Why MFA gaps still break healthcare identity security

At a glance

What this is: This article argues that healthcare identity security still breaks when MFA is absent or inconsistently applied across workforce and patient access paths.

Why it matters: For IAM teams, the issue is not whether MFA exists, but whether it is enforced across every login path that can reach patient data, clinical systems, and administrative workflows.

Context

Healthcare identity security fails when a single unprotected access path can still reach critical systems. In this article, the gap is not a lack of authentication technology, but uneven MFA enforcement across workforce and consumer access paths that support electronic health records and other sensitive services.

That matters because healthcare organisations operate with high-value personal data, mission-critical workflows, and a broad mix of user types. When one login path is left outside MFA coverage, the identity programme creates a weak link that ransomware actors and credential thieves can use to turn access into operational disruption.

Key questions

Q: What breaks when healthcare access controls are not tied to segmentation and MFA?

A: A single credential compromise can become broad lateral movement, especially where remote access, legacy systems, and flat networks still exist. Without MFA, attackers get in more easily. Without segmentation, they move farther than they should. Without fast access termination, stolen or stale sessions stay useful long after compromise is detected.

Q: Why does missing MFA create so much risk in healthcare environments?

A: Because healthcare systems concentrate sensitive personal data and critical workflows behind many different access paths. When one of those paths is left single-factor, attackers need only one credential to move toward patient data, administrative functions, or operational disruption. The risk grows with digitisation because the number of exposed entry points increases as portals, remote access, and integrated applications expand.

Q: What are the signs that MFA deployment is failing in a healthcare programme?

A: Look for inconsistent enforcement across workforce and consumer access, legacy portals that still accept passwords alone, and exceptions that are justified as temporary but never removed. Another warning sign is when security teams can describe MFA coverage in general terms but cannot prove it for every application, user type, and access route that reaches PHI.

Q: How should healthcare teams compare MFA coverage across workforce and patient access?

A: Workforce and patient access should be governed by the same risk-based standard, even if the user experience differs. Clinicians, staff, contractors, and patients all connect to the same data estate, so authentication policy should be evaluated by the sensitivity of the target system and the trust required to reach it, not by whether the user is internal or external.

Technical breakdown

Why missing MFA creates an exposed access path

Multi-factor authentication reduces the chance that a stolen password alone can open a protected system. In healthcare, that matters because access often spans staff portals, administrative systems, patient-facing apps, and third-party workflows. If even one of those paths remains single-factor, the organisation has a credential acceptance point that does not match the sensitivity of the data behind it. The problem is not only authentication strength, but coverage. Partial deployment leaves an uneven trust boundary, which attackers seek out because it is easier to exploit than fully enforced authentication.

Practical implication: map every login path that can reach PHI, EHRs, or operational systems and eliminate any single-factor exception.

MFA, 2FA, and healthcare access policy

The article distinguishes MFA from 2FA, which is important operationally. Two-factor authentication is one form of MFA, but MFA can use more than two verification factors and can be applied differently across user populations and access scenarios. For healthcare, the control question is not terminology, it is policy consistency. If employees, clinicians, contractors, and patients are governed by different access rules, the programme can look mature on paper while still leaving privileged or sensitive access outside the intended authentication standard.

Practical implication: standardise authentication policy language so security, IAM, and compliance teams enforce the same MFA baseline across all user populations.

Healthcare digitisation expands the attack surface

As healthcare becomes more digital, authentication controls must cover more systems and more identities. That includes electronic health records, portals, remote access, administrative consoles, and other applications that now sit on the path to patient data and service delivery. The scaling problem is governance, not just technology: every additional application, user type, and access route increases the number of places where MFA can be bypassed, weakened, or deferred. Strong authentication has to be embedded in the identity architecture, not bolted on after deployment.

Practical implication: build MFA requirements into onboarding, application integration, and access governance rather than treating them as a separate security project.

Threat narrative

Attacker objective: The attacker sought to turn one exposed access path into disruptive control over healthcare operations and access to sensitive data.

