How should hospitals govern access when physical and digital systems are separate?

Why This Matters for Security Teams

When hospitals keep physical access badges, visitor systems, and clinical applications in separate silos, revocation becomes a coordination problem instead of an identity control. That creates a gap between employment status, clinical role, and actual access, which is especially dangerous where shared workstations, contractors, and temporary staff are common. Current guidance suggests treating the person as one identity, even if the badge system and application stack remain technically separate. That is the practical lesson behind the Ultimate Guide to NHIs and the NIST Cybersecurity Framework 2.0: access decisions must be governed centrally, not by whichever team happens to own the system. The risk is not just convenience or audit friction. In healthcare, delayed deprovisioning can leave a former employee with a badge that still opens doors, a visitor record that still prints, or an application account that still reaches patient data. NHIMG research shows that only 20% of organisations have formal processes for offboarding and revoking API keys, a signal that revocation discipline is often weak even before physical access is added to the picture. In practice, many security teams discover lingering access only after a role change, termination, or incident forces a manual review.

How It Works in Practice

Hospitals do not need one monolithic platform, but they do need one identity lifecycle and one decision record. The cleanest model is to make HR, badge management, visitor management, and digital identity all consume the same source of truth for status, role, and sponsorship. When employment state changes, the policy engine determines which entitlements should expire, which should be reduced, and which should continue under a new approval path. That aligns with the control logic described in Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs and the access governance expectations in OWASP Non-Human Identity Top 10. A workable operating model usually includes:

• Central approval logic for onboarding, transfer, suspension, and termination.
• Time-bound badge issuance for contractors, vendors, and rotating clinical support staff.
• Immediate deprovisioning triggers for identity events, not just periodic recertification.
• Unified audit evidence showing who approved access, when it changed, and why.
• Exception handling for emergency access, with clear expiry and retrospective review.

For technical enforcement, hospitals often keep separate systems but integrate them through identity governance, workflow automation, and API-based revocation. That makes it possible to remove a person from building access, application access, and visitor privileges in one transaction while preserving local operational control. The same pattern is consistent with NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where access review, auditability, and least privilege are required. These controls tend to break down in hospitals with legacy badge systems and no reliable HR integration because identity changes arrive late, incomplete, or in different formats across each platform.

Common Variations and Edge Cases

Tighter access governance often increases operational overhead, so hospitals must balance speed at the bedside against the risk of stale entitlements. That tradeoff is real in emergency departments, disaster response, and float pools, where staff may need immediate temporary access without waiting for full enrollment. Best practice is evolving, but the current guidance is to use narrowly scoped, short-lived exceptions with automatic expiry rather than broad standing access. There are also edge cases where physical and digital controls cannot be fully synchronised. Shared areas such as pharmacy, radiology, and labs may require different approval chains than patient portals or EHR access. Third-party biomedical vendors, travel nurses, and students may need sponsor-based access that ends automatically when the visit or rotation ends. In those cases, the control objective is not perfect uniformity but consistent governance: the same identity lifecycle, the same review standard, and the same revocation signal across systems. NHIMG’s research on the Ultimate Guide to NHIs — Regulatory and Audit Perspectives shows why this matters for compliance evidence as much as security. When one hospital ID event can create or remove access in several systems, audit teams can verify intent instead of reconstructing it from disconnected logs. That is why centralised decision logic is preferable even when the underlying platforms remain separate.

Related resources from NHI Mgmt Group

• How should organisations govern identity when digital access and physical access are split across different systems?
• How should hospitals govern access without disrupting patient care?
• How should organisations govern mobile credentials in physical access programmes?
• How should security teams govern non-human identities that have persistent access?