Zero trust for healthcare needs identity-aware access, not VPN logic

At a glance

What this is: This is an analysis of why healthcare zero trust access must be identity-aware and clinically safe, with direct-routed ZTNA positioned as a better fit than broad network trust models.

Why it matters: It matters because healthcare IAM and access teams have to protect patient data without slowing clinicians, vendors, or connected devices that depend on reliable, low-friction access.

👉 Read Appgate's analysis of zero trust architecture for healthcare access

Context

Healthcare access architecture is not a generic enterprise control problem. In clinical environments, identity-based access has to support patient care, protect sensitive records, and keep time-critical systems available while still reducing exposure and lateral movement risk. That is why healthcare zero trust access has to be judged against operational reality, not against abstract network design.

Traditional VPN and network-centric models assume that authenticated users can be trusted inside a broad segment of the network. In healthcare, that assumption is too coarse for clinicians, contractors, vendors, and connected medical devices moving across hybrid environments, cloud-hosted EHR systems, and remote care workflows.

The article argues that Zero Trust Architecture only works in healthcare when it is tied to identity, device posture, context, and performance-aware routing. That starting point is typical of modern healthcare environments, where access policy is now part of the care delivery system rather than a back-office security layer.

Key questions

Q: How should healthcare teams implement zero trust without disrupting clinical workflows?

A: Start with the highest-risk access paths, usually remote access and third-party connectivity, then enforce resource-scoped policy based on identity, device posture, and context. Keep routing simple enough to preserve EHR, imaging, and telehealth performance. The test is whether clinicians can work normally while unauthorized users lose broad network reach.

Q: Why do VPN-style access models create risk in healthcare?

A: VPN-style models usually trust a user once they are inside the network, which gives them broad reach that is too coarse for healthcare. That increases lateral movement risk and makes it harder to distinguish clinicians, vendors, and devices. Healthcare access needs precise authorization, not blanket internal trust.

Q: How do organisations know if their healthcare zero trust programme is working?

A: Look for narrower resource exposure, lower unauthorized discovery of clinical systems, stable application performance, and auditable access logs that show who accessed what and under which conditions. If access is secure but clinical workflows slow down, the model is failing operationally even if it looks good on paper.

Q: Who is accountable for third-party access in healthcare zero trust?

A: The healthcare organisation remains accountable for scoping, reviewing, and revoking third-party access, even when a vendor operates the system. Third-party connectivity should follow the same lifecycle discipline as privileged access, because access that outlives the business need becomes a standing risk.

Technical breakdown

Why network-based trust breaks down in healthcare access

Healthcare environments combine distributed users, third-party providers, IoMT devices, and performance-sensitive clinical applications. VPNs and location-based controls were built for a different trust model. Once a user is authenticated, they often receive broad reach into network segments, which increases the blast radius if credentials are stolen or a session is misused. In clinical settings, that broad trust creates both security risk and operational friction. Zero Trust Architecture replaces that model by evaluating identity, device posture, and context at the point of access, not at the perimeter. That shifts enforcement from network membership to resource-specific authorization.

Practical implication: remove broad network reach from clinical access paths and replace it with resource-scoped policy enforcement.

Direct-routed ZTNA and clinical performance

ZTNA is often implemented through cloud routing, where traffic detours through external points of presence before reaching the target resource. In healthcare, that extra path can introduce latency that affects EHR responsiveness, imaging workflows, and telehealth sessions. A direct-routed architecture reduces unnecessary path length and avoids turning the access layer into a bottleneck. The design question is not only whether access is secure, but whether the secure path preserves the real-time behaviour clinicians depend on. In operational terms, direct routing is a resilience decision as much as an access decision.

Practical implication: test access routing against latency-sensitive clinical use cases before expanding it across production systems.

Why third-party access needs tighter scope and visibility

Healthcare organizations depend heavily on vendors, service partners, and device technicians, but those relationships often create long-lived remote access paths with weak oversight. The article frames that correctly: access must be tightly scoped, auditable, and continuously evaluated rather than left open-ended. In zero trust terms, the control objective is to prevent unnecessary exposure of clinical resources and reduce reconnaissance opportunity. For healthcare, that also means integrating access policy with identity platforms, endpoint telemetry, and SIEM workflows so the organisation can prove who accessed what, when, and under which conditions.

Practical implication: treat third-party connectivity as a privileged access problem, not a convenience channel.

Threat narrative

Attacker objective: The attacker aims to reach sensitive clinical systems and patient data through access paths that were broader than the care workflow required.

1. Entry occurs when a user, contractor, or device gains broad network-based access through a VPN or similar perimeter control that does not distinguish well between clinical roles and resources.
2. Escalation occurs when that authenticated session can reach multiple systems beyond the intended application, creating opportunity for lateral movement if credentials or device posture are compromised.
3. Impact occurs when sensitive patient data, clinical systems, or connected devices are exposed through overly broad access paths that increase both breach risk and operational disruption.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Healthcare zero trust fails when it inherits perimeter-era assumptions. The article is right to frame access as part of care delivery, but the deeper issue is that many healthcare programmes still assume network location can substitute for context. That assumption was designed for internal enterprise traffic, not for clinicians, vendors, telehealth, and connected devices spread across hybrid environments. The implication is that healthcare security teams have to redesign access decisions around identity and workflow, not just wrap old controls in new language.

