Notifications
Clear all
Topic starter
25/06/2026 2:42 pm
TL;DR: Healthcare organisations are tightening privileged access controls as third-party exposure remains widespread, with only 36% of health IT leaders saying privileged access strategy is consistently applied enterprise-wide and nearly 44% reporting a third-party breach or cyberattack in the past year, according to Imprivata and the Ponemon Institute. Privileged access governance is now a clinical continuity issue, not just an IT control.
NHIMG editorial — based on content published by Imprivata: As Cyberattacks Rise, Hospitals Tighten Privileged Access Controls
By the numbers:
- Only 36% of health IT leaders say their organizations have a privileged access strategy that’s consistently applied enterprise-wide.
- Some healthcare organizations are seeing as much as an 88% improvement in IT efficiency and productivity.
- 44% of healthcare organizations experienced a third-party data, ty data breach or cyberattack in the past year.
Questions worth separating out
Q: What breaks when privileged access is not consistently governed in healthcare?
A: Access becomes hard to trace, hard to revoke, and easy to overextend across vendors and remote staff.
Q: Why do third-party privileged accounts create outsized risk in hospitals?
A: Third-party accounts often sit outside normal employee lifecycle controls, so they can persist after a support need ends or be used beyond the original task.
Q: How do security teams know whether privileged access controls are actually working?
A: Look for evidence of narrow access scopes, approved sessions, complete session logs, and rapid revocation when the task ends.
Practitioner guidance
- Inventory every privileged vendor path Create a complete register of external support accounts, emergency access channels, and delegated admin paths that can reach clinical or claims systems.
- Require session-level traceability for high-risk access Record privileged sessions, tie them to an approved ticket or change request, and retain logs long enough to support incident reconstruction and compliance review.
- Enforce least privilege on vendor support workflows Limit vendor access to the smallest set of systems, commands, and time windows needed for the task.
What's in the full article
Imprivata's full analysis covers the operational detail this post intentionally leaves for the source:
- A healthcare-focused breakdown of privileged access strategy gaps across health IT leaders and third-party access governance
- Examples of how PAM and VPAM are being used to support compliance, traceability, and IT efficiency in real hospital environments
- Practical guidance on least-privilege access, delegated workflows, and continuous third-party session auditing
- The article’s discussion of how zero trust maps to clinical continuity and vendor-risk reduction
👉 Read Imprivata's analysis of privileged access control gaps in healthcare →
Privileged access in healthcare: what identity teams need to fix?
Explore further
25/06/2026 3:49 pm
Privileged access in healthcare is an accountability problem before it is a tooling problem. The article shows that only 36% of health IT leaders have a privileged access strategy that is consistently applied enterprise-wide, which means most environments still rely on fragmented enforcement. In healthcare, that fragmentation is dangerous because vendor support, remote staff, and clinical urgency all expand the number of people who can reach high-value systems. Practitioners should treat consistency of enforcement as the real control objective.
A few things that frame the scale:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: Who is accountable when a vendor privileged session is abused?
A: The vendor may operate the session, but the healthcare organisation remains accountable for the access it grants and the controls it enforces. Governance should assign a named internal owner, a review process, and a revocation path so that delegated access never becomes unattended access.
👉 Read our full editorial: Hospitals tighten privileged access controls as third-party risk rises
