Topic starter
25/06/2026 2:42 pm
TL;DR: Healthcare organisations are tightening privileged access controls as third-party exposure remains widespread, with only 36% of health IT leaders saying privileged access strategy is consistently applied enterprise-wide and nearly 44% reporting a third-party breach or cyberattack in the past year, according to Imprivata and the Ponemon Institute. Privileged access governance is now a clinical continuity issue, not just an IT control.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “As Cyberattacks Rise, Hospitals Tighten Privileged Access Controls”.
By the numbers:
- Only 36% of health IT leaders say their organizations have a privileged access strategy that’s consistently applied enterprise-wide.
- Nearly 44% of healthcare organizations experienced a third-party data breach or cyberattack in the past year.
- Some healthcare organisations are seeing as much as an 88% improvement in IT efficiency and productivity.
Key questions
Q: What breaks when privileged access is not tightly controlled in hospitals?
A: When privileged access is not tightly controlled, attackers can alter systems, disable safeguards, or reach sensitive data faster than defenders can respond.
A: Remote privileged access creates greater risk because those accounts can change systems, data, and security settings at scale.
Q: How should security teams reduce the blast radius of privileged identities?
A: Security teams should define a small set of tightly governed admin identities, give them the minimum authority needed, and make elevation time bound.
Practitioner guidance
- Map every third-party privileged pathway Inventory vendor, contractor, and remote support access to clinical, claims, and infrastructure systems so you can see where privileged entry actually exists.
- Require session-level auditability for vendor access Record and review all third-party privileged sessions, including commands, targets, and approval context, so investigations can reconstruct what happened.
- Separate vendor elevation from internal admin access Use dedicated workflows and tighter scopes for external accounts so vendor activity cannot blend into standard administrative privileges.
Bottom line: Hospitals are tightening privileged access because third-party connections and inconsistent governance leave high-value systems exposed to disruption.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:49 pm
Third-party privileged access is now a continuity control, not just an administrative control. Healthcare systems cannot separate identity governance from clinical availability when vendor access can interrupt claims, treatment workflows, and support operations. The control question is no longer only who is allowed in, but whether elevated access can be contained, attributed, and revoked without breaking service. For practitioners, privileged access design now sits in the same risk conversation as patient safety.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should hospitals prioritise PAM or broader zero trust controls first?
A: Hospitals should treat them as complementary, but privileged access is usually the faster place to reduce risk because it directly targets the accounts most able to cause damage. Zero trust sets the access model, while PAM enforces the control points around elevation, approval, and auditability. The right sequence is to secure the highest-risk access paths first.
👉 Read our full editorial: Hospitals tighten privileged access controls as third-party risk rises