Why healthcare often pushes the gap wider
Healthcare systems frequently mix high-value data with operational urgency. Clinicians need fast access, but access also happens from shared workstations, mobile devices, partner portals, and remote channels. That creates pressure to favour convenience, yet convenience can clash with the properties needed for high assurance, especially where copyable secrets or weak recovery paths would undermine the whole control.
The main operational difference is that substantial can be implemented with strong MFA using factors the user controls, while high must resist duplication and tampering in a way that stands up better to phishing, token theft, and credential cloning. If the environment still allows easy credential export, weak recovery, or unmanaged fallback methods, the organisation may satisfy a substantial-style control but still fall short of high assurance in practice.
That is why healthcare programmes often need to think beyond login and into lifecycle governance. Enrolment, device registration, recovery, revocation, and exception handling all become part of the assurance boundary, especially when clinicians, contractors, and patients may need different access patterns.
How to choose the right level for access design
The decision is usually driven by the impact of misuse, the availability of strong authenticators, and the amount of operational friction the workflow can absorb. If access is low risk and the user population is broad, substantial may be the more workable baseline. If access can expose clinical decision-making, regulated records, or privileged administrative functions, high assurance is often the better target because it reduces the chance that a copied credential can behave like the real person.
It also changes how you design recovery and exception paths. A system can look high assurance on paper, but if help desk reset, backup codes, or alternative channels are easier to abuse than the primary authenticator, the effective assurance level drops. Healthcare teams should therefore treat fallback design as part of the assurance architecture, not an afterthought.
Risk and Threat Considerations
Healthcare access is a high-value target because stolen credentials can expose sensitive records, enable fraudulent actions, or disrupt care workflows. The central risk is that a weaker credential path can satisfy the login process while still being easy for an attacker to duplicate, replay, or socially engineer around, which is exactly where high assurance is meant to add protection.
Failure mechanism: If a healthcare organisation relies on copyable factors, weak recovery, or poorly controlled credential issuance, an attacker can turn a one-time login event into persistent access. That can defeat the intended difference between substantial and high, because the control then proves possession of a credential rather than the resilience of the authenticator and identity process.
Impact: The consequence can be unauthorised access to records, prescription abuse, impersonation of staff or patients, and broader trust loss in digital care channels. In a clinical setting, the business impact is not limited to confidentiality, because the same access path may also affect availability, data integrity, and patient safety.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Defines identity assurance and authenticator strength for access decisions. |
| Recommendation — Apply assurance levels and phishing-resistant authentication to match access risk. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Healthcare staff access depends on strong user authentication controls. |
| IA-5 — Authenticator Management | High assurance depends on secure issuance, protection, rotation, and recovery of authenticators. | |
| Recommendation — Enforce robust user authentication for staff and privileged access. Control authenticator lifecycle so credentials cannot be easily copied or reused. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Healthcare access needs governed access decisions and strong access enforcement. |
| A.8.5 — Secure authentication | High assurance requires stronger authentication mechanisms than basic MFA alone. | |
| Recommendation — Define and enforce access rules based on business and clinical need. Use secure authentication methods that resist duplication and tampering. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account lifecycle and recovery controls are central to healthcare identity assurance. |
| Recommendation — Tighten account issuance, recovery, and removal to prevent abuse. | ||
Practitioner Guidance
What to verify: Confirm whether your access path depends on a phishing-resistant authenticator, hardware-backed binding, and robust enrolment and recovery controls, not just “two factors.” If the same credential can be exported, copied, or replayed easily, treat the design as substantial-grade rather than high-grade.
Decision rule: Use substantial where the access need is broad and the operational tolerance for friction is limited, but move to high when the account can reach sensitive healthcare records, clinical actions, or privileged administration. The practical test is whether a cloned authenticator would still be acceptable if an attacker obtained the user’s session or recovery path.
What good looks like: The strongest implementations pair device- or hardware-rooted possession with tight identity lifecycle governance, including enrolment review, rapid revocation, and controlled exception handling. That gives healthcare teams a clearer boundary between ordinary strong authentication and assurance that is resilient to capable attackers.
Practitioner takeaway: The real difference is not the number of login steps, but whether the authenticator can survive cloning, tampering, and recovery abuse without turning healthcare access into a reusable impersonation path.
Related resources from NHI Mgmt Group
- Guide: Digital Identity, eID and Identity Wallets Guide
- What is the difference between high assurance authentication and simple username and password access in healthcare?
- What is the difference between single biometric verification and integrated biometric systems in high-assurance access flows?
- What is the difference between basic onboarding checks and high-assurance identity verification for clinician access?
- What is the difference between MFA and least privilege in healthcare access control?