Benchmarks + reports
Citable data on the state of healthcare IAM.
Why Healthcare is distinct
Healthcare is one of the most-targeted industries for identity-vector attacks — and one of the most-regulated. After the Change Healthcare breach, the bar for clinical IAM hygiene rose significantly. The HIPAA Security Rule NPRM (Dec 2024) will tighten requirements further.
Regulators
- HHS Office for Civil Rights (HIPAA enforcement)
- CMS (Medicare + Medicaid)
- FDA (medical device identity)
- State Attorneys General
- HITRUST CSF (private certification framework)
Industry-specific challenges
The IAM challenges that recur in Healthcare.
- Clinical workflow latency vs MFA friction — clinicians need fast access at the point of care
- PHI access logging at scale — every chart access generates an audit event
- Business Associate Agreement (BAA) management — third-party access multiplies the surface
- Medical device identity — devices outlive identity platforms
- Shared clinical workstations — tap-and-go workflows replace traditional login
- Emergency / break-glass access — must work even when normal IAM is down
The canonical Healthcare resources
Everything we’ve published, organized by topic.
Compliance + audit
HIPAA, HITRUST, and related IAM control requirements.
Architecture + reference
How to design IAM for regulated-enterprise + clinical environments.
Incident + risk tracking
Sector-relevant insights
Healthcare IAM engagement