CIS1 to CIS2 migration exposes clinical identity access gaps

At a glance

What this is: This is an analysis of the CIS1 to CIS2 migration pressure facing UK and European healthcare organisations, with the key finding that access governance now has to preserve clinician workflow while moving to higher-assurance authentication.

Why it matters: It matters because IAM teams in healthcare must support shared-device clinical access, national system access, and legacy cutover at the same time without widening identity risk or slowing care delivery.

Context

CIS1 to CIS2 migration is a healthcare identity and access problem, not just an infrastructure upgrade. NHS England has set a final CIS1 removal date, which means trusts must redesign how clinicians authenticate to local and national systems while protecting patient data and keeping workflows usable.

The access model is unusually complex because many clinicians use separate identities for local hospital systems and national services such as NHS Spine. That creates a governance gap where one user may need multiple authenticators, shared devices, and rapid reauthentication across clinical tasks, all under tightening security expectations.

In this environment, the old assumption that a username and password is enough no longer holds. High-assurance authentication has become the baseline requirement, but healthcare teams still have to make it work in shared-device and follow-me desktop settings without creating friction that pushes users around the control.

Key questions

Q: How should healthcare organisations manage CIS1 to CIS2 migration without disrupting clinical access?

A: They should treat the migration as an identity governance programme, not a one-time technical swap. That means mapping every CIS1 dependency, validating CIS2-ready authentication on shared devices, and coordinating provisioning and offboarding across local and national systems so clinicians keep uninterrupted, auditable access during the transition.

Q: Why do healthcare identity controls fail when clinicians use shared devices and mixed systems?

A: They fail when the programme assumes a single-user, single-device login pattern. Clinicians move across wards, shared workstations, and national services, so controls that work only on managed laptops or static sessions create friction, inconsistent assurance, and shadow workarounds.

Q: What breaks when high-assurance authentication is added without clinical workflow design?

A: The control often protects the login screen but not the work itself. If reauthentication, smartcard replacement, or token handling interrupts medication tasks, witnessing, or break-the-glass access, users experience delay and the organisation gets less real security, not more.

Q: What should trusts do when CIS1 support is being withdrawn but CIS2 is not fully ready?

A: They should manage CIS1 and CIS2 as a controlled coexistence period with clear exception ownership, readiness checks, and access-path testing. The goal is to reduce reliance on CIS1 before the final removal date without forcing clinicians into unusable access patterns.

Technical breakdown

Why CIS2 shifts clinical identity from simple login to high-assurance access

CIS2 changes the access model because it raises confidence requirements for who is using the system, not just whether they know a secret. In practice, that means multi-factor authentication or other strong authenticators must work across local and national services, often in shared-device environments where clinicians move quickly between tasks. The technical challenge is not authentication alone, but keeping identity binding, session continuity, and reauthentication aligned with patient-facing workflows. When the same user must reach multiple systems with different trust levels, the access layer becomes part of clinical operations rather than a back-office control.

Practical implication: Design authentication flows for shared clinical workstations and mixed-trust systems, not for single-user endpoints.

How separate local and national identities create workflow friction

Healthcare organisations often operate with one identity for local hospital systems and another for national services, which doubles the governance surface. That split forces clinicians to manage multiple sign-in paths, multiple credentials, and different assurance rules depending on the system they are touching. The friction is especially visible where national platforms still inherit older PKI or smartcard patterns and local systems are already moving to modern standards such as OpenID Connect. The real architectural issue is consistency: identity assurance, session handoff, and step-up authentication need to work across both domains without making users manually stitch the experience together.

Practical implication: Map where identity is duplicated across local and national systems and remove avoidable sign-in fragmentation.

Why clinical access controls must support reauthentication inside the workflow

Clinical environments do not use identity only at the front door. They also need reauthentication for high-risk in-application actions such as medication administration, witnessing, and break-the-glass access. That is where access governance becomes operational, because the control must verify intent at the moment of sensitive action without breaking the pace of care. The technical lesson is that strong authentication and clinical usability are not opposites if the control is placed at the right step in the workflow. If it is placed too early or too often, users bypass it mentally; if it is too weak, sensitive actions are under-protected.

Practical implication: Place step-up checks at high-risk clinical actions instead of overburdening initial login.

NHI Mgmt Group analysis

Clinical CIS2 migration is really a governance redesign for shared access. The article shows that the migration pressure is not only about replacing one authentication service with another, but about preserving access across shared devices, roaming staff, and mixed local and national systems. That combination exposes any identity programme that was built around a one-user, one-device assumption. The practitioner conclusion is that healthcare identity governance has to be engineered around workflow reality, not abstract login models.

