Notifications
Clear all
Topic starter
24/06/2026 11:23 pm
TL;DR: The KHVVG ties reimbursement, quality evidence, and staffing qualifications more tightly together, which pushes hospital IAM from an IT support function into a compliance control for access, roles, and auditability, according to Imprivata. Identity governance now determines whether hospitals can prove who may do what across clinical, administrative, and third-party workflows.
NHIMG editorial — based on content published by Imprivata: KHVVG and identity management in the hospital context
By the numbers:
Questions worth separating out
Q: How should hospitals align IAM with quality and reimbursement controls under KHVVG?
A: Hospitals should connect access rights to validated roles, qualifications, and service scope so that every entitlement can be defended in an audit.
Q: Why do shared devices and external partners increase hospital identity risk?
A: Shared workstations and third-party access weaken the assumption that one account maps cleanly to one person, location, or task.
Q: What do hospitals get wrong about role-based access control in care settings?
A: They often make roles too broad, which leaves access either over-permissive or dependent on manual exceptions.
Practitioner guidance
- Map service access to validated qualification states Link clinical and administrative entitlements to current staff certifications, approvals, and duty assignments so access reflects who may perform each KHVVG-relevant service.
- Automate joiner, mover, and leaver controls for all hospital identities Extend lifecycle workflows to employees, contractors, and external partners, with explicit revocation when shifts, contracts, or service relationships end.
- Tighten privileged access for vendor and support accounts Route elevated access through PAM, require session logging, and separate emergency use from routine support so privileged exceptions stay visible and time-bound.
What's in the full article
Imprivata's full article covers the operational detail this post intentionally leaves for the source:
- How the new Leistungsgruppen and quality criteria change access and qualification evidence requirements in practice
- How hospitals can combine RBAC, user lifecycle automation, and audit logging for regulated clinical workflows
- How Level-1i delivery models affect external partner access, shared devices, and cross-sector identity governance
- How Imprivata frames SSO, MFA, and vendor privileged access in the hospital operating model
👉 Read Imprivata's analysis of KHVVG and hospital IAM requirements →
KHVVG, hospital IAM, and the governance gap teams must close?
Explore further
25/06/2026 8:13 am
KHVVG turns identity governance into a proof problem, not just an access problem. The law ties funding, quality, and service scope more closely together, so hospitals must prove that the right people held the right access when a service was delivered. That makes identity data, role accuracy, and certification evidence part of the compliance chain. The implication is that hospitals cannot treat IAM as an administrative layer separate from service eligibility.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Only 20% of organisations have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: Who is accountable when a hospital contractor keeps access after the work ends?
A: The hospital remains accountable for access governance even when the identity belongs to a supplier. Contracts should define ownership for provisioning, recertification, and removal, but the provider of care must still verify that third-party access is revoked when it is no longer justified.
👉 Read our full editorial: KHVVG makes identity governance a hospital compliance control
