Topic starter
24/06/2026 11:18 pm
TL;DR: A survey of more than 200 healthcare IT and security leaders found that 42% say passwords raise breach risk, 46% see risky password workarounds in daily operations, and only 7% have fully adopted passwordless access, according to Imprivata. The problem is not just credential theft but the way password-dependent workflows now undermine both security and clinical operations.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Why healthcare organizations need to stop trusting passwords”.
By the numbers:
- 46% reported risky password-related workarounds occurring in daily operations.
- 85% of healthcare IT and security leaders say passwordless authentication is very important or mission-critical.
- Only 7% have fully adopted passwordless access across their organizations.
Key questions
Q: Where do password-based access controls fail in healthcare environments?
A: They fail where speed, shared devices, and operational pressure force users into resets, overrides, or credential sharing.
Q: Why do help desk recovery workflows increase identity risk?
A: Help desk recovery workflows often rely on procedural checks that are easier to socially engineer than cryptographic factors are to steal.
Q: What are the signs that password controls are failing in day to day use?
A: Common warning signs include frequent password resets, repeated purchase abandonment, password reuse across services, and people sharing credentials with family, colleagues, or friends.
Practitioner guidance
- Map password fallback paths Inventory every reset, recovery, override, and support-assisted path that still depends on a password or one-time secret.
- Harden help desk verification Treat password reset and account recovery as high-risk authentication events.
- Reduce shared-secret dependence Move high-volume healthcare access toward passwordless and adaptive authentication patterns that preserve speed without relying on reusable credentials.
Bottom line: Password dependence in healthcare is creating both breach exposure and operational friction, which is why authentication has become a governance issue as much as a security issue.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:05 am
Password dependence is now an identity governance failure, not a user training gap. Healthcare organizations have already invested in awareness, MFA, and policy enforcement, yet the article shows that password-centred access still produces breach risk and operational friction. That means the weak point is no longer user knowledge alone. The governance problem is the continued reliance on shared secrets as the primary control for environments that need fast, shared, high-trust access.
A few things that frame the scale:
- 60% of healthcare organisations do not assess a vendor's security before signing a contract that grants access to protected health information, according to Ponemon Institute's 2023 Third-Party Risk in Healthcare report.
A question worth separating out:
Q: Should healthcare teams prioritise passwordless access or better reset processes?
A: Passwordless access should come first when reset volume is driven by the credential model itself. Better reset processes reduce friction, but they do not remove the underlying dependence on passwords. If the goal is to reduce both support load and recovery risk, passwordless changes the problem at its source.
👉 Read our full editorial: Passwordless authentication in healthcare is now an identity problem