Healthcare identity crisis shows why overprovisioning persists

At a glance

What this is: This is SailPoint’s analysis of healthcare identity risk, showing that manual processes are driving overprovisioned access across employees, non-employees, machine identities, and AI agents.

Why it matters: It matters because healthcare IAM programmes now have to govern mixed identity estates at clinical speed, where overprovisioning can expose patient data, delay access decisions, and weaken compliance.

By the numbers:

• 73% of healthcare organisations link manual processes to overprovisioned access.
• 43% of healthcare leaders admit that ePHI has been disclosed due to ungoverned access.

Context

Healthcare identity governance is the discipline of controlling who or what can access clinical systems, patient data, and operational platforms. In this article, the security gap is not a single breach vector but a governance model that still depends on manual approval and review while identities multiply across staff, contractors, vendors, devices, machine identities, and AI agents.

The article argues that overprovisioning persists because healthcare environments move faster than manual access administration. That creates delayed clinician access on one side and inappropriate access on the other, turning identity into the control plane that determines both patient-data exposure and operational friction.

For IAM and IGA teams, the central issue is lifecycle control across mixed identity types. The article is strongest when it shows that access sprawl is no longer a human-only governance problem, but a programme design problem that spans human, machine, and AI-connected access paths.

Key questions

Q: What breaks when healthcare identity governance stays manual?

A: Manual governance breaks when access decisions outgrow the speed and consistency of human approval chains. In healthcare, that leads to overprovisioned accounts, delayed clinician access, and lingering access after role changes. The result is not only inefficiency but a persistent path to ePHI exposure because excess entitlement becomes normal rather than exceptional.

Q: Why does over-provisioned access become more dangerous in healthcare identity environments?

A: Over-provisioned access increases the blast radius of human error, misuse, and compromised accounts. In healthcare, that risk is amplified by fragmented systems, static entitlements, and limited visibility into why access exists. When teams cannot see or explain access decisions clearly, they struggle to enforce least privilege, protect sensitive records, and prove compliance under pressure.

Q: What are the signs that user access governance is failing in a healthcare organisation?

A: Common warning signs include incomplete security training, missing documented procedures, unrestricted concurrent logins, weak monitoring, and no clear process for reporting or reviewing breaches. Another major signal is poor lifecycle control when employees change roles or leave. If access is not updated quickly, the organisation is carrying avoidable residual access risk.

Q: How should healthcare teams govern AI use that touches patient data?

A: They should start with discovery, then enforce policy at the point of use, and finally require auditability for every consequential interaction. That means mapping all AI apps, prompts, model calls, and downstream actions that can touch PHI, then applying runtime controls and identity-linked logs so the organisation can prove who used what, when, and for which workflow.

Technical breakdown

Why manual access processes fail in healthcare

Manual provisioning, review, and offboarding assume a relatively stable identity estate and tolerable response time. Healthcare breaks that assumption because clinicians, contractors, vendors, machines, and AI systems all need access at different speeds and with different risk profiles. When approvals sit in ticket queues or spreadsheet-driven reviews, the result is excess entitlement, delayed care delivery, and lingering access after role change or departure. The technical failure is not just slow administration. It is the absence of a governable identity lifecycle that can keep pace with clinical operations.

Practical implication: move high-volume healthcare access decisions out of manual queues and into lifecycle workflows tied to role, contract, and system state.

Why overprovisioning expands across human and non-human identities

Overprovisioning is not limited to employee accounts. In healthcare, the same governance gap affects contractors, affiliate physicians, travel nurses, machine identities, and now AI agents that interact with systems and data. Each identity type can accumulate access that outlives its purpose, especially when ownership and review responsibilities are unclear. That creates a wider attack surface than a traditional user-access problem because the organisation loses visibility into who owns the access, why it exists, and when it should be removed.

Practical implication: classify identities by type and lifecycle so access reviews, entitlements, and revocation rules reflect the identity’s actual operating model.

How ungoverned access turns into ePHI exposure

Electronic protected health information becomes exposed when entitlements exceed business need and are not continuously validated. In practice, that can mean a non-employee retaining access to patient records, a machine identity carrying broader system rights than intended, or an AI workflow reaching data it should never see. The security issue is not just visibility. It is that inappropriate access can persist long enough to become ordinary and therefore invisible to manual control checks.

Practical implication: pair least-privilege enforcement with continuous entitlement monitoring so ePHI exposure is reduced before access becomes accepted as normal.

Threat narrative

Attacker objective: The objective is to reach patient data or clinical systems through access that was never properly scoped, reviewed, or removed.

