Topic starter
06/11/2026 6:40 pm
TL;DR: Healthcare acquisitions create immediate identity governance blind spots because the acquired environment brings unknown applications, separate identity sources, and manual offboarding paths that can leave access uncontrolled for a year or more, according to READI. The core problem is not integration effort but a governance model that assumes visibility arrives before risk does.
Editorial analysis by NHI Mgmt Group, based on content published by READI: “When a health system acquires another hospital, identity governance is the first casualty.”.
Key questions
Q: What should teams do first when an acquired hospital is added to an identity programme?
A: Start with an identity and access inventory of every application, directory, entitlement source, service account, API key, token and certificate brought in by the acquired hospital.
Q: Why do healthcare acquisitions create so much identity governance risk?
A: Healthcare acquisitions create governance risk because identity data is fragmented across directories, local admin tools and application silos, so no single system has a reliable view of who has access to what.
Q: How do manual offboarding processes fail after a merger or acquisition?
A: Manual offboarding fails because local managers and IT teams rarely have a complete list of accounts, entitlements, API keys, shared logins and certificates created in the acquired environment.
Practitioner guidance
- Map inherited applications before recertifying access Start with a discovery pass over the acquired hospital's clinical, departmental, and administrative systems so the governance team can see where accounts and entitlements exist.
- Normalise identity sources early in the integration Reconcile directories, HR records, naming conventions, and role definitions before attempting enterprise-wide access certification or provisioning changes.
- Prioritise offboarding for inherited systems Close leaver, contractor, and duplicate access first in systems that remain outside the parent governance platform, because those are the accounts most likely to persist unnoticed.
Bottom line: Healthcare acquisitions create a governance gap because the acquired estate often arrives with unknown applications and mismatched identity sources.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Healthcare M&A turns identity governance into a visibility problem first and a control problem second. The combined organisation inherits access it cannot fully inventory, which means entitlement decisions are made against partial evidence. That is not a maturity issue so much as a structural mismatch between deal speed and governance speed. Practitioners should treat acquisition coverage as a distinct operating mode, not as a normal extension of steady-state IGA.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What is the best way to govern serial acquisitions in identity management?
A: The best way is to standardise onboarding and offboarding, then rapidly normalise identity sources into a single governance model with clear ownership, role mapping and entitlement reconciliation. Serial acquisitions need repeatable connector patterns, automated account discovery, duplicate resolution and centralised certification so each new hospital can be brought under the same control framework without delaying revocation or access reviews. normalises identity sources quickly
👉 Read our full editorial: Healthcare acquisitions expose identity governance gaps for a year