Healthcare has carried the highest average breach cost of any industry for thirteen consecutive years. IBM's 2026 Cost of a Data Breach report puts it at $6.64 million, down from the previous year but still ahead of every other sector. The reason is not indifference. Clinical environments are built around speed of access, and identity controls that slow a clinician down get worked around by the end of the week.
Three things are true in hospitals and almost nowhere else.
Insider misuse of legitimate access is a recurring pattern in healthcare breaches, which is why detection matters as much as prevention here, and why session recording is worth more in a hospital than almost anywhere.
45 CFR 164.308 requires access controls, audit logs and a risk analysis. Not as best practice — as a legal requirement, with civil penalties that can reach $2.19 million a year for repeated violations of the same requirement. The 2026 Security Rule update adds a technology asset inventory requirement, which is where the medical device problem stops being optional, and the HITECH Act raises breach penalties on top.
The HIPAA Security Officer, usually the CISO, is legally responsible for access controls and technical safeguards. In larger health systems the Chief Privacy Officer signs alongside them. Practically, the review asks four things: who can reach ePHI, whether it is least privilege, whether it is logged, and whether you can produce the evidence. Where the answer to the last one is no, that is the work. Start with a compliance readiness assessment, and where the systems warrant it, HIPAA penetration testing evidences the risk analysis.
The Security Rule names the control. The gap is almost always between the control and the evidence.
| Security Rule requirement | What an OCR review expects to see | Where it usually fails |
|---|---|---|
| Unique user identification — 45 CFR 164.312(a)(2)(i) | Every action against ePHI attributable to one named person | Shared ward workstation logins, which attribute the action to a machine |
| Emergency access procedure — 45 CFR 164.312(a)(2)(ii) | A documented break-glass path that holds up under clinical pressure | Break-glass exists on paper but is slow, so standing access is kept instead |
| Information access management — 45 CFR 164.308(a)(4) | Access granted by role and reviewed on a schedule | Residents, locums and vendors who kept access after the rotation ended |
| Audit controls — 45 CFR 164.312(b) | Logs showing who reached what, retained and searchable | Logging on the EHR but not on the databases and admin accounts behind it |
| Risk analysis and asset inventory — 45 CFR 164.308(a)(1) | A current inventory of the systems holding ePHI, medical devices included | Imaging and infusion estates that no one owns on the inventory |
The inventory requirement arrives with the 2026 Security Rule update. Where the evidence is the gap rather than the control, that is compliance readiness work.
EHR and PACS access that follows the person rather than the workstation, with break-glass built in and every emergency access reviewed.
Segmented, with privileged access to device management consoles brokered and recorded, because the device itself cannot defend itself.
A vendor with standing access to patient data is a way in that your own defenses never see. Vendor sessions brokered, recorded, and expired at grant rather than discovered at audit.
Populations that arrive and leave constantly, with access that has to be right on the first shift and gone on the last. That is IGA implementation work.
Tap-and-go or badge access into the shared workstation, with the session bound to the person rather than the machine. This comes first because it is the control clinicians feel, and because every audit requirement downstream depends on an action having a name against it.
The domain administrators, the database accounts behind the EHR and PACS, the device management consoles and the service accounts clinical systems use to talk to each other. These rarely appear in a workforce access review and are the path most ransomware takes.
Residents, locums, travelling staff, contractors and vendors arrive and leave constantly, and each one is a grant that has to expire on its own. Sponsored, time-bound access with attestation, so the leaving date is built into the grant rather than discovered at the next review.
Where the privileged platform is CyberArk, CyberArk implementation is the delivery route.
Two questions, asked of every account in the estate: should this person have this access, and can you prove what they did with it.
Identity and access management for healthcare splits along those two lines. Governance answers the first — who should hold what, granted on a role, reviewed on a schedule and removed when the rotation ends. Privileged access answers the second — the small number of accounts that can reach everything, vaulted and recorded so an action against patient data has a name and a session behind it.
Most health systems have the first in some form and very little of the second. Identity governance for hospitals is usually built around the clinical workforce and stops at the edge of it, which leaves the domain admins, the database accounts behind the EHR and the device management consoles governed by convention. That is IGA implementation on one side and PAM implementation on the other, and in a hospital they are the same programme approached from two ends.
The most common trigger. Map the finding to the control, fix the control.
Industry reporting puts hospital downtime cost as high as $900,000 a day. The path in is almost always a credential, and PAM implementation closes it.
Insurers now expect MFA on privileged access, brokered vendor sessions and security awareness training with records, before they will renew.
Where the privileged platform is CyberArk, CyberArk implementation is the delivery route, and service account management handles the credentials clinical systems use to talk to each other.
By making access to ePHI attributable, least-privilege, logged and evidenced — the four things an OCR review actually checks. Controls produce the evidence themselves rather than someone reconstructing it.
Not if break-glass is designed in from the start. Emergency access is instant, fully logged and reviewed afterwards. The controls that fail in hospitals are the ones that made a clinician wait; the ones that hold are the ones that never did.
Yes, around the device rather than on it: network segmentation, brokered and recorded access to the management console, and vaulted credentials for the service accounts the device uses. The device stays untouched, which is usually a regulatory requirement anyway.
By making the individual login faster than the shared one — tap-and-go or badge access into a shared workstation, with the session attributed to the person rather than the machine. Shared logins persist because they are convenient. Remove the inconvenience and they stop.
The risk analysis, the access control policy, evidence that access to ePHI is reviewed, audit logs showing who accessed what, and — since the 2026 update — the technology asset inventory. All of it produced on request, not assembled in the week before.
Both, and in a health system they are hard to separate. Governance covers the clinical workforce — joiners, movers, leavers, residents and locums, with access reviews that produce their own evidence. Privileged access covers the accounts underneath that reach everything. A programme that does one and not the other leaves the half an OCR review tends to ask about.
You deployed SSO. You turned on MFA. Then the auditor asked 'who has access to what, and should they?' — and that question lives in the gap between IAM and IGA.
Jul 24, 2026
Most SailPoint and Saviynt comparisons are written by SailPoint or by Saviynt. Here is the version from people who deploy identity governance for a living.
Aug 31, 2026
Owning PAM and IGA is not the same as knowing your identity risk. What identity security posture management actually measures.
Jul 27, 2026A free audit is a 30-minute review of your privileged and clinical access by a certified engineer, with the findings in writing. The Healthcare blind spot brief covers the largest healthcare breach ever recorded and the access gap behind it.
Needed for the site to work — page delivery, and the spam protection on our forms. These do not track you and cannot be switched off.
Google Analytics and Microsoft Clarity, so we can see which pages are useful and which are confusing. Clarity hides anything you type into a form. We use this to improve the site, not to identify you.
ZoomInfo WebSights, which tells us which organisation a visit is likely to have come from and which pages were read. With this on, ZoomInfo may also set third-party cookies that help it recognise a visit across other websites, and may share that with its own partners. Turning this off stops all of it.
