Italian healthcare access management expands to secure clinical work

At a glance

What this is: Imprivata’s Italy expansion reframes healthcare access management as a security and productivity issue, with a focus on faster clinical access, stronger compliance, and broader identity coverage.

Why it matters: IAM teams should read this as a signal that healthcare access design must balance clinician speed with governance for shared devices, privileged users, third parties, and AI agents.

By the numbers:

• Imprivata supports more than 4,000 organizations globally and helps more than 4 million clinicians and other users access the systems they need every day.
• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.

👉 Read Imprivata's analysis of healthcare access management in Italy

Context

Healthcare access in digital care environments is now an identity governance problem as much as an operational one. When clinicians are forced into slow logins, shared credentials, and fragmented systems, security controls get bypassed and care delivery suffers. In that setting, access management has to cover clinicians, privileged third parties, and machine identities without adding friction that drives unsafe workarounds.

Italy is a useful lens because the article ties healthcare transformation to NIS2, ACN guidance, and the pressures of interoperability and workforce strain. The underlying issue is not simply login convenience. It is whether identity controls can preserve security and compliance while supporting shared workstations, mobile devices, and clinical continuity.

The inclusion of AI agents in privileged access scope is also a sign of where healthcare identity models are heading. Once machine actors sit inside operational workflows, identity governance can no longer stop at human SSO or traditional third-party access reviews.

Key questions

Q: How should healthcare organisations reduce shared credential use without slowing clinicians down?

A: They should design access around the clinical workflow rather than the application boundary. Badge-tap login, SSO, and session continuity reduce pressure to share credentials. The goal is to make the secure path the fastest path, then measure whether workarounds decline on wards, in theatres, and across shared devices.

Q: Why do shared workstations create higher identity risk in hospitals?

A: Shared workstations increase risk because multiple staff members, devices, and shifts can collapse into the same session context. If authentication is weak or sessions are not tied tightly to the user and the task, accountability degrades and credential misuse becomes harder to detect.

Q: How should teams govern vendor and AI access to clinical systems?

A: They should require named ownership, task-scoped elevation, session logging, and revocation procedures that work when the task ends. In healthcare, vendor and machine access should be treated as temporary, auditable exceptions, not as permanent extensions of the production environment.

Q: Who is accountable when privileged access is used by third parties or AI agents in healthcare?

A: Accountability should sit with the business owner that approved the access, the technical owner that provisioned it, and the security team that monitors it. For AI agents, the organisation must also define who authorised the delegated action and who can revoke it quickly when behaviour changes.

How it works in practice

Healthcare SSO and shared workstation workflows

Shared workstation access in healthcare is a classic identity friction problem. Badge-tap access, single sign-on, and fast re-authentication reduce the temptation to share credentials or leave sessions open on clinical floors. The technical challenge is not authentication in isolation, but preserving session continuity across EHRs, local applications, and device handoffs while maintaining traceability. In practice, access orchestration must work at the point of care, not just at login. Practical implication: align clinical workflow design with session-aware controls so staff do not create shadow access paths.

Practical implication: align clinical workflow design with session-aware controls so staff do not create shadow access paths.

Privileged access management for third parties and AI agents

Healthcare environments increasingly depend on vendors, contractors, and automated actors that need temporary elevated access. Privileged access management in this context should separate standing administrative rights from task-scoped access, and it must record session activity for later review. The presence of AI agents is notable because it extends privileged access governance beyond humans without changing the need for accountability, approval, and revocation. The key architecture issue is whether privileged access remains attributable when the actor is not a clinician. Practical implication: treat third-party and machine elevation as governed exceptions, not permanent entitlements.

Practical implication: treat third-party and machine elevation as governed exceptions, not permanent entitlements.

Risk-based authentication and compliance under NIS2

Risk-based authentication is most useful when it responds to context, such as device state, location, role, and access sensitivity. In healthcare, that matters because the same user may need different access conditions across wards, devices, and patient systems. NIS2 raises the stakes by making resilience and security controls part of a broader operational obligation, not an IT-only preference. The architecture question is whether the identity stack can raise or lower friction dynamically without breaking clinical continuity. Practical implication: map high-risk access paths to step-up controls that are transparent to clinicians but auditable for compliance.

Practical implication: map high-risk access paths to step-up controls that are transparent to clinicians but auditable for compliance.

NHI Mgmt Group analysis

Healthcare access management is becoming an identity governance layer, not just a login layer. The article shows why clinical productivity and security can no longer be treated as separate objectives. Shared workstations, mobile devices, and fragmented systems force identity controls to operate inside real workflows, not outside them. That makes session design, traceability, and revocation part of frontline security operations, not back-office hygiene.

