Why do hospitals need identity governance for physical access?

Why This Matters for Security Teams

Hospital physical access is not just a facilities issue. Badge readers, locked wards, medication rooms, labs, and records storage are all identity decisions that determine who can move, when, and for what purpose. If identity, role, shift, and location are not governed together, access becomes inconsistent across departments and impossible to audit after the fact. That is the same control problem highlighted in NHIMG’s Ultimate Guide to NHIs, where weak lifecycle control and over-privilege are shown to persist in real environments.

The security issue is not simply theft of a badge. It is uncontrolled movement through a facility that never truly closes, with contractors, clinicians, visitors, and outsourced services all crossing the same trust boundaries. When access is granted by habit, shift pattern, or local exception, a single compromise can expose patients, equipment, controlled substances, and protected records. Current guidance suggests hospital identity governance should treat physical access with the same discipline as system access, using documented ownership, approval, and revocation. In practice, many security teams encounter unsafe badge entitlements only after a sensitive-area incident or audit finding, rather than through intentional review.

How It Works in Practice

Effective governance starts by binding each physical access entitlement to a verified identity, an approved purpose, and a defined time window. That means a badge is not the control by itself; the identity record behind the badge is. Access should be granted through role, location, and schedule rules, then reviewed against current employment status, clinical assignment, vendor status, and temporary need. This aligns with the least-privilege direction in the NIST Cybersecurity Framework 2.0 and the control discipline in NIST SP 800-53 Rev 5 Security and Privacy Controls.

Practically, hospitals usually need four linked capabilities:

• Joiner-mover-leaver workflows that create, adjust, and revoke badge rights when a person changes role or leaves.
• Time-bound access for contractors, students, and rotating clinical staff, with automatic expiry where possible.
• Exception handling for emergency access, with strong logging and retrospective review.
• Periodic recertification of high-risk areas such as pharmacies, NICUs, operating theatres, and records rooms.

Identity governance becomes stronger when it is connected to physical access management, HR source records, and visitor systems, so security and operations see the same authoritative identity state. The point is not to stop access, but to make every exception deliberate, traceable, and revocable. NHIMG’s 52 NHI Breaches Analysis shows how quickly weak credential governance turns into broader exposure, and the same pattern applies when badge rights are left stale. These controls tend to break down when facilities run multiple legacy badge platforms with no shared identity source because revocation and recertification become inconsistent.

Common Variations and Edge Cases

Tighter physical access governance often increases operational overhead, requiring hospitals to balance security with emergency readiness and clinical speed. Not every door should follow the same process, and current guidance suggests the model should be risk-based rather than uniform. Public lobbies, supply entrances, imaging suites, pharmacies, and isolation wards all justify different approval paths, logging depth, and review frequency.

Edge cases matter. Emergency responders may need rapid override access. Outsourced cleaners may need late-night movement with narrow scope. Clinical educators and temporary staff may need short-duration access that expires automatically. These situations are manageable, but only if exceptions are designed into the governance model instead of being handled informally at the door. The OWASP Non-Human Identity Top 10 is not a physical access standard, but its emphasis on lifecycle control and privilege minimisation is relevant because the same failure pattern appears whenever access is issued faster than it is reviewed.

Hospitals also need to separate urgent access from permanent entitlement. A temporary override for a code situation is acceptable when it is time-limited, logged, and reviewed. A standing override for convenience is not. That distinction is where many programmes fail, especially in multi-site environments where local managers control badge requests without central identity oversight. The practical rule is simple: if access cannot be explained, reviewed, and revoked, it is not governed well enough for a clinical environment.

Related resources from NHI Mgmt Group

• How should organisations govern identity when digital access and physical access are split across different systems?
• How should hospitals govern access when physical and digital systems are separate?
• Physical Identity And Access Management
• Why is it important to integrate identity and data governance?