Notifications
Clear all
Topic starter
24/06/2026 11:36 pm
TL;DR: Fast, secure identity access across shared devices, frontline workflows, and privileged users can reduce friction in regulated environments, according to Imprivata. The governance question is not speed versus security, but whether access controls are embedded well enough to work across every user type, device class, and critical workflow.
NHIMG editorial — based on content published by Imprivata: simple and secure access for life- and mission-critical industries
Questions worth separating out
Q: How should IAM teams secure shared-device access in regulated environments?
A: IAM teams should treat shared-device access as a session governance problem, not just an authentication problem.
Q: Why do regulated workflows need embedded authentication?
A: Regulated workflows need embedded authentication because users cannot always stop to complete separate login steps without disrupting critical work.
Q: What do security teams get wrong about privileged access in healthcare and similar sectors?
A: They often treat privileged access as a single admin problem, when in practice it covers vendors, employees, and other high-risk users with different trust boundaries.
Practitioner guidance
- Map workflow-critical access paths Identify the workflows where staff cannot afford repeated logins, then document where authentication is embedded today and where users still leave the workflow to re-authenticate.
- Separate shared-device session controls Enforce clear session termination, re-authentication, and user-switching rules on workstations, mobile devices, OT endpoints, and healthcare connected devices.
- Segment privileged access by actor type Review vendor, employee, and outward-facing privileged workflows separately so approval, elevation, and review logic matches the risk of each class.
What's in the full article
Imprivata's full company overview covers the operational detail this post intentionally leaves for the source:
- How the access management and privileged access security offerings are positioned for healthcare, enterprise, and other regulated environments
- Which user categories the company says it supports, including employees, third parties, and privileged internal users
- The device and workflow contexts the vendor highlights, including shared workstations, mobile devices, OT, and healthcare connected devices
- The company background, awards, and organisational history that sit outside this editorial analysis
👉 Read Imprivata's overview of access management for regulated workflows →
Shared-device access and privileged controls: what IAM teams need?
Explore further
25/06/2026 8:34 am
Access management in regulated industries is really workflow governance. Imprivata’s framing is less about authentication as a standalone control and more about making identity checks part of the operating rhythm of care and production. That matters because friction in critical workflows often produces shadow access patterns, workarounds, or over-reliance on shared credentials. The practical conclusion is that IAM teams should judge access design by whether it supports safe work at speed, not by whether it looks tidy on paper.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: How do you know if shared-device access controls are actually working?
A: Look for clean session handoff, reliable logout behaviour, and evidence that the next user never inherits the previous session’s access state. If users can move between devices or accounts without strong re-authentication and audit trails, the control is not working as intended. In shared environments, residual session access is the failure signal.
👉 Read our full editorial: Identity access for regulated workflows needs stronger governance
