Topic starter
06/06/2026 2:11 am
TL;DR: Healthcare IAM gaps are turning access control into an enterprise risk, with more than 700 large U.S. breaches in 2025 exposing up to 62 million patient records and hacking or IT incidents driving over 80% of cases, according to Imprivata. In healthcare, identity controls now determine both breach exposure and whether clinical workflows keep moving.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Identity and access management in healthcare: What healthcare executives should know”.
By the numbers:
- In 2025, over 700 large healthcare data breaches were reported in the U.S.
- Those breaches exposed up to approximately 62 million patient records.
- Hacking and IT incidents caused more than 80% of healthcare breaches.
Key questions
Q: What breaks when healthcare IAM is too rigid for clinical workflows?
A: When IAM is too rigid, clinicians work around it by sharing credentials, reusing passwords, or delaying access until the control is bypassed.
Q: Why do weak access controls create both security and care-delivery risk?
A: Because healthcare systems depend on continuous access, a failure in identity governance can delay treatment, disrupt claims, or expose patient records in the same event path.
Q: What should organisations measure to know if healthcare IAM is working?
A: They should measure login friction, password reset volume, access anomalies, and the frequency of unsafe workarounds such as shared credentials.
Practitioner guidance
- Assess high-risk access paths first Map shared workstations, remote access, mobile entry points, and contractor permissions to identify where identity risk is most likely to affect care or expose PHI.
- Build a phased passwordless strategy Prioritise clinical workflows where password fatigue causes the most friction, then introduce stronger factors such as biometrics, smart cards, or proximity-based authentication.
- Expand adaptive access controls Use contextual signals such as device, location, and role to adjust authentication requirements without creating delays in urgent clinical workflows.
Bottom line: Healthcare IAM failures can become both breach events and care-delivery disruptions, which makes identity governance an operational control as much as a cyber control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 3:44 am
Healthcare IAM is now an operational resilience control, not a back-office login function. The article makes clear that access failures can delay care, disrupt claims, and increase breach exposure in the same incident path. That means identity decisions in healthcare affect continuity of service, not just audit outcomes. Practitioners should treat IAM as part of clinical and enterprise resilience planning.
A few things that frame the scale:
- Only 36% of health IT leaders say their organisation applies a privileged access strategy consistently across the enterprise, according to Ponemon Institute research.
A question worth separating out:
Q: What is the difference between passwordless and stronger identity governance?
A: Passwordless changes how users authenticate, but it does not by itself govern who should have access, when access should be removed, or how exceptions are managed. Strong identity governance covers entitlement lifecycle, policy enforcement, and continuous visibility. In practice, passwordless is one control inside a broader governance model.
👉 Read our full editorial: Healthcare IAM gaps are driving breach and care disruption risk