NHS digital maturity shows the gap between capability and access

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Imprivata's blog post: NHS Digital Maturity Assessment and usability findings show that digital capability and real-world access experience do not always move together.

Why it matters: It matters because IAM, not infrastructure alone, determines whether clinicians can use digital systems securely, quickly, and consistently in day-to-day care.

Context

Digital maturity is not just about what systems exist. In this article, the gap is between deployed capability and how clinicians actually experience access, workflow, and security in practice. That makes identity and access management central to whether digital investment translates into usable care.

The NHS assessment matters because it creates a comparable view of capability and usability across organisations. The practical problem is familiar to identity teams: if access is slow, fragmented, or inconsistent, users create workarounds that reduce efficiency and increase operational risk.

Key questions

Q: How should NHS organisations reduce access friction without weakening security?

A: Start by mapping where clinicians encounter repeated authentication, inconsistent permissions, or workflow breaks, then redesign the identity journey so those steps are removed rather than compensated for later. The aim is not weaker control. It is consistent access that still enforces assurance while supporting care delivery.

Q: What does the gap between digital capability and user experience tell IAM teams?

A: It tells IAM teams that deployment success is not the same as operational success. If clinicians still experience friction, the identity model is failing at the point of use, which means governance, application integration, and workflow design need to be assessed together rather than separately.

Q: What are the signs that access governance is not supporting frontline work?

A: Frequent workarounds, duplicate logins, inconsistent access across settings, and complaints about usability all indicate that access governance is too fragmented. Those symptoms usually mean identity policies are being applied in a way that protects systems on paper but not the people using them.

Q: When should organisations prioritise access redesign over adding more digital capability?

A: When existing systems are already deployed but clinicians still struggle to use them efficiently. If the problem is access friction rather than missing functionality, more technology will not fix the underlying issue. Redesigning identity flows is the faster route to usable maturity.

Technical breakdown

Digital maturity versus digital experience

Digital maturity describes the infrastructure, interoperability, security, and data capabilities an organisation has deployed. Digital experience describes how those systems behave for the people using them. The article’s core point is that these are not interchangeable. A system can be technically advanced and still fail clinically if access is cumbersome, workflows are fragmented, or the security model forces repeated interruptions. In identity terms, the control layer is no longer only about authentication. It governs whether the digital environment is usable at scale.

Practical implication: measure both capability and user experience before treating digital investment as effective.

Why access friction becomes an operational risk

Access friction shows up as multiple logins, inconsistent permissions, and local workarounds. Those symptoms usually indicate that identity policies, application integration, and workflow design are not aligned. In healthcare, that misalignment has a direct operational effect because clinicians move across systems, devices, and care settings continuously. The article correctly frames access as the front door to every digital interaction. When that front door is slow or unreliable, users either lose time or bypass intended controls.

Practical implication: treat login friction and access inconsistency as service delivery issues, not just usability complaints.

Frictionless access as a security control

The article links usability and security rather than treating them as a trade-off. That is the right framing. Strong access control is only effective when it is consistent enough to support clinical work without encouraging unsafe shortcuts. In practice, this points to tighter identity lifecycle governance, better session continuity, and access patterns that follow the user across systems without weakening assurance. The governance challenge is to maintain security while removing avoidable steps from routine work.

Practical implication: design access pathways that reduce friction without pushing users toward workarounds or shadow processes.

NHI Mgmt Group analysis

Access is the real control plane of digital maturity: Infrastructure and interoperability matter, but they do not determine whether clinicians can actually use digital services safely and consistently. The article shows that usability is the missing half of maturity. If identity and access are not measured as part of transformation, the organisation will overstate progress and underdeliver value.

Friction creates governance debt: Multiple logins, inconsistent access, and local workarounds are not just user annoyances. They become evidence that governance has shifted from designed access to improvised access. That matters because every workaround is a signal that policy, workflow, and control design are out of alignment.

Visibility without action is only half the job: Publishing maturity data creates accountability, but accountability only changes outcomes when it drives operational follow-through. The useful insight is not that some trusts are more mature than others. It is that measurement now makes the access gap visible enough to manage.

Identity maturity must be judged by outcomes, not deployment: A programme that can deploy modern systems but cannot deliver seamless clinician mobility has not solved the identity problem. The gap between capability and experience should be treated as a governance failure, not a communications problem. Practitioners should judge maturity by whether access enables work at the point of care.

Named concept, access usability gap: This article crystallises a simple but under-measured problem: organisations can improve digital capability faster than they improve digital usability. That gap defines whether investment becomes clinical value or administrative friction. Practitioners should treat access usability as a first-class maturity measure alongside infrastructure and security.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Identity Security Maturity Model

What this signals

Access usability gap: NHS organisations should stop treating login friction as a minor user-experience issue and start measuring it as a maturity signal. When clinicians need multiple logins or workarounds, the identity layer is not supporting digital transformation in practice.

The policy lesson is straightforward: capability measurements without workflow evidence overstate readiness. Teams should watch for places where strong technical deployment still produces slow, fragmented, or inconsistent access, because that is where governance and delivery are out of alignment.

For practitioners

• Map access friction across the clinical journey Identify where multiple logins, repeated authentication, and inconsistent permissions interrupt frontline work across systems and settings.
• Measure usability alongside digital maturity Track digital experience and digital capability together so leadership can see where deployed systems are not translating into usable workflows.
• Standardise identity journeys across care settings Align authentication, session continuity, and entitlement handoff so clinicians do not need to relearn access each time they move between services.
• Treat workarounds as control signals Use local shortcuts and manual access exceptions as indicators that policy, workflow, or configuration is failing the people who rely on the systems.

Key takeaways

• The article shows that digital maturity and digital usability can diverge, leaving healthcare organisations with deployed systems that still frustrate frontline work.
• That gap matters because repeated logins, inconsistent access, and workarounds turn identity into a practical limiter on safe care delivery.
• For practitioners, the key move is to measure access experience alongside capability and treat friction as a governance signal, not a minor inconvenience.

Key terms

• Digital Maturity: Digital maturity is the extent to which an organisation has deployed integrated, secure, and data-capable systems. In practice, it is only meaningful when those systems can be used reliably in day-to-day work, because deployment without usability does not deliver operational change.
• Digital Experience: Digital experience is how people actually experience the systems an organisation has put in place. It covers speed, consistency, friction, and trust at the point of use, which makes it a practical measure of whether identity and access controls are helping or hindering the work.
• Access Friction: Access friction is the delay, inconsistency, or effort a person experiences when trying to reach a system or task. It becomes a governance issue when it is high enough to encourage shortcuts, exceptions, or support-heavy workarounds that weaken the intended control model.
• Identity And Access Management: Identity and Access Management is the discipline of controlling who or what can access systems, data, and services. It covers identity lifecycle, authentication, authorization, provisioning, deprovisioning, and policy enforcement across users, devices, applications, and non-human identities, so access is granted only to approved entities under defined conditions.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.