Notifications
Clear all
Topic starter
24/06/2026 11:10 pm
TL;DR: French healthcare’s shift toward digitised records, NIS2-driven controls, and AI adoption is exposing the limits of password-only access, while IAM can improve security, auditability, and clinician workflow, according to Imprivata. Password reuse, phishing, and manual sign-in friction now create both patient-risk and operational drag.
NHIMG editorial — based on content published by Imprivata: a French healthcare IAM and passwordless access analysis
By the numbers:
- In health environments, manually entering usernames and passwords several times can cost up to 45 minutes per day per clinical team.
Questions worth separating out
Q: How should healthcare organisations replace password-only access without slowing clinical work?
A: They should replace password-only access with centrally governed IAM that supports fast authentication, role-based authorisation, and session-aware controls.
Q: Why do passwords create disproportionate risk in healthcare environments?
A: Passwords create disproportionate risk because they are easy to reuse, share, forget, and steal, while healthcare systems often contain highly sensitive data and time-critical workflows.
Q: How do IAM controls improve both security and compliance in healthcare?
A: IAM improves both by centralising identity decisions, enforcing role and policy-based access, and generating audit trails that show who accessed what and when.
Practitioner guidance
- Eliminate shared password workflows in clinical areas Replace shared or manually repeated credentials with authenticated session models that keep clinicians moving without reusing secrets across stations or shifts.
- Map access to clinical role and context Define who can access which records, from which device, and in which care setting, then enforce those rules through central IAM policy rather than local exceptions.
- Build audit trails for every sensitive access path Capture who authenticated, what they reached, and whether the session matched policy so security and compliance teams can reconstruct access decisions after the fact.
What's in the full article
Imprivata's full article covers the operational detail this post intentionally leaves for the source:
- Workflow examples for reducing password prompts in clinical settings without weakening access control
- The specific role of MFA, biometrics, and contextual access in healthcare identity design
- How auditability and compliance expectations shape identity choices in regulated health environments
- The implementation trade-offs involved in moving clinicians off password-centric access
👉 Read Imprivata's analysis of IAM adoption in French healthcare →
Healthcare IAM in France: why password-only access is failing?
Explore further
25/06/2026 7:54 am
Passwords are the wrong trust primitive for modern healthcare identity. They were built for human memorisation, not for proving task-specific access in a regulated clinical environment. Once credentials can be shared, guessed, reused, or phished, the control no longer tells you who is really acting. The implication is that healthcare IAM must stop treating password strength as the centre of trust and start treating identity governance as the centre of control.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
A question worth separating out:
Q: What should organisations measure to know if healthcare IAM is working?
A: They should measure login friction, password reset volume, access anomalies, and the frequency of unsafe workarounds such as shared credentials. If clinicians are still bypassing the control to do their jobs, the IAM model is not aligned with the operational reality of care delivery.
👉 Read our full editorial: Identity access in French healthcare is moving beyond passwords