1. Entry occurs through identity sprawl, where employees, contractors, vendors, devices, and AI agents receive access through manual processes that are difficult to track consistently.
2. Credential or entitlement abuse follows when unnecessary permissions and ungoverned identities retain access beyond the point of need.
3. Escalation happens as inappropriate access broadens across clinical systems and patient data, increasing the chance that a low-value account can reach sensitive information.
4. Impact is the disclosure of ePHI and the operational drag caused by delayed or poorly governed access decisions.

Breaches seen in the wild

• Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity sprawl is now the primary healthcare governance problem. The article shows that access risk is no longer limited to employee accounts or one control point in the joiner-mover-leaver process. Healthcare programmes now have to govern a mixed estate of human, machine, and AI-connected identities, which means identity ownership and lifecycle discipline have become operational security controls, not back-office administration.

Manual provisioning creates overprovisioning by design. The article’s 73% figure links the control failure directly to human-run processes, not to isolated misconfiguration. When approvals, changes, and removals depend on manual action, entitlement accumulation is the predictable outcome. The practitioner conclusion is straightforward: if the process is manual, excess access is not an exception but the expected state.

Ungoverned AI access is the next access-sprawl multiplier. The article notes that 97% of providers are using or exploring AI and that 81% say ungoverned AI poses significant risk. That combination means healthcare identity governance is moving into a mixed environment where access can be both human-requested and machine-executed. The implication is that access policy now has to account for runtime behaviour as well as static assignment.

Health data protection depends on entitlement precision, not just visibility. The article’s ePHI disclosure finding shows that broad visibility alone does not stop harm if access remains too broad. The governance gap is not only knowing where identities exist, but proving that each identity still needs its current access. Practitioners should treat entitlement precision as the control that separates manageable complexity from persistent exposure.

Machine and contractor access need the same lifecycle discipline as clinicians. The article makes clear that 66% of respondents find machine identities harder to manage than human identities, while inappropriate access among non-employees is already common. That means lifecycle governance cannot be reserved for staff accounts. The practitioner takeaway is that ownership, review, and removal rules must apply consistently across every identity class that can reach patient data.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Identity sprawl is becoming the operating condition for healthcare IAM. The practical question is no longer whether organisations can list their identities, but whether they can keep entitlement boundaries accurate as staff, contractors, machines, and AI systems change faster than review cycles. That is why lifecycle governance now has to be designed as a control plane, not a clerical task.

Access review cadences are too slow for mixed identity estates. Access often persists long enough to look legitimate in the next certification cycle, which means the control can miss the period when overprovisioning is most dangerous. Programmes need to shift more of the decision to issuance time and treat exceptions as evidence of process strain rather than normal variation.

Healthcare teams should expect AI access pressure to rise quickly. According to the 2026 Infrastructure Identity Survey, 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years. That makes healthcare governance increasingly dependent on whether identity teams can scope AI access before it becomes operationally embedded.

For practitioners

• Map all identity classes to a governed lifecycle Inventory employees, contractors, vendors, machine identities, and AI agents separately, then assign ownership for onboarding, change, and offboarding decisions across each class.
• Replace manual access approvals with policy-driven workflows Move recurring access grants and removals into rule-based workflows that can enforce least privilege at the point of assignment rather than after review delays.
• Prioritise ePHI entitlements for continuous review Focus recertification on patient-data access paths first, especially accounts with broad clinical system reach or unclear business ownership.
• Tighten machine identity ownership and review Require named owners for service accounts, API keys, tokens, and other machine identities so access can be justified, recertified, and removed on schedule.
• Build exception handling for AI-driven access requests Treat AI-mediated access as a governed identity event and require the same entitlement checks, approval criteria, and revocation paths used for other high-risk access.

Key takeaways

• Manual identity administration is the core reason overprovisioning keeps appearing in healthcare environments.
• The article ties overprovisioned access to ePHI disclosure, showing that governance gaps can become direct data exposure events.
• Healthcare IAM teams need entitlement precision across human, machine, contractor, and AI identities, not just broader visibility.

Key terms

• Identity Sprawl: Identity sprawl is the uncontrolled growth of identities, entitlements, and credentials across an environment. For NHIs, it usually appears when automation creates accounts faster than governance teams can inventory, review, and remove them. The result is hidden access, weak accountability, and a wider attack surface.
• Overprovisioning: Overprovisioning occurs when an identity receives more access than its job, task, or risk profile requires. In practice, it increases attack surface and makes lateral movement easier because a compromised account already carries permissions that the attacker can reuse immediately.
• Electronic Protected Health Information: Electronic protected health information is any PHI stored, processed, or transmitted in digital form. In practice, it includes records and related metadata that can identify a patient and must be protected through access control, logging, and breach response processes across human and non-human identities.
• Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.