PBM identity and authentication gaps are raising fraud risk

At a glance

What this is: This is an analysis of why pharmacy benefit managers need modern identity and authentication controls as portal sprawl, integrations, and regulatory pressure expand their attack surface.

Why it matters: It matters because IAM, IGA, and security teams supporting healthcare platforms must align authentication, authorization, and logging across members, partners, and admins without creating new account takeover or compliance gaps.

By the numbers:

• The three biggest PBMs now handle about 80% of all prescription claims in the United States.

👉 Read Descope's analysis of PBM authentication, access, and compliance challenges

Context

PBM identity and authentication is fundamentally about controlling access to prescription benefits, health data, and partner workflows across many different user types. The article’s core point is that older portal-by-portal login designs no longer match how PBMs operate, especially when member apps, specialty pharmacy services, and EHR-linked integrations all depend on consistent identity decisions.

That problem matters because PBMs are not a single-user application model. They have members, pharmacies, prescribers, employers, brokers, and administrators, each with different access patterns and risk profiles. When identity is fragmented across those groups, credential stuffing, account takeover, role confusion, and audit failure become programme issues, not isolated login problems.

Frequent mergers and acquisitions make the situation harder, because identity systems must be unified or federated under tight timelines while preserving compliance and operational continuity. That makes PBM authentication a lifecycle and governance challenge as much as a customer experience problem.

Key questions

Q: How should PBMs reduce account takeover risk without making member access harder?

A: Use passwordless options, risk-based MFA, and consistent recovery flows so legitimate users can authenticate without repeated friction. The goal is to narrow attack opportunity while keeping login and prescription refill journeys usable. PBMs should also monitor for credential stuffing patterns, because high-value member portals remain attractive targets for takeover attempts.

Q: Why do fragmented PBM portals create security and compliance problems?

A: Fragmented portals let authentication, logging, and role design drift apart, which makes it harder to enforce the same control standard across every user group. That inconsistency increases takeover risk, complicates audits, and creates support overhead. A unified identity layer reduces these gaps by aligning policy across member, partner, and administrator access.

Q: How can security teams govern shared or family access in healthcare portals?

A: They should replace informal password sharing with explicit delegated access tied to the actual relationship being represented. That means scoped permissions, visible account linkage, and reviewable authority for dependents or household members. Without that structure, privacy, accountability, and entitlement scope all become difficult to defend.

Q: Which compliance concerns should identity teams expect in PBM environments?

A: HIPAA, state PBM licensing, and FTC transparency obligations all increase the need for audit-ready authentication and authorization records. Teams should be able to show who accessed what, under which role, and through which workflow. Good logs are not optional evidence, because regulators increasingly expect identity controls to be traceable.

Technical breakdown

Portal sprawl and fragmented authentication logic

PBMs often grew portal by portal, which means member, employer, broker, and pharmacy experiences may each have their own authentication flow, session handling, and role model. That fragmentation makes consistent policy enforcement difficult because access decisions are no longer made in one place. It also increases the odds that one portal will lag behind others on MFA, logging, or recovery controls. In practice, the risk is not just poor user experience, but inconsistent security boundaries across systems that expose the same underlying prescription and payment data.

Practical implication: map every portal to a single policy baseline and identify where duplicated login logic creates ungoverned exceptions.

OAuth, token exchange, and FHIR-connected access paths

PBM integrations increasingly rely on OAuth flows, token exchanges, and API-level authorization for ePA, SMART on FHIR, and EHR-connected workflows. That shifts the control problem from one login screen to a chain of delegated access decisions across systems. If consent, token scope, and identity assertion handling are not aligned, the result is over-broad access or brittle integrations that teams cannot confidently audit. For healthcare identity, the technical issue is not only authentication strength, but whether the token lifecycle and downstream authorisation model are actually traceable.

Practical implication: trace token issuance, scope, and revocation across every healthcare integration path before expanding connected workflows.

Fine-grained authorization across mixed stakeholder roles

PBMs do not just need authentication, they need precise authorization for members, brokers, employers, pharmacies, and plan administrators. Fine-grained access control matters because the same platform may need to support family access, delegated admin, tenant-specific branding, and restricted visibility into specialty drug activity. Broad roles create unnecessary exposure, but overly rigid roles push users to shared credentials or workarounds. The technical objective is to keep authentication simple while making authorization specific enough to reflect the actual business relationship behind each request.

Practical implication: separate identity proofing from authorization design so role scope can be narrowed without adding login friction.

Threat narrative

Attacker objective: The attacker wants to hijack member or partner access to health data, drug benefits, and financially valuable prescription workflows.

1. Entry happens through credential stuffing or reused credentials against member portals that expose PHI, payment data, and specialty drug access.
2. Escalation follows when fragmented portals, shared accounts, or weak role boundaries let the attacker move from a consumer login to higher-value account actions.
3. Impact is account takeover, privacy exposure, fraud, and disruption to prescription access across member and partner workflows.

