HIMSS 2026 showed zero trust and segmentation as healthcare’s real controls

At a glance

What this is: HIMSS 2026 cybersecurity sessions argued that healthcare security failures are driven by implicit trust, unmanaged edge devices, and weak segmentation rather than a shortage of tools.

Why it matters: For IAM, PAM, NHI, and security teams, the article reinforces that zero trust only works when identity, privilege, and device access are governed continuously across users, vendors, and clinical systems.

By the numbers:

• 75% and increased segmentation coverage by 45% by
• Most organisations are using only about 60% of any given tool's effectiveness, according to the session summary.

👉 Read Elisity's HIMSS 2026 analysis of zero trust, segmentation, and privilege in healthcare

Context

Healthcare cybersecurity is not failing because organisations lack controls. It is failing because trust is still granted too broadly to vendors, devices, integrations, and credentials that were never designed to carry standing access across a clinical environment. In that setting, zero trust architecture becomes an identity and segmentation problem as much as a network one.

HIMSS 2026 made that gap visible across multiple sessions focused on security maturity, device isolation, and privilege control. The conference discussion was especially relevant to IAM, PAM, NHI, and device governance teams because healthcare environments blend human users, service access, vendor connections, and medical devices in ways that break simple perimeter assumptions.

The starting position described in the article is typical for large healthcare organisations: high complexity, broad trust zones, and a slow move from policy intent to enforceable controls.

Key questions

Q: What fails in healthcare security when organisations rely on implicit trust?

A: Implicit trust fails when vendors, users, devices, or integrations are allowed broad access simply because they are already inside the environment or hold a credential. In healthcare, that creates hidden pathways into clinical and administrative systems. The fix is explicit authorisation, continuous verification, and tightly defined reachability so access decisions are based on current need, not historical assumption.

Q: Why do service accounts and vendor identities increase risk in clinical environments?

A: Service accounts and vendor identities increase risk because they often outlive the task they were created for and accumulate more access than human users would receive. In clinical environments, that makes them attractive paths for lateral movement and persistence. Teams should govern them with lifecycle ownership, least privilege, and revocation triggers tied to actual operational need.

Q: How can hospitals tell whether segmentation is actually reducing risk?

A: Hospitals can measure whether segmentation is working by checking whether a compromised device or user can still reach systems outside its intended zone. Good indicators include fewer unknown devices, fewer reachable paths between sensitive environments, and clearer ownership of zone exceptions. If every system can still talk to everything else, segmentation exists on paper only.

Q: Who should be accountable for zero trust decisions in healthcare?

A: Accountability should sit across security, clinical operations, IT, legal, and procurement because zero trust changes both access and operational workflow. Security owns policy design, clinical leaders approve operational exceptions, and legal should review vendor access terms before they become breach exposure. Zero trust fails when it is treated as a technical project instead of a shared governance model.

Technical breakdown

Implicit trust in healthcare networks

Implicit trust means access is granted because a user, vendor, device, or integration already sits inside the environment or holds a credential that has not been fully scrutinised. In healthcare, that model persists because clinical continuity often overrides security friction. The result is that vendor remote access, device connectivity, and API integrations become durable trust paths. Zero trust architecture changes the assumption from presumed legitimacy to continuous verification of identity, device posture, and authorisation before each access decision.

Practical implication: map every vendor, device, and integration path that currently relies on standing trust, then require explicit authorisation for each one.

Segmentation as blast-radius control

Segmentation limits what an attacker or compromised device can reach after initial access. In healthcare, this is critical because medical devices, clinical workstations, and administrative systems often share network adjacency that was never designed for modern threat conditions. Segmentation does not prevent compromise at the entry point, but it can stop lateral movement from turning one infected device into a hospital-wide incident. That makes segmentation a containment control, not just an architecture preference.

Practical implication: define isolation zones around clinical device classes and enforce reachability rules before a compromise becomes a cross-environment event.

Identity governance for users, vendors, and devices

Identity governance in healthcare has to cover more than employee accounts. It must include vendor credentials, service accounts, medical devices, and any machine identity used to support operations. When those identities are unmanaged or over-privileged, security teams lose visibility into who or what can reach patient systems. IAM, PAM, and NHI controls converge here: lifecycle control, least privilege, access review, and revocation all need to work across human and non-human identities alike.

Practical implication: extend access reviews and privilege controls to non-human identities and vendor pathways, not just workforce accounts.

Threat narrative

Attacker objective: The attacker objective is to turn a single trusted foothold into broad access across healthcare systems, clinical devices, and sensitive data.

1. Entry occurs through trusted vendor access, unmanaged edge devices, or over-broad internal connectivity that assumes legitimacy once something is inside the network. Escalation follows when that access is not constrained by identity, segmentation, or privilege boundaries, allowing movement into more sensitive clinical or administrative systems. Impact emerges when the attacker reaches patient data, operational systems, or device fleets that were never isolated well enough to limit blast radius.

NHI Mgmt Group analysis

Implicit trust is the core healthcare security failure, not tool scarcity. The article shows that organisations keep adding controls without changing the trust model that determines how access is granted. When vendors, devices, and integrations inherit broad access by default, the programme is still operating on implicit trust even if the stack looks mature. The identity problem is not just authentication, but governance of who and what is allowed to move through the environment. Practitioners should treat trust boundaries as the real control plane.

