TL;DR: Hospital digitalisation still breaks down when identity workflows are introduced without clinical adoption, training, and governance, according to Imprivata’s interview with Michaela Hansen. The bigger issue is not software access alone but whether identity controls fit frontline work without forcing unsafe workarounds.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Imprivata's blog post: Clinical workflow identity controls in hospitals fail when they are introduced without clinical adoption, training, and operational support.
Why it matters: It matters because IAM programmes in healthcare have to work for frontline staff, or clinicians will bypass them and the organisation will lose both control and efficiency.
Context
Clinical workflow identity in hospitals is a governance problem when identity controls are designed for IT convenience but do not fit the pace, pressure, and safety requirements of frontline care. In healthcare, access is not just a login issue. It is a workflow issue that can either support or disrupt patient care.
The interview frames the gap clearly: staff do not resist technology in the abstract, they resist tools that create friction, take time, or risk interrupting care. That makes clinical adoption, training, and visible support part of identity governance, not a separate change-management exercise.
The article also shows why fragmented access models create shadow processes in practice. When clinicians need multiple tickets, long approval cycles, or awkward authentication steps, they will improvise workarounds that weaken both governance and safety.
Key questions
Q: How should hospitals reduce identity friction for frontline clinicians?
A: Hospitals should design identity journeys around clinical tasks, not around internal IT convenience. That means simplifying login paths, aligning access profiles to real roles, and testing whether staff can complete work without repeated support tickets or workaround behaviour. If a process slows patient-facing activity, it is failing its operational purpose even if it is technically compliant.
Q: Why do hospital IAM rollouts fail when the technology itself is sound?
A: Because technical correctness does not guarantee clinical usability. If staff are not trained, supported at go-live, and involved early, they will experience the control as friction rather than help. That turns a nominal deployment into an unofficial process layer that security can no longer manage cleanly.
Q: What are the signs that clinical identity workflows are not working in practice?
A: Common signs include repeated help desk tickets, frequent access delays, staff inventing shortcuts, and complaints that digital workflows take longer than the manual ones they replaced. Those symptoms indicate that the identity process is misaligned with frontline work, not that clinicians are simply resistant to change.
Q: Who needs to own clinical identity governance in a hospital environment?
A: It has to be shared ownership. IT can manage policy and controls, but clinical leadership must sponsor adoption, and frontline champions must reinforce how the workflow works in practice. Without that mix, identity governance stays technically correct but operationally weak.
Technical breakdown
Why fragmented hospital login flows create governance drift
Hospitals often accumulate multiple platforms for records, medication, scheduling, and support functions, each with its own access path. When identity is fragmented across systems, clinicians spend more time authenticating than treating, and governance shifts from controlled access to informal workarounds. The technical problem is not only password load. It is the loss of a coherent identity journey across clinical applications, which makes every additional login another place where users can get stuck, bypass a process, or depend on local help from colleagues.
Practical implication: reduce access friction across the clinical application stack before users build unofficial shortcuts around it.
Why training and go-live support are part of identity governance
Identity controls in clinical environments succeed or fail at the point of use. A well-configured access model can still underperform if staff do not understand it, if support is unavailable during rollout, or if no one is present to resolve issues in real time. The article’s example of structured preparation, named champions, and minimum training coverage shows that adoption is a control surface. In practice, the identity programme must be introduced as an operating model, not just a technical deployment.
Practical implication: treat go-live readiness, floor support, and user training as governance controls, not soft enablement tasks.
Why role design matters more than ticket volume in clinical IAM
The article’s example of waiting weeks and raising many tickets before access was usable points to a deeper IAM issue: if the initial profile is wrong, every downstream request becomes remediation. In hospitals, role and entitlement design have to anticipate clinical tasks, not merely assign broad access and hope service desk tickets will fill the gap. Poor role modelling produces delay, friction, and local improvisation. Good governance starts with getting the identity profile right before users need it.
Practical implication: fix role and entitlement design at onboarding so clinicians do not need repeated access exceptions to do their jobs.
NHI Mgmt Group analysis
Clinical identity governance fails when adoption is treated as optional. Hospitals do not experience IAM as a policy problem alone. They experience it as whether the workflow helps or hinders patient care, and that means training, support, and clinician involvement are part of the control surface. The practical conclusion is that access design has to be measured by frontline usability, not only by technical completeness.
