Topic starter
16/01/2026 12:31 pm
TL;DR: Healthcare organisations are struggling to govern a mix of employees, contractors, vendors, devices, and AI agents, with SailPoint reporting that 73% link manual processes to overprovisioned access and 43% admit ePHI disclosure due to ungoverned access. The governing problem is no longer account volume alone, but identity sprawl outpacing manual access control.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “The identity crisis in healthcare cybersecurity”.
By the numbers:
- 73% of healthcare organisations link manual processes to overprovisioned access.
- 43% of healthcare leaders admit that ePHI has been disclosed due to ungoverned access.
Key questions
Q: What breaks when healthcare identity governance stays manual?
A: Manual governance breaks when access decisions outgrow the speed and consistency of human approval chains.
Q: Why does over-provisioned access become more dangerous in healthcare identity environments?
A: Over-provisioned access increases the blast radius of human error, misuse, and compromised accounts.
Q: What are the signs that user access governance is failing in a healthcare organisation?
A: Common warning signs include incomplete security training, missing documented procedures, unrestricted concurrent logins, weak monitoring, and no clear process for reporting or reviewing breaches.
Practitioner guidance
- Map all identity classes to a governed lifecycle Inventory employees, contractors, vendors, machine identities, and AI agents separately, then assign ownership for onboarding, change, and offboarding decisions across each class.
- Replace manual access approvals with policy-driven workflows Move recurring access grants and removals into rule-based workflows that can enforce least privilege at the point of assignment rather than after review delays.
- Prioritise ePHI entitlements for continuous review Focus recertification on patient-data access paths first, especially accounts with broad clinical system reach or unclear business ownership.
Bottom line: Manual identity administration is the core reason overprovisioning keeps appearing in healthcare environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 5:38 pm
Identity sprawl is now the primary healthcare governance problem. The article shows that access risk is no longer limited to employee accounts or one control point in the joiner-mover-leaver process. Healthcare programmes now have to govern a mixed estate of human, machine, and AI-connected identities, which means identity ownership and lifecycle discipline have become operational security controls, not back-office administration.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should healthcare teams govern AI use that touches patient data?
A: They should start with discovery, then enforce policy at the point of use, and finally require auditability for every consequential interaction. That means mapping all AI apps, prompts, model calls, and downstream actions that can touch PHI, then applying runtime controls and identity-linked logs so the organisation can prove who used what, when, and for which workflow.
👉 Read our full editorial: Healthcare identity crisis shows why overprovisioning persists