State of Identity in Healthcare 2026
Healthcare-specific identity benchmarks — HIPAA Security Rule enforcement, breach cost economics for healthcare data, MFA coverage on clinical surfaces, the post-Change-Healthcare regulatory environment. Updated quarterly.
Reviewed
2026-05-22
6 benchmarks · CC BY 4.0
Regulators
HHS Office for Civil Rights (HIPAA) · CMS · FDA (medical device identity) · State AGs
$7.42M
Average healthcare breach cost
Healthcare remains the highest-cost industry for data breaches, well above the cross-industry average of $4.44M. Driven by regulatory penalties, individual notification cost, and reputational impact.
Source: IBM Cost of a Data Breach Report 2025 · 2025
190M
Change Healthcare breach records
The largest medical-data breach in US history. UnitedHealth finalized the disclosure at ~190 million Americans in January 2025 (initial October 2024 OCR filing was 100M).
Source: UnitedHealth disclosure (Jan 2025) · 2025
Leading vector
Healthcare breaches via stolen credentials
Credential-based access (stolen, reused, no MFA) remains the dominant initial vector in healthcare breaches. The Change Healthcare attack itself originated through a Citrix portal account without MFA.
Source: Verizon DBIR 2025 + practitioner observations · 2025
~62%
ObservationWorkforce MFA coverage on clinical applications
Clinical applications (Epic, Cerner, etc.) lag on MFA coverage relative to administrative surfaces. Trade-off is intentional — clinical workflow latency vs security — but the gap is increasingly auditor-flagged.
Source: askmeidentity practice observations · 2026
NPRM pending
HIPAA Security Rule update status
HHS-OCR issued a Notice of Proposed Rulemaking on December 27, 2024 to modernize the HIPAA Security Rule (MFA on all PHI access, encryption at rest, mandatory annual technical audit). 4,700+ comments submitted; final rule target was May 2026 but a January 2025 federal regulatory freeze leaves timing uncertain.
Source: HHS OCR NPRM · 2025
Increasing
ObservationBAA-required IAM evidence requests
Business Associate Agreements are increasingly requiring formal IAM evidence packages from BAs (third-party SaaS, service providers). Particularly common for payers and large health systems post-Change-Healthcare.
Source: askmeidentity practice observations · 2026
Cite this page
Reference our benchmarks in your reporting.
These benchmarks are licensed under CC BY 4.0 — free to cite, quote, and link to with attribution. Pick a format below.
askmeidentity. (2026). The State of Identity, live (v2026.05). Retrieved 2026-05-22 from https://askmeidentity.com/resources/state-of-identity-healthcare/
"The State of Identity, live." askmeidentity, v2026.05, https://askmeidentity.com/resources/state-of-identity-healthcare/. Accessed 2026-05-22.
@misc{askmeidentity_state_of_identity_2026_05, title = {The State of Identity, live}, author = {{askmeidentity}}, year = {2026}, note = {Version 2026.05, retrieved 2026-05-22}, url = {https://askmeidentity.com/resources/state-of-identity-healthcare/} }