Healthcare identity crisis shows why overprovisioning persists

At a glance

What this is: This is SailPoint's analysis of healthcare identity sprawl, showing that manual processes are driving overprovisioned access and ePHI exposure across human, machine, and AI identities.

Why it matters: It matters because healthcare identity programmes now have to govern clinicians, non-employees, machine identities, and AI agents with the same access controls and lifecycle discipline.

By the numbers:

• 73% of healthcare organizations link manual processes to overprovisioned access.
• 43% of healthcare leaders admit that electronic protected health information has been disclosed due to ungoverned access.
• 97% of providers are using or exploring AI agents.

👉 Read SailPoint's analysis of healthcare identity risk and overprovisioned access

Context

Healthcare identity governance is becoming a control problem, not just an access administration problem. When employees, contractors, vendors, devices, and AI agents all need access to the same clinical and operational systems, manual approval workflows stop being reliable enough to control privilege growth or protect sensitive records.

SailPoint's survey points to a sector where access decisions are moving slower than the environment around them. That is a familiar identity security failure mode: accounts accumulate, governance trails lag behind operations, and patient data becomes exposed through permissions nobody can clearly justify after the fact.

Key questions

Q: How should healthcare teams reduce overprovisioned access without slowing care delivery?

A: Healthcare teams should reduce overprovisioned access by automating entitlement cleanup around role changes, offboarding, and temporary assignments. The goal is to remove permissions that no longer match clinical duties while preserving fast access for active care workflows. That requires current-state recertification, not periodic approval theatre.

Q: Why do machine identities and AI agents complicate healthcare IAM?

A: Machine identities and AI agents complicate healthcare IAM because they can scale quickly, access systems programmatically, and persist beyond the task that created them. If they are governed like human users, organisations miss the need for separate ownership, policy boundaries, and review logic for non-human access.

Q: What do security teams get wrong about access review in healthcare?

A: Security teams often treat access review as a periodic administrative exercise instead of a control that should reflect live operational need. In healthcare, that mistake leaves inherited permissions, contractor access, and stale vendor entitlements untouched long after the underlying purpose has ended.

Q: Who should be accountable when ePHI is exposed through excess access?

A: Accountability should sit with the identity, application, and data owners together, because ePHI exposure is usually created by weak entitlement governance rather than a single technical failure. Healthcare programmes should make access ownership explicit, so no one can claim the risk belonged only to the system.

Technical breakdown

Why manual identity processes create overprovisioning

Manual access administration breaks down when healthcare organisations must assign, change, and revoke permissions across a large mix of identities at speed. Overprovisioning happens when approvals are handled case by case, access changes are not tied tightly to role changes, and offboarding is delayed or incomplete. In that model, every exception becomes a standing permission. The result is not only excess access, but also poor visibility into which permissions are actually needed for care delivery, operations, and third-party support.

Practical implication: replace ad hoc access handling with lifecycle controls that can consistently remove excess permissions when roles change.

How AI agents and machine identities change healthcare access governance

AI agents and machine identities do not fit neatly into access patterns built for human users. They often need rapid, programmatic access to data and systems, but that access can persist longer than the task, or expand beyond the intended scope. Healthcare organisations in particular face a governance gap because machine and AI identities can multiply faster than review processes can keep up. Once these identities are treated like ordinary users, the organisation loses the ability to distinguish approved automation from ungoverned privilege.

Practical implication: classify machine and AI identities separately in IAM and review their permissions as distinct governance populations.

Why ePHI exposure is an identity control failure

ePHI exposure in this context is usually not the result of a single breached system, but of access that was never sufficiently constrained in the first place. When contractors, affiliate physicians, travel nurses, and vendors inherit permissions that exceed their current duties, sensitive data becomes reachable through ordinary workflows. That makes identity governance part of the data protection layer. Visibility into who can reach patient data, and why, becomes just as important as monitoring where the data sits.

Practical implication: map every high-risk dataset to explicit identity owners and review access against current job function, not historical entitlement.

Threat narrative

Attacker objective: The objective is to reach sensitive healthcare data through permissions that were never properly narrowed, reviewed, or removed.

1. Entry occurs through excessive or poorly governed access assigned to employees, contractors, vendors, or AI and machine identities that should not retain broad permissions.
2. Escalation follows when those identities keep unnecessary privileges long enough for misuse, accidental exposure, or attacker exploitation of orphaned and overprovisioned accounts.
3. Impact is disclosure of sensitive patient information, including ePHI, and a weakened ability to prove that access was limited to legitimate healthcare work.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• AI LLM hijack breach — attackers used stolen AWS access keys to hijack Anthropic LLM models on Bedrock.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Healthcare identity governance fails when manual access administration becomes the default control plane. The article shows a sector where permission decisions are still handled too slowly for modern identity sprawl, especially when contractors, vendors, and clinicians all need different access lifecycles. That is not a visibility problem alone, it is a governance design problem. The practitioner conclusion is that healthcare IAM must stop treating access review as a back-office task and start treating it as an operational control.

