Notifications
Clear all
Topic starter
11/08/2026 3:16 pm
TL;DR: Traveling clinicians expose a common healthcare IAM failure: organisations often treat onboarding as staffing logistics, then scramble across HR, credentialing, IT, and application teams while access to EHR and clinical systems is still unresolved, according to Fischer Identity. Delayed, duplicate, or over-broad access directly affects patient care, compliance, and operational continuity.
NHIMG editorial — based on content published by Fischer Identity: Traveling Clinicians and Healthcare Identity Governance: Why Access Cannot Wait Until They Arrive
By the numbers:
- Around 90% of all US Healthcare facilities rely on locum providers to maintain coverage.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
Questions worth separating out
Q: How should healthcare organisations onboard travelling clinicians without delaying patient care?
A: Treat onboarding as a governed lifecycle, not a manual request.
Q: Why do temporary clinicians create identity governance risk in healthcare?
A: They often arrive through staffing agencies, return under new roles, and move across facilities, which increases duplicate identity creation and access ambiguity.
Q: What breaks when healthcare identity matching is weak?
A: Duplicate accounts, confused access ownership, failed deprovisioning, and inconsistent EHR permissions are the usual outcomes.
Practitioner guidance
- Define the clinical identity trigger before day one Require staffing, credentialing, or sponsor data to trigger identity creation before the clinician reports to the unit.
- Implement attribute-level identity matching Use multiple identifiers to determine whether a travelling clinician already exists in the enterprise record, especially when the person has worked previously under a different agency or role.
- Tie EHR access to assignment duration Create expiring entitlements for EHR and related clinical systems so access starts with the assignment and is revoked automatically when the assignment ends or changes.
What's in the full article
Fischer Identity's full blog post covers the operational detail this post intentionally leaves for the source:
- Role-by-role guidance for travelling clinicians, locum providers, and supplemental staff across healthcare workflows
- The business process questions used to define required source data, ownership, and access triggers
- How organisations should think about EHR-aware provisioning, access duration, and end-of-assignment revocation
- Practical examples of how identity matching and lifecycle orchestration reduce manual exception handling
👉 Read Fischer Identity's analysis of traveling clinician identity governance in healthcare →
Traveling clinicians and identity governance: why access cannot wait?
Explore further
11/08/2026 3:29 pm
Healthcare identity governance fails when access is treated as a staffing afterthought. The article correctly frames travelling clinicians as a lifecycle problem, not an IT queue problem. That distinction matters because clinical access is time-bound, sponsor-dependent, and operationally urgent. When organisations treat onboarding as a ticket, they create predictable delays and over-provisioning. The practitioner conclusion is simple: clinical staffing events must trigger identity governance, not merely request it.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: Who is accountable when a travelling clinician keeps access after the assignment ends?
A: The accountable owner should be the organisation that sponsored the access, working through IAM, credentialing, and application ownership. Revocation needs a clear business owner and workflow path, because temporary clinical access should never depend on informal follow-up or service desk memory.
👉 Read our full editorial: Healthcare identity governance must start before traveling clinicians arrive