1. Entry occurred when attackers exploited a server at Change Healthcare that was missing MFA, giving them an access path that did not require a second verification factor.
2. Credential abuse followed because the unprotected login path let the attacker move from initial access into systems that supported healthcare operations.
3. Impact came through ransomware disruption, which paralysed services, exposed healthcare data, and drove major recovery cost and ransom payment.

Breaches seen in the wild

• Change Healthcare breach 2024: A stolen login on a Citrix portal without MFA led to ALPHV ransomware, a $22 million ransom and 192.7 million people affected.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MFA gaps in healthcare are really governance gaps. The problem is not that healthcare lacks authentication technology. It is that access policy is still being applied unevenly across user populations and access paths, which leaves critical systems exposed even when the organisation believes it has a strong control baseline. Practitioners should treat MFA coverage as a programme-wide governance obligation, not a portal-by-portal setting.

Healthcare identity security fails when authentication coverage is partial. A single unprotected server, remote access route, or patient-facing workflow creates the kind of weak point attackers need to convert credentials into disruption. This is why consistent enforcement matters more than individual control selection. Practitioners should verify that every path to PHI, EHRs, and administrative systems is subject to the same authentication standard.

Identity controls in healthcare must span workforce and consumer access together. The article’s key point is that clinicians, staff, contractors, and patients all contribute to the same identity attack surface, even if their journeys differ. That means identity architecture, not just login experience, determines whether MFA actually reduces risk. Practitioners should align authentication policy across all access types instead of treating each channel as a separate programme.

Change Healthcare is a reminder that one missed access path can dominate the risk picture. The article ties a missing MFA control to service disruption, data exposure, ransom payment, and large recovery cost. That shows why healthcare identity programmes need exception management with real accountability. Practitioners should assume that the highest-risk path is often the one outside the standard rollout, not the one inside it.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

MFA coverage should now be treated as an identity governance metric, not a point control. Healthcare organisations cannot rely on having MFA somewhere in the stack; they need proof that it covers every path to high-value systems. The practical test is whether any application, vendor route, or patient-facing workflow can still authenticate with only one factor.

Coverage gaps are most dangerous where operational urgency meets legacy access design. In healthcare, those are often the systems that were integrated first, modernised last, or exempted for user convenience. The lesson for programme owners is simple: if a login path is important enough to keep alive, it is important enough to bring under the same authentication policy as the rest of the estate.

For practitioners

• Audit every healthcare access path Inventory workforce, contractor, patient, and administrative logins that can reach PHI or clinical systems, then confirm where MFA is actually enforced.
• Remove single-factor exceptions Treat any login route that still accepts a password alone as a remediation item, especially for remote access, back-end services, and legacy portals.
• Standardise MFA policy by user type Define one authentication baseline for sensitive access and apply it consistently across clinicians, staff, vendors, and patients where risk warrants it.
• Tie MFA coverage to access reviews Use recertification and periodic review to confirm that every high-value application still sits behind the intended authentication requirement.

Key takeaways

• Healthcare identity security breaks when MFA is unevenly applied across the access paths that reach sensitive systems and data.
• The Change Healthcare incident shows how a single missing MFA control can lead to ransomware, service disruption, and major recovery cost.
• Practitioners should focus on complete MFA coverage, not partial deployment, and remove any login route that still accepts password-only access.

Key terms

• Multi-Factor Authentication: Multi-factor authentication requires two or more independent verification factors before access is granted. In practice, it reduces the chance that a stolen password alone will open a system, but it only works well when applied consistently across all high-risk access paths and identity types.
• Access Path: An access path is the route an identity uses to reach a resource, whether directly, through a role, via a group, or through inherited permissions. In NHI governance, access-path analysis matters because machine identities often gain broad access through indirect relationships that are easy to miss.
• Authentication Coverage Gap: An authentication coverage gap is the difference between the identity policy an organisation claims to enforce and the platforms or user groups that remain outside that policy. In mixed estates, these gaps often appear first in Linux, legacy systems, or privileged workflows that are harder to modernise.
• Single-Factor Exception: A single-factor exception is any approved or unreviewed login path that still allows access with only one credential. In a healthcare environment, these exceptions are high-risk because they create bypass routes to PHI, EHRs, and critical service workflows.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.