Breaches seen in the wild

• MITRE ATT&CK Enterprise Matrix — MITRE ATT&CK Enterprise — adversary tactics and techniques, threat detection, attack chain mapping, credential access, lateral movement, privilege escalation.
• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

PBM identity is a mixed human IAM and lifecycle problem, not a login problem. The article correctly treats members, pharmacies, prescribers, employers, and brokers as distinct access populations with different risk profiles. That means the control challenge is lifecycle governance across multiple user classes, not a single authentication pattern. The implication is that PBMs need to govern identity relationships, entitlement scope, and offboarding consistency as one programme.

Portal sprawl creates authentication drift. When each portal evolves independently, security policy starts to diverge across adjacent systems that should be governed together. That drift is where account recovery, MFA, logging, and delegated admin controls become uneven and hard to audit. The practitioner conclusion is that consolidated identity policy matters more than another isolated login feature.

Fine-grained authorization is the real control boundary in PBMs. Members, dependents, brokers, and plan administrators cannot all be governed with the same coarse role set without either overexposure or operational friction. Broad roles increase blast radius, while over-restriction drives workarounds and support burden. The implication is that the identity model must reflect actual business relationships, not just portal names.

Shared and family account patterns expose a governance gap that consumer IAM often ignores. PBMs often have legitimate multi-person household use cases, but shared credentials blur accountability and complicate privacy enforcement. That is a lifecycle and authorisation problem, not a password problem alone. The practitioner conclusion is that delegated access must be explicit, scoped, and reviewable if the programme is to stay compliant.

From our research:

• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing how slowly remediation can move once identity exposure is discovered.
• For a broader baseline on machine and service-account governance, see Top 10 NHI Issues.

What this signals

Identity federation is becoming the only viable operating model for complex healthcare platforms. PBMs cannot keep adding standalone login systems without multiplying audit burden and user confusion. As integration density rises, the programme question shifts from whether to unify identity to how much governance can be standardised across differently regulated portals.

Healthcare identity teams should expect authorization to matter more than authentication alone. Passwordless login and adaptive MFA reduce friction, but they do not solve role scope, delegated access, or downstream token governance. PBM programmes that stop at better login UX will still carry the same compliance and privacy exposure if entitlement models remain coarse.

Access review patterns built for employees do not map cleanly to PBM consumer and partner identity. Household access, broker delegation, and tenant admin roles need a different governance cadence than standard workforce recertification. The operational signal is clear: identity teams that cannot distinguish user classes will keep over-provisioning to avoid service disruption.

For practitioners

• Consolidate identity policy across every portal Create one baseline for MFA, recovery, session controls, logging, and role assignment across member, pharmacy, employer, and broker portals. Use portal inventory to identify duplicated authentication logic and remove exceptions that create inconsistent access boundaries.
• Trace delegated access through healthcare integrations Document OAuth flows, token scope, consent handling, and revocation paths for ePA, SMART on FHIR, and EHR-connected workflows. Treat every token exchange as a governed identity event, not just an integration detail.
• Separate family access from shared credentials Define explicit dependent and household access models so legitimate shared use does not rely on credential sharing. Make delegated access reviewable and tied to the relationship being represented.
• Review identity logs for compliance evidence Retain authentication and authorization logs in a form that can support HIPAA, state licensing, and FTC transparency obligations. Focus on traceability of account changes, recovery events, and sensitive-access decisions rather than raw log volume.

Key takeaways

• PBM authentication is now a governance issue because portal sprawl, mixed user populations, and regulated data all intersect in one access layer.
• The main technical risk is inconsistent identity control across portals and integrations, which increases takeover exposure and weakens auditability.
• Programmes that unify policy, scope delegated access, and preserve traceable logs will be better positioned to reduce fraud without slowing legitimate access.

Key terms

• Portal sprawl: Portal sprawl is the accumulation of separately built login experiences that all serve the same organisation but follow different identity rules. It usually creates inconsistent authentication strength, duplicated policy, and harder auditability because security controls are spread across multiple systems instead of managed once.
• Fine-Grained Authorization: Fine-grained authorization is access control that evaluates specific resources, actions, and context rather than granting broad application-level permission. For AI agents, this is the difference between merely connecting to a system and being limited to the exact data or action the task requires.
• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
• Identity Federation: Identity federation is the practice of trusting one identity system to authenticate a user or workload for another system. It reduces login friction, but it also creates a dependency on assertion trust, policy consistency, and strong control over downstream authorization.

What's in the full article

Descope's full article covers the implementation detail this post intentionally leaves for the source:

• Passwordless and adaptive MFA patterns tailored to member, pharmacy, and partner access journeys.
• Multi-tenant SSO and self-service onboarding details for employer and broker integrations.
• Delegated admin and fine-grained authorization workflow design for operational teams.
• SMART on FHIR and API authorization support for connected healthcare workflows.

👉 Descope's full post covers member access design, integration patterns, and the operational trade-offs behind unified identity.

Deepen your knowledge

NHI governance, identity lifecycle management, secrets management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity governance programme, it is worth exploring.