Machine identities and AI agents are forcing healthcare to govern non-human access as a distinct population. The article's core signal is that human-centric IAM models no longer cover the full access surface. Machine identities behave differently from staff accounts because they can be numerous, persistent, and difficult to rationalize with ordinary role-based thinking. The practitioner conclusion is that healthcare programmes need separate policy and review logic for non-human identities, not a human-user adaptation of the same workflow.

Overprovisioned access is the named failure mode here, and it is the real governance debt in healthcare. 73% linking manual processes to overprovisioning is not a maturity signal, it is a symptom of identity governance that cannot keep pace with operational change. Identity blast radius: once access is granted too broadly across clinical and third-party populations, one error or compromise can expose far more patient data than the role required. The practitioner conclusion is that healthcare security teams should measure privilege sprawl as a data exposure risk, not just an access hygiene metric.

ePHI disclosure shows that access governance and data security are now the same control conversation. The article makes clear that patient data protection depends on who can reach the data, not only on where the data is stored. That means identity certification, entitlement cleanup, and lifecycle offboarding belong inside the healthcare data protection programme. The practitioner conclusion is that ePHI control objectives should be written in identity terms, because that is where exposure is created.

Healthcare providers are discovering that automation without governance simply accelerates bad access decisions. The vendor positions automation and AI as the remedy, but the broader lesson is that speed without entitlement discipline produces more overprovisioning, not less. The practitioner conclusion is that automation must be anchored to least privilege and lifecycle rules before it can safely reduce risk.

From our research:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
• Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, which shows how quickly one identity failure can repeat.
• For the broader access-governance picture, see Ultimate Guide to NHIs for the lifecycle controls that keep identity sprawl from becoming a standing risk.

What this signals

Healthcare programmes should expect identity governance to move closer to data governance, because patient record exposure increasingly follows weak entitlement logic rather than perimeter failure. The practical consequence is that access owners, application owners, and data owners will need to work from the same entitlement view instead of separate operational reports.

Identity blast radius: healthcare security leaders should treat excess access as a patient-safety issue as much as a cybersecurity issue. Once that framing changes, access review cadences, contractor offboarding, and machine-identity inventories become board-relevant controls, not only IAM hygiene.

As non-human access grows, healthcare teams will need continuous visibility into which identities can reach regulated data and why. That shift aligns directly with the control intent in the Ultimate Guide to NHIs and with identity governance patterns discussed in the Top 10 NHI Issues.

For practitioners

• Separate human and non-human access policies Define different approval, review, and offboarding paths for clinicians, contractors, machine identities, and AI agents so that each population is governed according to its own risk profile.
• Rebuild access reviews around current duties Tie every entitlement recertification cycle to current job function, clinical assignment, or vendor relationship instead of relying on historical permissions that may no longer be justified.
• Treat AI and machine identities as governed populations Inventory AI agents and machine identities separately, then assign owners, access boundaries, and periodic reviews that reflect their automation-driven use patterns.
• Map ePHI to explicit identity controls Identify which identities can reach sensitive patient data, then remove any broad or inherited permissions that are not required for the present care or support task.

Key takeaways

• Healthcare identity sprawl is creating overprovisioned access faster than manual processes can correct it.
• The reported 43% ePHI disclosure rate shows that weak identity governance is now a direct data exposure problem.
• Healthcare teams need separate lifecycle and review controls for clinicians, contractors, machine identities, and AI agents.

Key terms

• Overprovisioned Access: Access is overprovisioned when an identity has more permissions than it needs for the work it actually performs. In healthcare, this often happens when roles change, temporary access is never removed, or manual approvals create permissions that outlive the original clinical or operational need.
• Non-Human Identity: A non-human identity is any machine or software identity that authenticates to systems and consumes access, including service accounts, tokens, certificates, bots, workload identities, and AI agents. These identities need ownership, lifecycle control, and review because they can create the same exposure as human accounts, often at greater scale.
• Electronic Protected Health Information: Electronic protected health information is regulated patient data stored or transmitted in digital form. It becomes a security concern when identities can reach it without a clear, current business need, because access governance is then part of the data protection control set rather than a separate administrative process.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.

This post draws on content published by SailPoint: The identity crisis in healthcare cybersecurity. Read the original.