Topic starter
06/06/2026 2:15 am
TL;DR: Healthcare service desks often spend 10% to 50% of calls on password issues, and SSPR can reduce call volume by up to 70% while lowering reset costs that average $70 per ticket, according to Imprivata. The deeper point is that modernization fails when teams try to replace core clinical systems instead of extending existing identity controls.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Modernizing the service desk with self-service password reset and identity verification: Reap the rewards without ripping and replacing systems”.
By the numbers:
- Password-related issues can represent 10 to 50 percent of service desk calls in some healthcare deployments.
- SSPR can reduce service desk call volume by up to 70 percent in some deployments.
Key questions
Q: How should healthcare teams reduce password reset tickets without disrupting clinical workflows?
A: Start by moving the most repetitive recovery requests into a policy-driven self-service flow that uses the identity systems already in place.
Q: Why do manual password reset processes create security risk in healthcare?
A: Manual recovery creates uneven assurance because each technician may verify identity differently, and that inconsistency is easy to exploit through social engineering.
Q: What breaks when healthcare identity modernisation starts with system replacement?
A: Replacement projects often break around integration stability, user adoption, and clinical continuity.
Practitioner guidance
- Standardise self-service password reset Move repeat password tickets into a policy-driven self-service flow so clinicians can recover access without service desk intervention.
- Harden identity verification for recovery Use consistent proofing rules for every reset, including stronger checks for high-risk callers and account lockout events.
- Preserve existing EAM integrations Extend the current access platform rather than replacing core clinical systems, so recovery changes do not break legacy workflows.
Bottom line: Healthcare password recovery is a security control as much as a support process, because inconsistent verification creates an opening for social engineering.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 3:50 am
Identity recovery is the modernization bottleneck that most programmes underestimate: password reset is where security assurance, user experience, and operational cost collide. In healthcare, the control has to work during clinical pressure, not just in policy documents. The practical conclusion is that recovery design is a first-order identity architecture decision, not a back-office support issue.
A few things that frame the scale:
- According to Forrester Research, a single password reset can cost around $70.
A question worth separating out:
Q: Should passwordless programmes include self-service recovery and proofing?
A: Yes, because passwordless does not remove the need to recover access safely. If the fallback path is weak, attackers can target recovery instead of authentication. Strong programmes pair passwordless access with secure proofing, caller identification, and auditable self-service recovery so the fallback does not become the weakest control in the chain.
👉 Read our full editorial: Healthcare identity modernization through extension, not replacement