HIMSS 2026 showed zero trust and segmentation as healthcare’s real controls

At a glance

What this is: Elisity’s HIMSS 2026 recap argues that healthcare cybersecurity conversations centred on zero trust, segmentation, and privilege because those controls address the real attack paths created by vendors, credentials, and sprawling edge devices.

Why it matters: For IAM and NHI practitioners, the article shows why identity governance, least privilege, and segmentation have to be treated as operational controls, not as abstract architecture principles.

By the numbers:

• Cooper University Health Care reported a 75% reduction in unknown edge devices.
• Cooper University Health Care reported a 45% increase in segmentation coverage.

Context

HIMSS 2026 put a familiar healthcare security problem back in focus: trust is still being granted faster than it is being governed. In environments filled with vendors, integrations, medical devices, and shared clinical workflows, traditional perimeter thinking breaks down because access paths are now distributed across identity, network, and operational layers.

For NHI and IAM teams, the relevance is direct. Vendor accounts, hardcoded device credentials, and unmanaged edge systems all behave like non-human identity risks once they can reach clinical or administrative systems, which means zero trust only works when privilege, segmentation, and lifecycle control are enforced together.

The article’s starting position is typical for large healthcare environments: many tools, many stakeholders, and a widening gap between security intent and actual control of access paths.

Key questions

Q: What breaks in healthcare when trust is granted before identity and access are verified?

A: Implicit trust turns valid credentials, vendor logins, and device access into lateral movement paths. In healthcare networks, that means a compromise does not need to defeat the perimeter first. It only needs one over-permissioned path into clinical or administrative systems, which is why zero trust must govern access decisions continuously.

Q: Why do edge devices and vendor accounts increase breach risk in hospital networks?

A: They often combine long-lived access, uneven patching, and unclear ownership. That creates standing reach that attackers can abuse once a single credential or device is compromised. The problem is not that these assets exist, but that their access is frequently broader and less visible than teams assume.

Q: What signs show that segmentation is failing to contain healthcare risk?

A: Look for flat communication paths between device classes, unknown edge devices, vendor accounts that can reach multiple clinical zones, and security teams that cannot explain why a system has its current access scope. Those are signs that containment exists on paper but not in operational practice.

Q: How should healthcare teams balance privilege governance and segmentation?

A: They should treat them as complementary controls. Privilege limits what an identity can do, while segmentation limits where that identity can go if it is abused. Used together, they reduce both the likelihood and the blast radius of compromise in environments with medical devices and third-party access.

Technical breakdown

Why zero trust in healthcare depends on identity before network access

Zero trust is not just a network design; it is an access decision model. In healthcare, that matters because users, vendors, devices, and applications often coexist on the same operational fabric, but they should not inherit the same level of trust. Identity becomes the control plane that decides whether a request is legitimate, while segmentation limits what that identity can reach if it is compromised. Without that pairing, a valid credential can still become a path to lateral movement. The article’s core point is that healthcare breaches often exploit trusted access rather than bypassing defenses outright.

Practical implication: bind access policy to verified identity and reachable scope, not to location inside the network.

How segmentation reduces blast radius for edge devices and clinical systems

Segmentation works by separating devices and workloads into zones so a compromise in one place does not automatically become movement everywhere else. That is especially important in hospitals, where edge devices often include infusion pumps, tablets, workstations, and vendor-managed systems with uneven patching and limited visibility. When devices cannot freely talk to each other, hardcoded credentials and vendor access are less likely to produce network-wide exposure. The article shows this as a practical resilience control, not just an infrastructure preference: segmentation is what makes unknown devices manageable at scale.

Practical implication: segment by clinical function and trust level, then verify that high-risk devices cannot traverse administrative or EHR paths.

What privilege governance changes when vendors and devices are part of the trust chain

Privilege governance in healthcare has to cover more than human administrators. Vendor support accounts, device credentials, and integrated services can all create standing access that outlives the need for it. When access is treated as a one-time enablement rather than a governed lifecycle, organisations accumulate hidden reach that no policy dashboard can fully explain. The article’s strongest identity lesson is that privilege is not only about who logged in. It is about whether the access path still exists, still makes sense, and still matches the current clinical and operational context.

Practical implication: review non-human access paths with the same ownership, expiry, and scope discipline used for privileged human accounts.

