Topic starter
10/07/2026 9:19 pm
TL;DR: Healthcare zero trust fails when it inherits VPN-era assumptions, according to Appgate, because clinical access must balance identity, device posture, context, performance, and auditability across EHRs, imaging, telehealth, and third-party connections. Zero trust in this setting is less about branding and more about whether access decisions stay precise enough to support care without broad trust zones.
Editorial analysis by NHI Mgmt Group, based on content published by Appgate: “Zero Trust Architecture for Healthcare: Technical Requirements and Implementation Considerations”.
Key questions
Q: How can zero trust be applied in healthcare without disrupting care delivery?
A: Zero trust should be applied at the point of use, with policy that reflects clinical context rather than a generic deny-by-default posture.
Q: Why do VPN-style access models create risk in healthcare?
A: VPN-style models usually trust a user once they are inside the network, which gives them broad reach that is too coarse for healthcare.
Q: What are the signs that a healthcare zero trust programme is too broad?
A: Common warning signs are broad network reach after login, inconsistent treatment of third parties, and access paths that cannot be tied cleanly to a specific clinical system.
Practitioner guidance
- Replace broad VPN trust with scoped clinical access Map clinician, vendor, and device access to the specific EHR, imaging, telehealth, or device resource required, and remove network-wide entitlements wherever possible.
- Use identity and context as policy inputs Require role, device posture, and request context to influence every access decision so that a user approved in one circumstance is not automatically trusted in another.
- Constrain third-party connectivity to auditable paths Give external providers only the access needed for the task, log each session, and ensure offboarding removes the path as well as the account.
Bottom line: Healthcare zero trust breaks down when it inherits VPN-era trust assumptions instead of using identity and context as the basis for access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:42 pm
VPN-era trust assumptions are the wrong foundation for healthcare access. Healthcare networks now mix internal staff, remote clinicians, vendors, cloud applications, and connected devices, so a location-based trust model cannot represent the real risk boundary. The governance failure is assuming that authenticated network presence is enough to justify broad access. Practitioners should treat clinical access as a scoped entitlement problem, not a network membership problem.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams govern third-party access in digital healthcare environments?
A: They should treat third-party identities like a governed lifecycle, not a temporary exception. That means defining scope before access is granted, reviewing active entitlements regularly, and revoking access as soon as the vendor need ends. External accounts should be monitored with the same rigor as employee access, especially in shared clinical systems.
👉 Read our full editorial: Zero trust for healthcare needs identity-aware access, not VPN logic