Notifications
Clear all
Topic starter
12/06/2026 9:40 pm
TL;DR: Italian healthcare providers are facing slower logins, shared workstation workarounds, and rising regulatory pressure as digital care expands, according to Imprivata. The access problem is no longer just user experience. It is a security, compliance, and productivity issue that demands stronger identity governance across clinicians, third parties, and AI agents.
NHIMG editorial — what this means for NHI practitioners
By the numbers:
- Imprivata supports more than 4,000 organizations globally and helps more than 4 million clinicians and other users access the systems they need every day.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should healthcare organisations reduce shared credential use without slowing clinicians down?
A: They should design access around the clinical workflow rather than the application boundary.
Q: Why do shared workstations create higher identity risk in hospitals?
A: Shared workstations increase risk because multiple staff members, devices, and shifts can collapse into the same session context.
Q: How should teams govern vendor and AI access to clinical systems?
A: They should require named ownership, task-scoped elevation, session logging, and revocation procedures that work when the task ends.
Practitioner guidance
- Map clinical access paths by workflow, not by system. Inventory how clinicians move between EHRs, shared workstations, mobile devices, and remote applications, then identify where session breaks or login delays trigger unsafe workarounds.
- Separate privileged access for vendors and AI agents from standing administrative rights. Require task-scoped elevation, session recording, and explicit offboarding for every third-party or machine identity that can touch sensitive healthcare systems.
- Use risk-based authentication for high-impact access paths. Apply step-up checks to actions involving patient data, privileged tools, and off-network access, but avoid forcing extra prompts into routine bedside workflows.
What's in the full announcement
Imprivata's full article covers the operational detail this post intentionally leaves for the source:
- How the platform handles badge-tap access, SSO, and session continuity across shared clinical devices.
- The specific combination of privileged access, mobile access, and risk-based authentication capabilities described for healthcare workflows.
- The Italy market context, including the PNRR-driven digital transformation backdrop and the NIS2 compliance angle.
- The vendor's own examples of how access friction affects clinician burnout, support load, and patient care timing.
👉 Read Imprivata's analysis of healthcare access management in Italy →
Healthcare access management in Italy: what changes for IAM teams?
Explore further
12/06/2026 11:55 pm
Healthcare access management is becoming an identity governance layer, not just a login layer. The article shows why clinical productivity and security can no longer be treated as separate objectives. Shared workstations, mobile devices, and fragmented systems force identity controls to operate inside real workflows, not outside them. That makes session design, traceability, and revocation part of frontline security operations, not back-office hygiene.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- A separate finding from the same research shows that lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations.
A question worth separating out:
Q: Who is accountable when privileged access is used by third parties or AI agents in healthcare?
A: Accountability should sit with the business owner that approved the access, the technical owner that provisioned it, and the security team that monitors it. For AI agents, the organisation must also define who authorised the delegated action and who can revoke it quickly when behaviour changes.
👉 Read our full editorial: Italian healthcare access management expands to secure clinical work
