Notifications
Clear all
Topic starter
06/06/2026 1:50 am
TL;DR: Healthcare is shifting from AI that summarizes and assists to AI agents that can act across EHRs, scheduling, and administrative systems, and HSCC says autonomous and semi-autonomous agents need additional threat modeling, identity management, and constrained access. The governance model has to treat these actors as managed identities because clinical workflows can become patient-safety issues when access and behaviour are not tightly bounded.
NHIMG editorial — based on content published by Imprivata: agentic AI identity governance in healthcare
By the numbers:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
- Only 5.7% of organisations have full visibility into their service accounts.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when AI agents are given broad access to healthcare systems?
A: Broad access breaks the assumption that workflow actions remain reviewable and predictable.
Q: Why do AI agents complicate identity governance in hospitals?
A: AI agents complicate identity governance because they can act continuously, cross systems in one workflow, and touch clinical data without a human-paced approval loop.
Q: How do security teams know if an AI agent is operating outside its approved role?
A: Teams should compare actual workflow behaviour against the approved use case.
Practitioner guidance
- Inventory every approved agent identity Map each agent to an owner, a business purpose, the systems it can touch, and the exact workflow it is authorised to support.
- Separate suggest from execute permissions Design clinical workflows so agents can recommend, prepare, or queue actions without being able to finalise record changes, schedule changes, or order modifications unless a human approves the step.
- Set behavioural baselines for clinical workflows Define expected record access paths, action sequences, and system touchpoints for each agent, then review deviations as access events rather than only as application anomalies.
What's in the full article
Imprivata's full analysis covers the operational detail this post intentionally leaves for the source:
- How Imprivata Agentic Identity Management brokers secure connections for AI agents in healthcare environments.
- How access monitoring and privacy intelligence are used to spot deviations in clinical system behaviour.
- How healthcare teams can apply least privilege and revocation controls to agents that touch EHR workflows.
- How the vendor positions agent identity within existing healthcare infrastructure constraints.
👉 Read Imprivata's analysis of agentic AI identity risk in healthcare →
AI agents in healthcare: what IAM teams need to govern now?
Explore further
06/06/2026 3:11 am
Agentic AI in healthcare should be governed as a managed insider category, not as ordinary application logic. HSCC is right to call for threat modeling, identity management, credential control, and constrained EHR access because the actor is no longer passive software. Once an AI system can move through multiple clinical systems and complete a workflow, it behaves like a workforce member with delegated authority. Practitioners should reframe governance from application-centric approval to identity-centric control.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: Who is accountable when an AI agent causes a clinical access problem?
A: Accountability remains with the organization and the humans who approved, owned, and monitored the agent. The agent is a governed actor, not a responsible party. Healthcare teams should make ownership visible, keep audit trails clear, and define escalation paths before the agent is put into production. That is the only way to preserve clinical accountability.
👉 Read our full editorial: Agentic AI identity governance in healthcare needs a new control model
