Notifications
Clear all
Topic starter
10/07/2026 9:24 pm
TL;DR: Healthcare remains the most expensive sector for breaches at $9.77 million on average in 2024, according to IBM, while the Change Healthcare incident affected about 192.7 million people and showed how access weaknesses can become patient-safety and continuity problems. Access governance, not just perimeter defense, is now the decisive control plane for healthcare security.
NHIMG editorial — based on content published by Appgate: healthcare access control, breach cost trends, and ZTNA for healthcare environments
By the numbers:
- Nearly 48% of 2024 data breaches involved third-party connections, while industry analysis points to vendor access vulnerabilities as a major source of exposure.
Questions worth separating out
Q: What fails when healthcare organisations rely on broad network access for clinical systems?
A: Broad network access fails because a single successful login can expose many applications, devices, and data stores at once.
Q: Why do over-privileged accounts increase healthcare breach impact so much?
A: Over-privileged accounts increase impact because they turn one credential into access across several clinical and administrative systems.
Q: What do security teams get wrong about third-party access in healthcare?
A: Teams often treat vendor access as a procurement issue instead of a core identity problem.
Practitioner guidance
- Replace network trust with application-scoped access Limit clinicians, vendors, and support staff to the specific applications and workflows they need, rather than granting broad VPN-based reach across clinical networks.
- Review and shrink high-risk entitlements Identify accounts with access to multiple clinical systems, especially administrator, service, and vendor accounts.
- Bring machine and third-party identities into IAM governance Inventory certificates, tokens, service accounts, and remote support credentials that touch patient data or clinical operations.
What's in the full article
Appgate's full article covers the operational detail this post intentionally leaves for the source:
- How AppGate ZTNA applies application-specific access controls across healthcare workflows and remote support paths
- The access-architecture rationale for replacing broad VPN trust in clinical environments
- Operational examples of how centralised logging and policy-driven controls support audit visibility
- How healthcare teams can preserve performance for EHR, imaging, and telehealth systems while tightening access
👉 Read Appgate's analysis of healthcare access control risk and ZTNA →
Healthcare access control gaps are driving breach costs higher?
Explore further
10/07/2026 9:47 pm
Broad access models are the hidden breach multiplier in healthcare. The sector's security problem is not simply that attackers target hospitals. It is that once a credential works, the resulting reach is often much wider than the role truly requires. That makes identity governance a patient-safety issue as much as an IT control issue. Practitioners should treat access scope as the variable that determines how far an incident spreads.
A question worth separating out:
Q: Who is accountable when patient data is exposed through weak access control?
A: Accountability sits with the organisation that owns the access model, not just the external partner that used it. Security, IAM, and operational leaders all share responsibility for defining who can reach what, for how long, and under what conditions. In regulated healthcare, access reviews, audit logs, and offboarding records are part of that accountability.
👉 Read our full editorial: Healthcare breach costs keep rising as access control fails
