Topic starter
25/06/2026 2:50 pm
TL;DR: CISA 2015’s expiration leaves healthcare delivery organizations with less legal certainty around threat sharing and greater pressure to harden identity, access, and coordination controls across EHRs, shared workstations, and mobile workflows, according to Imprivata. The governance gap is no longer just information sharing, but whether identity programmes can support fast, compliant response under regulatory uncertainty.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “How Healthcare Organizations Can Build Cyber Resilience After CISA’s Expiration”.
Key questions
Q: How should healthcare teams strengthen IAM when threat sharing becomes slower?
A: They should move more of the response burden into internal access governance by tightening authentication, revocation, and monitoring across clinical systems.
Q: Why do shared clinical workstations create identity governance risk?
A: Shared clinical workstations make session integrity a governance issue because the device is reused by multiple people in fast-moving care settings.
Q: What are the signs that healthcare access control is failing in practice?
A: The clearest signs are privilege creep, incomplete audit logs, excessive access after role changes, and temporary users retaining permissions after their work ends.
Practitioner guidance
- Tighten access governance on clinical systems Review who can reach EHRs, shared workstations, and shared mobile applications, then remove broad or inherited access that is not operationally necessary.
- Adopt passwordless authentication where clinical workflows allow it Reduce dependence on reusable passwords and improve sign-in reliability for staff who move between shared endpoints and mobile devices.
- Centralize credential governance across care environments Use a single management approach for issuing, reviewing, and revoking credentials so that exceptions do not accumulate across departments and devices.
Bottom line: The expiration of CISA 2015 shifts more resilience responsibility onto internal identity and access controls in healthcare environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:01 pm
Identity resilience is now part of healthcare cyber resilience, not a separate hygiene task. Once legal certainty around information sharing weakens, the controls that matter most are the ones inside the care environment itself: authentication, authorization, and credential governance. That means identity programmes have to absorb more of the burden that external coordination once helped carry. The practitioner conclusion is straightforward: resilience has moved deeper into IAM.
A few things that frame the scale:
- 60% of healthcare organisations do not assess a vendor's security before signing a contract that grants access to protected health information, according to Ponemon Institute's 2023 Third-Party Risk in Healthcare report.
A question worth separating out:
Q: How do zero trust principles apply to healthcare identity governance?
A: They require explicit, context-aware access decisions for every sensitive request, rather than assuming trust because a user is inside the network or on a familiar device. In healthcare, that means combining strong identity assurance, least privilege, and continuous verification across clinical workflows.
👉 Read our full editorial: Healthcare cyber resilience after CISA expiration needs stronger identity controls