Segmentation is most effective when it is treated as identity-adjacent governance. In healthcare, lateral movement rarely fails because a firewall exists somewhere. It fails when the environment is partitioned so that identity, device class, and privilege all have to align before communication is allowed. That is why microsegmentation and IAM belong in the same governance conversation, especially where vendor access and medical devices intersect. Practitioners should align segmentation policy with access policy instead of managing them separately.

Machine and vendor identities deserve the same lifecycle discipline as workforce accounts. The article’s examples make clear that edge devices and vendor pathways become hidden attack paths when they are not reviewed, constrained, and retired on time. That is a classic NHI governance issue in a healthcare setting. Standing access, untracked device identities, and long-lived integrations all widen the attack surface. Practitioners should extend lifecycle, review, and revocation controls to every non-human identity that can reach production systems.

Tech rationalization is a security governance decision, not just a cost exercise. More tools do not reduce exposure when ownership gaps and handoffs are the real failure mode. The field should be moving toward fewer overlapping controls with clearer accountability, especially in environments where clinical uptime makes every control change politically difficult. Practitioners should measure whether each control closes a real trust gap before adding another product.

Healthcare zero trust succeeds when legal, clinical, and security teams share ownership. The article shows that trust decisions are not purely technical because access affects patient safety, vendor contracts, and operational continuity. That means the governance model has to include legal review, clinical escalation, and identity policy together. Practitioners should build cross-functional decision paths before they need them in a response scenario.

What this signals

Implicit trust will remain the dominant failure mode until healthcare programmes treat identity, device class, and network reachability as one control problem. The organisations that make progress will be the ones that stop asking how many tools they own and start asking which trust paths are still open. That shift matters because device sprawl, vendor access, and non-human identities all compound each other in clinical environments.

Machine identity governance is becoming a healthcare resilience issue, not just an IAM issue. As medical devices, service accounts, and integrations multiply, the risk is less about one compromised credential and more about uncontrolled reach across clinical operations. For programmes that have not yet extended review and revocation to NHIs, the gap is now visible enough to be operationally material.

Segmentation policy will increasingly be judged by containment outcomes, not design intent. Healthcare teams should expect stronger scrutiny of whether a compromised device can still move laterally into patient systems, administrative zones, or vendor-connected services. The practical benchmark is simple: if reachability has not changed, risk has not changed.

For practitioners

• Audit all implicit trust paths Inventory vendor connections, internal integrations, shared admin access, and device-to-system relationships that currently rely on assumed legitimacy. Convert each one into an explicit approval path with documented owner, scope, and expiry.
• Extend segmentation to clinical blast-radius control Group devices and systems by function, sensitivity, and operational dependency, then block unnecessary east-west communication between those zones. Use the segmentation policy to contain a compromised endpoint, infusion pump, or vendor session before it reaches administrative systems.
• Bring non-human identities into access governance Include service accounts, device credentials, and vendor accounts in lifecycle review, access review, and revocation processes. Tie each identity to a business owner and an expiry condition so it cannot persist after the operational need ends.
• Rationalise overlapping controls Compare tools against ownership gaps, coverage overlap, and real enforcement capability. Retire controls that add noise without closing a specific trust or containment gap, and redirect effort toward controls that actually change reachability or privilege.

Key takeaways

• HIMSS 2026 reinforced that healthcare security failures are usually trust failures, not a shortage of controls.
• Cooper University Health Care's results show that segmentation and device governance can materially reduce unknown assets and expand control coverage.
• The control that matters most is explicit governance over users, vendors, devices, and non-human identities before they are allowed to move inside the environment.

Key terms

• Implicit Trust: Implicit trust is access granted because something is already inside the environment or appears familiar, rather than because it has been explicitly evaluated. In healthcare, that often includes vendors, devices, integrations, and long-lived credentials that inherit reach without continuous review.
• Network Segmentation: Network segmentation divides an environment into isolated zones so systems can only communicate where policy explicitly allows it. In healthcare, it is a containment control that limits how far an attacker or compromised device can move after initial access.
• Non-Human Identity: A non-human identity is any credentialed entity used by software or infrastructure rather than a person. That includes service accounts, API keys, tokens, certificates, workloads, and device identities, all of which need lifecycle ownership, privilege limits, and revocation control.
• Tech Rationalization: Tech rationalization is the structured review of people, process, and technology to remove overlap, close real gaps, and improve how security controls work together. In practice, it turns tool sprawl into a governance exercise focused on measurable coverage and ownership.

What's in the full article

Elisity's full article covers the operational detail this post intentionally leaves for the source:

• The session-by-session HIMSS 2026 notes behind the tech rationalization, zero trust, segmentation, and privilege discussions.
• The Cooper University Health Care operating details behind the 75% reduction in unknown edge devices and the 45% segmentation increase.
• The legal trade-offs behind conducting a HIPAA risk analysis under attorney-client privilege, including what counsel should review first.
• The vendor booth context and conference observations that explain how healthcare buyers are prioritising trust, segmentation, and control rationalization.

👉 The full Elisity article includes the conference session details, Cooper University Health Care example, and legal privilege discussion.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management for practitioners responsible for controlling non-human access. It gives security teams a common foundation for extending identity governance beyond human accounts.