Direct-routed access is a clinical resilience decision, not just an optimisation choice. In healthcare, latency is operational risk because access delays can affect imaging, EHR use, and telehealth continuity. Cloud-routed ZTNA may be acceptable in lower-sensitivity environments, but the healthcare use case makes path control part of service reliability. Practitioners should treat access routing as a patient-care dependency and validate it against the exact systems clinicians use.

Resource cloaking is the right answer to reconnaissance pressure in healthcare environments. When clinical resources are invisible to unauthorised users, the organisation reduces discovery opportunities before exploitation even begins. That aligns with NIST SP 800-207 thinking because the goal is not just to authenticate users but to constrain what can be found and reached. For healthcare, that means access architecture must reduce both attack surface and operational noise.

Third-party connectivity in healthcare is a lifecycle governance problem. Vendor relationships change, equipment gets replaced, and service access often survives the business need that created it. That pattern creates persistent exposure unless access is reviewed, scoped, and revoked with the same discipline as human joiner-mover-leaver processes. The practitioner takeaway is that third-party access should be governed as continuously mutable privilege, not as a one-time onboarding event.

Identity-aware access becomes the control plane for healthcare Zero Trust. The article correctly prioritises identity, device posture, and context over network location, because those are the variables that actually map to care delivery risk. The broader implication is that healthcare security programmes need a tighter coupling between IAM, endpoint signals, and policy enforcement if they want access decisions to remain accurate under real clinical pressure.

From our research:

• The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, according to The 2024 ESG Report: Managing Non-Human Identities.
• Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to the same report.
• For a broader breach pattern view, see 52 NHI Breaches Analysis, which maps repeated control failures to real incidents.

What this signals

Identity-aware routing will matter more than brand-labelled zero trust. Healthcare teams should expect access design to be judged on whether it preserves clinical performance while shrinking exposure. The control plane is shifting toward policy, context, and routing fidelity, not broad network trust. That is where IAM, PAM, and endpoint telemetry converge.

Third-party access will keep exposing the difference between policy and governance. Organisations may have a zero trust label while still operating vendor connections that are too broad, too persistent, and too hard to audit. Healthcare security leaders should expect external access reviews, offboarding discipline, and system-specific scoping to become board-level questions.

With more than 1 in 5 NHIs judged insufficiently secured, the lesson for healthcare is not abstract. Every vendor account, device credential, and service connection that supports clinical care needs lifecycle control and visibility, or it becomes part of the same exposure problem.

For practitioners

• Redesign clinical access around resource scope Replace broad network reach with application-level and resource-level policies for EHR, imaging, telehealth, and device administration paths.
• Validate routing against clinical latency tolerances Test direct-routed and cloud-routed paths for response time, session stability, and failover behaviour in the exact workflows clinicians use.
• Tighten third-party access lifecycle controls Apply explicit onboarding, review, and offboarding steps for vendors and service partners so remote access does not outlive the business need.
• Integrate access policy with identity and telemetry Feed identity provider, endpoint, and SIEM signals into access decisions so context changes can trigger enforcement changes in near real time.

Key takeaways

• Healthcare zero trust succeeds only when access is tied to identity, context, and clinical workflow rather than network location.
• Performance matters as much as policy in clinical environments because delayed access can become an operational and patient-care problem.
• Third-party and vendor connectivity should be governed as privileged, lifecycle-managed access, not as a permanent exception.

Key terms

• Zero Trust Architecture: A security model that does not trust network location by default and instead evaluates identity, device posture, and context before granting access. In healthcare, the practical test is whether the control can protect clinical systems without disrupting patient care or time-sensitive workflows.
• Direct-Routed ZTNA: A zero trust access pattern where users and devices connect directly to authorized resources rather than detouring through a cloud relay. In healthcare, it matters because latency and routing stability can affect EHR, imaging, and telehealth performance.
• Resource Cloaking: A control that hides protected systems from unauthorized users so they cannot easily discover or target them. For healthcare, this reduces reconnaissance against clinical applications and limits exposure before authentication even succeeds.
• Third-Party Access Lifecycle: The process for onboarding, scoping, reviewing, and revoking vendor or contractor access over time. In healthcare, it is a governance issue because remote support and equipment access often outlive the business need that created them.

What's in the full article

Appgate's full article covers the operational detail this post intentionally leaves for the source:

• Direct-routed ZTNA design considerations for latency-sensitive clinical systems.
• Implementation guidance for integrating access policy with IAM, SIEM, and EDR tooling.
• Policy examples for resource cloaking and third-party connectivity in healthcare.
• Practical deployment considerations for hybrid on-prem and cloud-hosted environments.

👉 Appgate's full article covers direct-routed ZTNA, clinical performance, and deployment considerations.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.