What happens when healthcare organisations enforce MFA only for some privileged accounts and not others?

Why selective MFA weakens privileged access

Selective MFA creates a split trust model: one set of privileged accounts is protected, while another remains easier to compromise. Attackers do not need the strongest account, they need the least protected one that can still reach the same systems, so inconsistent enforcement turns policy exceptions into practical entry points. That matters most where administrators can access cloud consoles, SaaS admin planes, and internal tools from the same trust boundary.

Once a privileged account is exempted or left out of coverage, the control is no longer uniform enough to support a Zero Trust posture. The organisation may believe MFA exists, but the security outcome depends on which account, which app, and which login path is being used. That inconsistency is exactly what privileged-access hardening aims to remove, which is why Privileged Access Management Guide remains relevant for understanding how standing privilege and inconsistent authentication create exposure.

The practical effect is not just weaker login protection. Inconsistent MFA can also weaken monitoring and response, because high-risk administrative activity becomes harder to treat as a single governed control set. A consistent identity posture is easier to enforce, review, and detect, which is why the broader Workforce Identity Security Guide is useful when privileged access spans employee accounts, federated apps, and recovery paths.

How attackers use the weakest privileged account

When MFA coverage is uneven, attackers target the account that still permits privileged action with the fewest obstacles. That may be a legacy admin account, a dormant break-glass path, a SaaS administrator, or a cloud role that can be reached through a less protected login flow. From there, the attacker can escalate, move laterally, or reuse the trusted administrative session to access higher-value systems.

In healthcare, that attack path is especially damaging because privileged accounts often bridge clinical, operational, and vendor-managed environments. A single weak link can expose scheduling, billing, identity infrastructure, or remote administration tooling. Public breach writeups show this pattern repeatedly, including situations where MFA gaps on privileged or remote access let attackers bypass stronger controls elsewhere, such as Change Healthcare breach 2024 and CitrixBleed exploitation 2023.

Selective MFA also increases the value of account takeover techniques that do not need to defeat the strongest factor everywhere. If one privileged path is protected and another is not, an attacker will choose phishing, password reuse, token theft, or session replay against the weaker path. The same logic is illustrated by campaigns documented in Uber Breach and Twilio 0ktapus breach 2022, where attackers focused on the path of least resistance rather than the best-protected account.

What healthcare organisations should standardise first

The first priority is not adding MFA to one more account class, it is removing exceptions that allow privileged access to behave differently across systems. If administrators can reach production, patient-facing, or infrastructure control planes, the organisation should treat those paths as one policy domain and one audit domain. Consistency matters more than the specific MFA method when the current problem is selective enforcement.

What to verify: every account with administrative reach should be covered by the same authentication rule set, including SaaS admins, cloud admins, internal privileged users, and recovery or break-glass paths. If a path is exempt for operational reasons, that exception should be narrow, documented, time-bound, and monitored, not left as a permanent convenience setting. The MFA Guide is a useful reference when deciding which methods are strong enough and how attackers bypass weaker ones.

Decision rule: if a privileged account can change configurations, approve access, reset credentials, or reach sensitive data, it should not be protected by a weaker or optional control than the rest of the admin population. Where possible, pair that standard with Just-in-Time Access and Zero Standing Privilege Guide so that even authenticated privilege is temporary and reviewable.

Risk and Threat Considerations

Selective MFA creates a predictable attack gap, because attackers look for the account that still offers privileged reach with the fewest checks. In healthcare, that gap can expose administrative consoles, vendor access, and recovery workflows, then turn a single compromise into broad operational and data exposure.

Failure mechanism: one privileged path remains easier to authenticate than the others, so compromise of that weaker account bypasses the stronger MFA controls protecting adjacent systems and sessions.

Impact: account takeover becomes more likely, administrative actions become harder to trust, and a compromise can spread into cloud, SaaS, and internal systems that were assumed to be protected by the same policy.

Practitioner Guidance

What to prioritise: inventory every account with privileged reach, then sort them by whether they can alter production settings, reset access, or touch sensitive patient or operational data. The highest-risk problem is not a missing factor on a low-value account, it is an exception on an account that can meaningfully move the organisation.

What to verify: test the full login and recovery path, not just the primary sign-in screen. Recovery, help desk reset, break-glass, and vendor-admin flows are where selective MFA often survives longest, and those are the paths attackers target when the main route is better protected.

Practitioner takeaway: selective MFA is a control gap, not a control compromise, and the fix is to make privileged access uniformly hard to use rather than selectively easy to reach.

Related resources from NHI Mgmt Group

• What breaks when organisations do not enforce MFA and strong credential hygiene on exposed accounts?
• What happens when healthcare organisations grant privileged access without strong session monitoring and audit trails?
• What happens when organisations do not enforce secure configuration and MFA in CIS IG1?
• What happens when healthcare organisations try to recover from ransomware without reliable privileged credential history?