High-assurance authentication becomes fragile when organisations ignore clinician context. CIS2 raises the assurance bar, but assurance that cannot operate on shared workstations or follow-me desktops will fail in practice. The point is not that healthcare should relax the control, but that the control has to be fit for purpose in clinical environments. The practitioner conclusion is that assurance design must be measured by usable coverage across wards, devices, and national services.

OpenID Connect-style modernisation does not remove lifecycle pressure, it moves it. As national platforms shift away from legacy PKI and smartcard dependency, trusts still have to govern authenticator choice, identity binding, and phased coexistence with CIS1. That is a lifecycle problem, not just a protocol swap. The practitioner conclusion is that the migration plan has to include coexistence rules for old and new access paths, or the result will be fragmented control.

CIS1 to CIS2 migration is exposing the identity blast radius of legacy healthcare access. Every separate identity, every shared device exception, and every legacy national access path expands the number of places where governance can fail. This is why the topic belongs in both IAM and healthcare operational planning. The practitioner conclusion is that migration sequencing should be driven by where access complexity is highest, not by where replacement is easiest.

National access and local access can no longer be governed as separate problems. The article makes clear that clinicians experience both as one working day, even if the systems are controlled differently behind the scenes. That means a split governance model creates hidden failure points in onboarding, authentication, and support. The practitioner conclusion is that trusts should evaluate access policy across the full clinical journey, not by system silo.

From our research library:

• 60% of healthcare organisations do not assess a vendor's security before signing a contract that grants access to protected health information, according to Ponemon Institute's 2023 Third-Party Risk in Healthcare report.

What this signals

Identity fragmentation is the hidden cost of clinical modernisation. When staff need separate credentials for local and national services, every additional authenticator becomes another support burden, another user experience failure point, and another place where migration projects stall. Healthcare IAM teams should expect access rationalisation to become a prerequisite for any meaningful CIS2 transition.

High-assurance access only works when the control matches the environment. Shared devices, roaming clinicians, and emergency workflows make healthcare fundamentally different from office identity programmes. The practical signal is that CIS2 readiness should be judged by whether authentication survives real ward conditions, not by whether it passes a desktop-only pilot.

Clinical access governance now sits at the intersection of compliance and continuity of care. NHS England’s direction, European healthcare modernisation, and tighter national requirements all point the same way: identity teams must prove that stronger assurance can coexist with fast access. For practitioners, the task is to remove duplication, reduce authenticator sprawl, and make workflow-friendly security the default.

For practitioners

• Map the clinician identity split Inventory where staff use separate identities for local and national systems, then document every handoff between those access domains so the migration plan reflects real clinical workflow.
• Plan coexistence for CIS1 and CIS2 Build a phased access model that lets CIS1 applications and CIS2-native access operate in parallel until cutover, rather than forcing a single big-bang transition.
• Validate shared-device authenticator coverage Test authentication methods on ward workstations, thin clients, mobile devices, and other shared endpoints before standardising on any one authenticator.
• Use step-up checks for high-risk clinical actions Require stronger reauthentication for medication administration, break-the-glass access, and other sensitive in-application tasks instead of adding friction to every login.
• Align migration milestones to support withdrawal dates Treat the CIS1 SLA reduction and final removal date as governance triggers for readiness reviews, exception tracking, and cutover sequencing.

Key takeaways

• CIS1 to CIS2 migration is exposing how much clinical access still depends on duplicated identities, legacy pathways, and shared-device exceptions.
• The access challenge is not only technical, it is operational, because clinicians need secure entry to local and national systems without slowing patient care.
• Trusts that treat migration as an identity governance project, not just an authentication upgrade, will be better placed to retire CIS1 on time.

Key terms

• High Assurance Authentication: Authentication that gives a higher level of confidence in the user’s identity than password-only login. In healthcare, it usually combines stronger factors, device context, or approved authenticators so staff can access sensitive systems securely without turning clinical work into a manual checkpoint.
• Clinical Identity Access: The access path clinicians use to reach patient records, prescribing systems, and national health services. It often combines local and central identities, which makes workflow design and assurance governance part of safe care delivery.
• Shared-Device Access: An access pattern where multiple users authenticate through the same endpoint or workstation, often seen in healthcare and operational environments. It weakens simple one-user, one-device assumptions and requires stronger identity proofing, session control, and audit evidence to preserve accountability.
• Federated Access: A delegated access model that lets an AI client act through controlled identity flows instead of embedded long-lived secrets. For agentic systems, federation improves accountability because credentials can be scoped, tracked, and revoked more cleanly.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.