Healthcare Identity Security Guide

Healthcare combines some of the most valuable data an attacker can steal with some of the hardest identity problems to solve. Clinicians move between shared workstations dozens of times a shift and cannot wait for slow sign-in in an emergency. Connected medical devices run for years with vendor-managed credentials, and hospitals depend on long chains of suppliers and clearing houses. The 2024 Change Healthcare attack, which began with a remote access login without MFA, disrupted claims and prescriptions across the US and affected data on 192.7 million people. This guide maps the identity controls healthcare organisations need to the regulations that apply, and shows how to secure clinical access without slowing care. It is a practitioner summary, not legal advice.

Key takeaways

• Fast, strong clinical access is achievable with badge tap, SSO and proximity-based session switching on shared workstations.
• Remote access and third parties are the most attacked paths. Enforce phishing-resistant MFA on every one.
• Electronic prescribing of controlled substances (EPCS) has specific identity proofing and two-factor requirements in the US.
• Medical devices and clinical systems carry non-human identities that need inventory, ownership and credential management.
• Design emergency (break-glass) access so care is never blocked, and review every use.

Regulations and frameworks at a glance

See the Identity Security Regulatory Map for cross-sector frameworks.

Clinical access that is fast and secure

• Badge tap and SSO: clinicians tap a badge to unlock a shared workstation and single sign-on opens clinical applications, with a PIN or biometric as a second factor where risk requires it.
• Session switching: fast user switching so one clinician's session is never left open for the next.
• Context-aware policy: stronger checks for remote access, prescribing and administrative actions; lighter friction on trusted clinical workstations.
• Break-glass access: emergency access to records outside a clinician's normal scope, logged and reviewed after the event. See the Break-Glass Account Guide.
• Role-based access aligned to clinical roles, departments and care relationships, with regular reviews. See the Access Reviews Guide.

Remote access and third parties

• Enforce phishing-resistant MFA on every remote access portal and VPN. The Change Healthcare breach began with a Citrix login without MFA. See the Remote Access Identity Guide.
• Broker and time-limit vendor access to clinical systems and devices. See the Third-Party Access Guide.
• Govern business associates' access and their integrations with your systems.
• Harden help desk resets, which attackers have targeted in healthcare. See the Account Recovery and Help Desk Security Guide.

EPCS and clinician identity

• Prescribers must be identity proofed before they can sign controlled substance prescriptions electronically.
• Signing requires two-factor authentication; hardware tokens, biometrics and approved app-based methods are used.
• Access controls for who can prescribe must be set by two individuals, one of them a registrant.
• Reuse strong prescriber authenticators across clinical workflows where possible rather than running separate systems. See the MFA Guide.

Medical devices and clinical system NHIs

• Inventory connected devices and link each to an owner, location and vendor. See the Device and IoT Identity Guide.
• Change default credentials and remove shared vendor passwords where devices allow.
• Segment devices and restrict what each can talk to.
• Govern service accounts and interface engine credentials used by EHRs, lab systems and imaging. See the Service Account Security Guide.
• Protect API keys used for health data exchange and patient apps. See the API Key Management Guide.

Patient identity

• Patient portals need strong, accessible authentication and secure recovery. See the Customer IAM (CIAM) Guide.
• Proxy access for carers and parents is delegated access and needs verification and clear scope.
• Patient matching errors are a safety issue; accurate identity data matters clinically as well as for security. See the Identity Data Quality Guide.

AI in clinical workflows

AI scribes, triage assistants and agents that read records or place orders act with access to health data. Give them their own identities, scope their access to the patient and task, and keep a clinician approval step for orders and prescriptions. See the AI Agent Authorisation Guide and the Agentic AI Compliance Guide.

Practitioner checklist

• Enforce phishing-resistant MFA on all remote access, email and administrative access.
• Deploy badge tap and SSO with fast session switching on shared clinical workstations.
• Design and review emergency break-glass access to records.
• Meet EPCS identity proofing and two-factor signing requirements where applicable.
• Broker and time-limit vendor and business associate access.
• Inventory medical devices and clinical system NHIs, and remove default and shared credentials.
• Secure patient portal authentication, recovery and proxy access.
• Give clinical AI tools scoped identities with clinician approval for high-impact actions.

Standards and references

• HHS: HIPAA Security Rule
• 21 CFR Part 1311: Requirements for electronic orders and prescriptions
• FDA: Medical device cybersecurity
• HHS 405(d): Health Industry Cybersecurity Practices
• NHS Data Security and Protection Toolkit
• Directive (EU) 2022/2555 (NIS2)

This guide summarises identity themes for security practitioners and is not legal advice. Related NHI Mgmt Group resources: Identity Security Regulatory Map · Remote Access Identity Guide · Device and IoT Identity Guide · Break-Glass Account Guide