Should hospitals prioritise PAM or broader zero trust controls first?

Why hospitals should start with privileged access control

Hospitals rarely have the luxury of doing every control at once, so sequencing matters. Privileged access is usually the fastest way to shrink immediate blast radius because a small number of admin, domain, remote support, database, and integration accounts can touch far more systems than ordinary user accounts. A PAM-first move targets the paths that can alter records, disable monitoring, move laterally, or trigger outage-level damage.

That does not make zero trust secondary in importance. Zero trust is the broader operating model, but in most hospital environments it takes longer to implement consistently across clinical, administrative, and third-party workflows. PAM gives a more direct control point for elevation, session oversight, vaulting, and emergency access while the wider zero trust program is being phased in.

For privileged access patterns, the practical question is not whether the organisation will adopt both, but which control will reduce the most risk in the shortest time. Hospitals usually get the strongest early return by focusing on the accounts that already hold the highest authority and the highest operational concentration of trust.

How PAM and zero trust fit together in a hospital environment

These controls solve different problems, and the hospital use case makes that distinction very clear. Zero trust sets the access model: verify explicitly, reduce implicit trust, segment access, and treat every request as a policy decision. PAM enforces what happens when a person or process needs elevated power, such as just-in-time elevation, credential checkout, session recording, and stronger approval paths.

That means PAM is not a substitute for zero trust, and zero trust is not a substitute for PAM. A hospital can have modern network segmentation and still be exposed if domain admins, remote support tools, or shared service accounts are standing privileges with weak auditability. It can also have a strong PAM platform and still carry broad trust assumptions in the rest of the environment.

The best sequencing is usually to stabilise the highest-risk privilege paths first, then use zero trust principles to reduce standing trust more broadly. NHIMG’s Privileged Access Management Guide and Just-in-Time Access and Zero Standing Privilege Guide both reflect that operational pairing: one controls privileged sessions and elevation, the other reduces standing access across the estate.

What usually matters most in hospitals

Hospitals should prioritise the access paths that combine high privilege with high operational dependence. That often includes domain administration, EHR administration, remote support, integration accounts, cloud admin roles, and service accounts that bridge clinical and back-office systems. These are the accounts most likely to produce a material incident if they are misused, stolen, or left active too broadly.

In practice, PAM is strongest when it is applied to the most consequential paths first: vault and rotate the credentials, force time-bound elevation, broker sessions where possible, and log what the privileged session actually did. Zero trust then strengthens the surrounding environment by reducing implicit trust between users, devices, applications, and segments.

For hospitals with mixed legacy and cloud estates, a useful pattern is to use PAM as the immediate control surface for privilege, then expand zero trust around identity-centric policy and segmentation. NHIMG’s Cloud PAM and CIEM Guide and Zero Trust Identity Guide show how those two layers reinforce each other when the environment mixes cloud admin roles, human users, and workloads.

Risk and Threat Considerations

Hospitals face unusually high consequence from privilege misuse because privileged accounts can reach patient systems, operational infrastructure, and externally exposed support tools. If an attacker gains a high-value account, the result is often not just data exposure, but service disruption, ransomware spread, or tampering with the systems that clinicians rely on in real time.

Failure mechanism: Standing privilege, weak session control, or shared administrative access lets an attacker or insider turn one credential compromise into broad control over systems, records, and remote management paths.

Impact: The organisation can lose containment, auditability, and recovery speed at the same time, which increases the chance of outage, lateral movement, and unsafe operational disruption.

Practitioner Guidance

What to prioritise: Start with the privileged paths that can affect the widest clinical and operational blast radius, not with a generic enterprise-wide rollout. If an account can administer domain services, remote support, EHR platforms, or infrastructure, it should be earlier in scope than low-impact user access.

Decision rule: If the access path is high privilege and frequently used, implement PAM controls first, then extend zero trust policy and segmentation around it. If the path is low privilege but widely distributed, the zero trust phase may deliver more value later.

What to verify: Confirm that privileged sessions are brokered or recorded where feasible, emergency access is controlled and tested, and any standing privilege that remains is explicitly justified and reviewed.

Practitioner takeaway: In hospitals, the fastest risk reduction usually comes from controlling who can act with authority today, then using zero trust to make that authority harder to abuse everywhere else.

Related resources from NHI Mgmt Group

• Should organisations prioritise agent lifecycle controls or broader zero trust controls first?
• What controls should teams prioritise first in a Zero Trust rollout?
• Should organisations prioritise external exposure or internal credential governance first?
• Should organisations prioritise Zero Trust or least privilege first for NHI risk?