Topic starter
25/06/2026 3:11 pm
TL;DR: Healthcare’s shift to EHRs, shared mobile devices, and third-party access is widening the identity attack surface and making HIPAA compliance harder to sustain, according to Imprivata. The control gap is no longer just access convenience versus security, but whether identity governance can cover every user, device, and vendor without breaking clinical workflows.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Thoughts from Dr. Sean Kelly on HIPAA’s 29th Anniversary”.
Key questions
Q: What breaks when HIPAA-era access controls meet shared clinical devices?
A: The assumption that one authenticated user maps cleanly to one controlled session breaks down.
Q: Why do vendor and contractor accounts increase healthcare compliance risk?
A: Because external access often has a weaker lifecycle than internal access.
Q: How do teams know if identity security controls are actually working?
A: Identity security controls are working when teams can show a current view of high-risk entitlements, detect privilege drift quickly, and remove access before exposure spreads.
Practitioner guidance
- Strengthen shared-device session controls Require session separation, step-up checks, and rapid re-authentication on shared endpoints used for clinical access so one user’s session does not bleed into another’s.
- Treat vendor access as lifecycle-governed access Map third-party and contractor entitlements to business purpose, owner, and expiration so access is revoked when the relationship or task ends.
- Improve traceability for patient-data access Log who accessed patient data, from which device, and under which role so privacy monitoring can detect misuse and support HIPAA reporting.
Bottom line: Healthcare identity sprawl now spans staff, shared endpoints, and external vendors, so the original access model no longer describes the real risk surface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:33 pm
Healthcare identity governance now has to cover a far larger trust perimeter than HIPAA’s original access assumptions anticipated. The article shows how EHRs, shared mobile devices, and vendor connectivity have turned identity into a cross-domain control problem. That shift matters because the programme is no longer governing only employees. It is governing devices, contractors, and workflow speed at the same time, which means access policy, monitoring, and accountability must be designed for the whole clinical ecosystem.
A question worth separating out:
Q: What is the difference between access convenience and clinical identity governance?
A: Access convenience focuses on reducing friction for clinicians. Clinical identity governance is broader: it preserves speed while still enforcing device trust, third-party oversight, session traceability, and revocation discipline. In healthcare, the right balance is not fewer controls, but controls that fit workflow without losing accountability.
👉 Read our full editorial: HIPAA-era identity controls are lagging behind healthcare sprawl