Topic starter
16/01/2026 5:29 pm
TL;DR: Healthcare attacks continue to exploit missing MFA, with Change Healthcare’s 2024 ransomware incident showing how a single unprotected access path can trigger service disruption, patient-data exposure, a $22 million ransom and more than $1.6 billion in expected recovery costs, according to Ping Identity. The real failure is inconsistent enforcement across workforce and consumer access paths, not authentication hardening alone.
Editorial analysis by NHI Mgmt Group, based on content published by Ping Identity: “The Imperative of Multi-Factor Authentication (MFA) in Healthcare”.
Key questions
Q: What breaks when healthcare access controls are not tied to segmentation and MFA?
A: A single credential compromise can become broad lateral movement, especially where remote access, legacy systems, and flat networks still exist.
Q: Why does missing MFA create so much risk in healthcare environments?
A: Because healthcare systems concentrate sensitive personal data and critical workflows behind many different access paths.
Q: What are the signs that MFA deployment is failing in a healthcare programme?
A: Look for inconsistent enforcement across workforce and consumer access, legacy portals that still accept passwords alone, and exceptions that are justified as temporary but never removed.
Practitioner guidance
- Audit every healthcare access path Inventory workforce, contractor, patient, and administrative logins that can reach PHI or clinical systems, then confirm where MFA is actually enforced.
- Remove single-factor exceptions Treat any login route that still accepts a password alone as a remediation item, especially for remote access, back-end services, and legacy portals.
- Standardise MFA policy by user type Define one authentication baseline for sensitive access and apply it consistently across clinicians, staff, vendors, and patients where risk warrants it.
Bottom line: Healthcare identity security breaks when MFA is unevenly applied across the access paths that reach sensitive systems and data.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/10/2026 6:47 pm
MFA gaps in healthcare are really governance gaps. The problem is not that healthcare lacks authentication technology. It is that access policy is still being applied unevenly across user populations and access paths, which leaves critical systems exposed even when the organisation believes it has a strong control baseline. Practitioners should treat MFA coverage as a programme-wide governance obligation, not a portal-by-portal setting.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: How should healthcare teams compare MFA coverage across workforce and patient access?
A: Workforce and patient access should be governed by the same risk-based standard, even if the user experience differs. Clinicians, staff, contractors, and patients all connect to the same data estate, so authentication policy should be evaluated by the sensitivity of the target system and the trust required to reach it, not by whether the user is internal or external.
👉 Read our full editorial: Why MFA gaps still break healthcare identity security