Access friction becomes an operational risk multiplier in healthcare. When staff face too many logins, approvals, or access delays, they will look for faster paths around the system. That does not just reduce efficiency. It pushes identity governance into informal behaviour that the security team no longer controls. The implication is that workflow fit is a security issue because it shapes whether controls are obeyed or bypassed.
Clinical workflow identity is a named governance gap, not a niche usability issue. This article shows that hospitals need a concept we can call clinical workflow identity: the alignment of identity controls with the tempo, safety requirements, and role complexity of care delivery. Without that alignment, identity investments underperform and frontline staff lose trust in the programme. The practitioner conclusion is to govern identity through clinical workflow fit, not through access logic alone.
Champions matter because hospitals run on peer credibility as much as central policy. The interview describes colleagues helping colleagues, which reflects how change really lands in clinical environments. That is not a communications layer on top of IAM. It is part of the governance model itself. The implication is that the most durable identity programmes in healthcare combine central standards with local clinical advocates.
Leadership sponsorship is the difference between a deployed control and a working control. The article makes clear that even strong training and user engagement cannot compensate for a lack of support from hospital leadership. Identity governance in healthcare therefore depends on executive backing to free up time, staff, and process change. The practitioner conclusion is simple: if the organisation will not fund adoption, the control will not behave as designed.
What this signals
Clinical workflow identity: hospitals should treat the fit between identity controls and frontline care as a governance domain in its own right. When login, role assignment, and support processes do not match clinical tempo, users will route around the system and the control objective changes from prevention to damage limitation.
The programme signal for IAM teams is that rollout quality matters as much as policy quality. Training coverage, champion networks, and visible support at go-live are not change-management extras. They are the conditions that determine whether the access model becomes the working model.
Healthcare identity teams should assume that every extra login, ticket, or approval has workflow cost. If clinicians have to spend more time on access than care, the organisation is effectively subsidising its own governance failure through productivity loss and unsafe local practice.
For practitioners
- Map identity controls to clinical tasks Document how authentication, access approval, and application switching affect nurses, physicians, and support staff during real shifts. Use that map to identify where controls add delay or create unsafe workarounds.
- Build go-live support into the control design Assign floor support, named champions, and rapid issue resolution during rollout so staff can complete work without reverting to informal access paths.
- Validate role profiles before first use Review whether each staff profile contains the access needed for the actual clinical workflow, not just the minimum on paper, so tickets do not become the primary access mechanism.
- Measure adoption as a governance outcome Track whether staff can use the identity workflow without repeated help desk intervention, because sustained ticket volume usually signals a design problem rather than a user problem.
Key takeaways
- Hospital identity governance fails when clinical workflows, training, and support are not built into the access model from the start.
- The practical evidence in this interview is the persistence of workarounds, long ticket chains, and user frustration when access design does not fit frontline care.
- Hospitals need identity programmes that are measured by clinical usability as well as technical control coverage, or adoption will remain fragile.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centers on whether staff get usable, role-appropriate access in a clinical workflow. |
| GV.RR-02 — Roles, responsibilities, and authorities are established, communicated, and coordinated | The interview stresses shared ownership across IT, clinical leaders, and champions. | |
| Recommendation — Align access permissions and entitlements with clinical tasks so staff do not need workarounds to do their jobs. Define clinical, IT, and executive responsibilities for identity adoption before rollout begins. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The access bottleneck described in the article is driven by how credentials and access steps are managed. |
| Recommendation — Use authenticator management to reduce repeated access friction and keep clinical logins usable. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article highlights onboarding, role setup, and access readiness as operational account management issues. |
| Recommendation — Tighten account management so clinicians receive correct access before they need to improvise around it. | ||
Key terms
- Clinical Workflow: Clinical workflow is the sequence of tasks, decisions and system interactions used to deliver care. In identity programmes, it matters because access controls only work well when they reflect how staff actually move, collaborate and use applications in wards, clinics and specialist settings.
- Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
- Clinical Champions: Trusted peers who help colleagues adopt new workflows and reinforce correct usage after rollout. In hospital identity programmes, champions reduce resistance by translating policy into practical bedside behaviour and by showing that the new process is workable under pressure.
- Access Friction: Access friction is the delay, inconsistency, or effort a person experiences when trying to reach a system or task. It becomes a governance issue when it is high enough to encourage shortcuts, exceptions, or support-heavy workarounds that weaken the intended control model.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 25, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org