Third-party and AI access in healthcare exposes a governance boundary that many programmes still leave implicit. The inclusion of vendors and AI agents in privileged access security means the access model now spans human, machine, and delegated machine-assisted activity. That broadens the governance problem from user convenience to accountable elevation, because the organisation must know who or what is acting, on whose authority, and under what review path. Practitioners should treat this as a policy boundary failure, not a tool selection issue.

Shared credentials are a symptom of access models that still assume users can wait. Clinician burnout, slow logins, and overburdened IT teams are not secondary issues. They are the conditions under which security exceptions become normalised. When the access path is too slow, people route around it, and the resulting shadow process becomes the real control surface. The implication is that governance has to be designed for time-critical work, or it will be bypassed in practice.

Clinical identity programmes now need to bridge human IAM, NHI governance, and operational resilience. The article links access management with regulatory pressure, digital transformation, and mission-critical service delivery. That combination is where NHIMG sees the strongest signal: identity is no longer a single-domain control set. Healthcare teams need one governance model that can handle clinicians, shared devices, vendors, and machine identities without losing auditability or speed.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• A separate finding from the same research shows that lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations.
• For teams building out healthcare identity governance, NHI Lifecycle Management Guide helps frame provisioning, rotation, and offboarding as operational controls rather than one-time setup work.

What this signals

Clinical access programmes will increasingly be judged on whether they remove friction without creating unowned exceptions. In healthcare, the real test is not whether authentication is strong in isolation. It is whether clinicians can move between systems quickly enough that shared credentials, vendor shortcuts, and unmanaged sessions stop looking like acceptable trade-offs.

Access governance for healthcare now needs to include machine actors in the same review horizon as human staff. Once AI agents and third-party automation can touch privileged systems, the programme has to track ownership, approval, and revocation across every identity type. That is a governance expansion, not a feature add-on.

Zero-trust thinking will gain traction in healthcare only when it can survive the pace of care delivery. If continuous verification adds delay at the point of care, users will route around it. The programme signal to watch is whether session-aware controls and adaptive checks reduce workarounds without forcing support teams into constant password resets.

For practitioners

• Map clinical access paths by workflow, not by system. Inventory how clinicians move between EHRs, shared workstations, mobile devices, and remote applications, then identify where session breaks or login delays trigger unsafe workarounds. Prioritise the highest-friction paths first.
• Separate privileged access for vendors and AI agents from standing administrative rights. Require task-scoped elevation, session recording, and explicit offboarding for every third-party or machine identity that can touch sensitive healthcare systems. Treat these identities as governed exceptions with a clear owner.
• Use risk-based authentication for high-impact access paths. Apply step-up checks to actions involving patient data, privileged tools, and off-network access, but avoid forcing extra prompts into routine bedside workflows. The control should adapt to context and remain clinically usable.
• Review shared credential workarounds as a security finding. When staff share accounts or reuse sessions, treat it as evidence that the access model is misaligned with care delivery. Fix the workflow and the control together, rather than blaming users for bypassing slow login design.

Key takeaways

• Healthcare access management is now a security and workflow discipline, because login friction directly affects both care delivery and control bypass behaviour.
• The article expands identity governance beyond clinicians to third parties and AI agents, which raises the bar for attribution, revocation, and session oversight.
• Practitioners should redesign access around clinical workflows, or shared credentials and manual workarounds will continue to erode both security and productivity.

Key terms

• Shared workstation access: A shared workstation access model lets multiple clinicians use the same endpoint while preserving individual accountability. In healthcare, it must combine fast re-authentication, session separation, and auditability so staff do not fall back to shared credentials or leave exposed sessions behind.
• Risk-based authentication: Risk-based authentication adjusts verification strength based on context such as device state, location, role, and sensitivity of the request. In clinical environments, it should add control only when needed, so security improves without disrupting time-critical care delivery.
• Privileged access security: Privileged access security governs elevated access to sensitive systems, administrative tools, and high-risk workflows. For healthcare, it must cover internal admins, vendors, and machine actors, with session control, logging, and revocation that match the speed of operational work.
• Identity workflow friction: Identity workflow friction is the delay or complexity created by access controls when people are trying to do their jobs. In healthcare, excessive friction drives unsafe workarounds such as shared credentials, which means the control problem is as much operational as technical.

Deepen your knowledge

NHI governance, agentic AI identity, machine identity security, and identity lifecycle management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or programme maturity, it is worth exploring.

This post draws on content published by Imprivata: Imprivata expands into the Italian market for healthcare access management. Read the original.