Topic starter
06/06/2026 1:50 am
TL;DR: Healthcare AI is shifting from assistants to agents that can access EHRs, schedule patients, and trigger workflows, which makes identity, credential, and behavioral controls central to safety and privacy, according to Imprivata. Treating agents as managed identities is the governance change that determines whether automation stays bounded or becomes an insider problem.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Agentic AI in Healthcare needs an identity strategy”.
Key questions
Q: What breaks when AI agents are treated like standard human users?
A: You lose visibility into effective permissions, expected behaviour, and real blast radius.
Q: Why do AI agents with EHR access create patient-safety risk?
A: Because EHR access is not just data access.
Q: What are the signs that an AI agent is failing or drifting outside its intended mission?
A: Common warning signs include goal drift, repeated no-progress calls, unusual tool use, privilege escalation attempts, credential misuse, and unexpected agent-to-agent communication.
Practitioner guidance
- Inventory every AI agent touching clinical systems Map where each agent is running, what data and workflows it can touch, who owns it, and whether it can act in the EHR or adjacent systems.
- Assign a unique managed identity to each agent Eliminate shared accounts and unexplained vendor credentials so every agent can be tied to a purpose, an owner, and a revocation path.
- Constrain EHR permissions to task-scoped access Limit each agent to the smallest possible read and write set for its approved workflow, especially where orders, scheduling, or PHI are involved.
Bottom line: Healthcare agentic AI changes the control problem from model oversight to identity governance because agents can act across clinical and administrative systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 3:11 am
Agentic AI in healthcare creates an identity governance problem before it creates an automation problem. Once an agent can reach the EHR, schedule patients, or interact with administrative systems, it becomes part of the identity plane, not just the application layer. That means ownership, authorization, monitoring, and revocation matter more than the model label attached to the system. The practitioner takeaway is that healthcare IAM must expand to cover software actors with operational authority.
A few things that frame the scale:
- A May 2025 Gartner poll of 147 CIOs and IT leaders found that 24% had already deployed AI agents, 50% were experimenting and 17% planned to deploy by the end of 2026.
A question worth separating out:
Q: How should healthcare teams govern AI agents that access clinical systems?
A: Treat AI agents as managed identities with named ownership, scoped permissions, audit trails, and revocation. In healthcare, the governance bar should be higher than for ordinary automation because agents can touch regulated workflows, patient data, and legacy systems. Combine least privilege with human oversight for actions that could affect care delivery or privacy.
👉 Read our full editorial: Agentic AI identity governance in healthcare needs a new control model