Topic starter
24/08/2026 2:01 pm
TL;DR: Healthcare cyber risk remained acute in 2025, with breaches affecting more than 139 million patients and a 2025 Ponemon-Proofpoint survey finding 93% of US healthcare organisations had at least one cyberattack in the prior year, while privileged access abuse remained a leading root cause of data loss, Securden reports. The governance problem is not only compliance pressure, but unmanaged privileged accounts, third-party access, and standing credentials across clinical and device environments.
Editorial analysis by NHI Mgmt Group, based on content published by Securden: “The Essential Guide to PAM for Healthcare: Protecting Critical Systems and Patient Data”.
By the numbers:
- In 2025, breaches compromised the protected health information of over 139 million patients.
- According to a 2025 Ponemon-Proofpoint survey, 93% of healthcare organisations in the United States experienced at least one cyberattack in the past 12 months.
Key questions
Q: What breaks when privileged access is not tightly separated in healthcare IAM?
A: When privileged access is not tightly separated, administrators and recovery operators can cross into clinical data pathways that were meant to be isolated.
Q: What happens when third-party access is not tightly governed in healthcare environments?
A: When third-party access is not tightly governed, a breach at the vendor can spread into the healthcare organization through trusted connections and privileged credentials.
Q: How can healthcare teams know whether privileged access is actually under control?
A: Look for a measurable reduction in standing administrative access, faster revocation of unused privileges, and monitoring that ties access to specific tasks or sessions.
Practitioner guidance
- Constrain privileged access to task windows Replace always-on administrator access for healthcare systems with time-limited access that expires after the maintenance or support task ends.
- Inventory vendor and contractor privilege List every third-party account that can touch EHR platforms, clinical databases, device management consoles, or support portals, then assign an owner and review cycle.
- Record privileged sessions that affect ePHI Capture session logs for administrative actions on patient-record systems and retain them for forensic review, audit evidence, and incident reconstruction.
Bottom line: Healthcare privileged access failures can expose patient records, devices, and vendor paths in the same incident surface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
24/08/2026 2:01 pm
Healthcare privileged access is now a patient-safety issue, not just an IT control issue. When shared clinical logins, vendor support paths, and device administration all sit inside the same access model, the blast radius extends beyond data theft into care disruption. That makes privileged access governance a core healthcare resilience function, not a peripheral compliance task. Practitioners should treat every privileged path as part of clinical risk management.
A few things that frame the scale:
- Only 36% of health IT leaders say their organisation applies a privileged access strategy consistently across the enterprise, according to Ponemon Institute research.
A question worth separating out:
Q: What should organisations do when privileged access affects both patient data and medical devices?
A: They should apply one governance model across both domains rather than managing them separately. That means assigning ownership, limiting elevation, monitoring use, and revoking access when the task ends. When device administration and patient-record access are governed together, it becomes much harder for a single account to create clinical and data risk at once.
👉 Read our full editorial: Healthcare privileged access failures expose ePHI and device risk