Topic starter
21/08/2026 4:58 pm
TL;DR: Healthcare breaches are driven more by human error than technical failure, and Living Security Human Risk Management Platform cites data showing a shift from roughly 33% to 4% phishing click rates with continuous training. The real issue is that annual compliance training does not fit clinical workflows, shared endpoints, or the speed of care, so risk reduction has to become behavioural and continuous.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “Healthcare Security Awareness Training: Moving Beyond Compliance”.
By the numbers:
- The average cost of a healthcare breach has reached $10.93 million, according to Living Security Human Risk Management Platform.
Key questions
Q: Why do compliance-only security awareness programmes fail in healthcare?
A: They fail because they measure completion, not behaviour change, in an environment where people work fast, share devices, and face constant interruptions.
Q: Why does shared-device access create special identity risks in healthcare?
A: Shared devices make traditional login and session handling harder because multiple users must move quickly between tasks and endpoints.
Q: How do security teams know if security awareness training is actually working?
A: Look for reductions in susceptibility over time, improved reporting behaviour, and fewer successful phish-to-access events.
Practitioner guidance
- Implement role-specific microlearning Replace annual generic awareness modules with short, role-specific lessons for clinicians, billing staff, and remote care teams.
- Tie training to shared-device behaviour Build scenarios around logging out, protecting open charts, and handling patient data on shared endpoints so the message matches ward reality.
- Use phishing simulations as coaching Run realistic but ethical simulations, then explain the lure and the mistake so staff learn how to recognise healthcare-themed attacks without blame.
Bottom line: Healthcare awareness programmes fail when they optimise for compliance evidence instead of reducing the mistakes that create real breach risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:14 pm
Compliance-led awareness is a weak control when the work itself is dynamic. Healthcare staff do not operate in a stable desktop environment where annual training can reliably shape behaviour. They work under time pressure, on shared devices, and across rapid handoffs, so the control has to live inside the workflow. For identity and access teams, that means security awareness is part of operational governance, not a side programme. The practitioner conclusion is simple: training must be continuous, role-specific, and tied to real task context.
A few things that frame the scale:
- 55% of healthcare data breaches now originate from a third-party vendor, according to Ponemon Institute’s 2023 Third-Party Risk in Healthcare report.
A question worth separating out:
Q: Should healthcare organisations prioritise behaviour-based training over annual compliance training?
A: Yes, if the goal is reducing real-world exposure rather than only passing audit checks. Annual compliance training can satisfy a requirement, but it does not address clinical stress, shared endpoints, or fast handoffs. Behaviour-based training is the better first investment when human error is the dominant breach vector.
👉 Read our full editorial: Healthcare security awareness training must move beyond compliance