NHI Mgmt Group analysis

Zero trust in healthcare fails when identity is treated as an implementation detail. The article shows that the real control problem is not perimeter strength but whether access is continuously evaluated across users, vendors, and devices. When identity governance is weak, network controls end up compensating for decisions they were never meant to make. The practitioner conclusion is to treat identity as the primary trust boundary.

Segmentation is becoming the practical enforcement layer for healthcare trust decisions. In environments with medical IoT, shared workstations, and vendor-managed endpoints, segmentation converts policy intent into containment. That matters because many healthcare assets cannot be patched or replaced quickly, so blast-radius reduction becomes more valuable than theoretical prevention. The practitioner conclusion is to design segmentation around clinical reality, not idealised network diagrams.

Hidden non-human identities are a healthcare governance gap, not just an IT inventory issue. Hardcoded device credentials, vendor access, and unmanaged integrations create machine-to-machine trust paths that behave like NHI risks even when teams do not label them that way. This is where IAM, PAM, and NHI governance intersect with clinical operations. The practitioner conclusion is to inventory and govern every non-human access path as part of zero trust.

Tech rationalization matters because tool count does not equal control coverage. The article correctly separates security maturity from security spend. In healthcare, overlapping dashboards and fragmented ownership often obscure the actual access paths that matter. The practitioner conclusion is to map controls to outcomes, then retire duplication where it adds noise rather than containment.

Healthcare security programs should measure trust reduction, not just alert volume. The most useful signals are narrower access scope, fewer unknown devices, and shorter-lived trust relationships. Those indicators show whether governance is changing operational behaviour, which is what matters when breaches exploit over-permissioned access and flat connectivity. The practitioner conclusion is to track access containment as a core security metric.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
• Read next: Guide to SPIFFE and SPIRE

What this signals

Healthcare zero trust now depends on reducing hidden trust paths, not just authenticating more users. The article’s practical signal for programme owners is that every vendor connection, device credential, and integration account needs a scoped trust decision. That shifts zero trust from an architecture slogan into an operating model for clinical environments, where non-human access is often the shortest path to lateral movement.

Edge-device governance is becoming a segmentation problem before it is a patching problem. Many hospital devices cannot be replaced or updated on normal enterprise schedules, so the immediate control question is where they can communicate, not only whether they are current. Programmes that can isolate high-risk devices will usually absorb risk faster than programmes that only chase visibility.

Identity and network controls now need to be measured together. A healthcare team can have strong authentication and still fail if internal connectivity remains too permissive. The more useful programme signal is whether access scope is shrinking across vendors, devices, and clinical workflows, because that is where breach containment is actually decided.

For practitioners

• Map non-human access paths Inventory vendor logins, device credentials, service accounts, and integration accounts that can reach clinical systems or shared infrastructure.
• Segment by clinical trust zone Separate medical devices, administrative systems, and clinical applications so a compromise in one zone cannot freely traverse the rest of the environment.
• Harden edge devices before expansion Apply baselines, remove unnecessary services, and eliminate hardcoded credentials on endpoints that cannot be patched quickly.
• Govern privilege as a lifecycle Require ownership, scope review, and expiry for every standing non-human account, including vendor-supported and embedded credentials.
• Measure unknown device reduction Use the number of unknown edge devices and segmentation coverage as programme metrics, not just ticket counts or alert totals.

Key takeaways

• Healthcare breaches in this article are framed as trust failures, not failures of perimeter strength or tool volume.
• Cooper University Health Care’s reported 75% reduction in unknown edge devices and 45% increase in segmentation coverage illustrate the value of operational containment.
• For practitioners, the message is to govern non-human access, segment clinical environments, and measure whether trust boundaries are actually shrinking.

Key terms

• Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.
• Network Segmentation: Network segmentation divides traffic and resources into controlled zones so access can be restricted between groups, systems, or applications. In remote access design, segmentation limits what a connected user or workload can reach after authentication, which reduces lateral movement and shrinks blast radius.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Dynamic Privileged Access Governance: Dynamic privileged access governance is the practice of applying access controls that adapt to changing cloud conditions, user context, and task requirements. It replaces static, long-lived entitlements with policies that can issue, monitor, and revoke privilege in a way that better matches the pace of cloud operations.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the operational realities of healthcare, cloud, and hybrid environments.