Notifications
Clear all
Topic starter
02/08/2026 12:29 pm
TL;DR: A healthcare customer is using an enterprise browser to secure access to patient records, freeze inactive sessions, re-authenticate users, and clear tabs and browsing data before data leakage occurs, according to Island. The pattern matters because session control and managed access boundaries increasingly sit alongside IAM, PAM, and identity governance in regulated environments.
NHIMG editorial — based on content published by Island: What We learned Wednesdays and the HITRUST certification case
Questions worth separating out
Q: How should security teams govern browser-based access to sensitive applications?
A: Treat browser-based access as part of the privileged access surface when it reaches cloud consoles, admin portals, or operational systems.
Q: Why do browser-based workflows create identity governance risk in regulated environments?
A: Because the identity decision at login does not control everything that happens afterward.
Q: What breaks when session controls are missing from web access policy?
A: Without session controls, a user can remain authenticated while unattended, or resume work from a browser that still contains sensitive state.
Practitioner guidance
- Define browser session controls for protected workflows Set inactivity thresholds, session freeze rules, and forced re-authentication requirements for applications that expose regulated records or other sensitive data.
- Block residual data persistence after session end Disable or tightly constrain open-tab retention, browsing-data storage, copy-out, and download paths so that sensitive content cannot survive the session boundary.
- Map browser policy to identity governance evidence Document which session controls support access review, audit, and compliance evidence, especially where the browser acts as the managed endpoint for healthcare workflows.
What's in the full article
Island's full blog post covers the operational detail this post intentionally leaves for the source:
- How the enterprise browser is configured as the secure access point for healthcare workflows
- The specific inactivity and re-authentication behaviour used to freeze and resume sessions
- The controls that prevent patient data from leaving the browser after inactivity or session end
- The customer-facing implementation context behind the HITRUST-oriented access pattern
👉 Read Island's blog post on HITRUST-oriented browser controls for healthcare access →
HITRUST access control in browsers: what IAM teams should watch?
Explore further
02/08/2026 1:27 pm
Browser-mediated access is becoming a governance layer, not just a UX choice. When protected data is accessed through web applications, the control question shifts from whether a user can log in to what the session is allowed to do afterward. That makes browser policy relevant to IAM, PAM, and audit teams, especially in healthcare where the confidentiality boundary sits around the record itself. Practitioners should treat browser enforcement as part of access governance, not a separate convenience feature.
A question worth separating out:
Q: Should organisations treat the browser as part of the managed endpoint?
A: Yes, when the browser is the primary path to sensitive applications. That approach lets teams enforce session expiry, data-loss controls, and re-authentication close to where the work happens. It does not replace endpoint security, but it can materially reduce dependence on device trust alone.
👉 Read our full editorial: Healthcare browser controls tighten HITRUST access and session governance
