Security

How Identity Management Supports Health Systems’ Ability To Provide Care Anywhere

A modern approach to cybersecurity gives the right people the right access when they need it.

Alexandra Shimalla is a freelance journalist and writer.

Someone sick with the flu logs in to an urgent care appointment from their bed. A hospice nurse checks on a patient in their bed at home. A clinician moves from campus to campus throughout the week. In an increasingly mobile healthcare environment, identity management provides nurses and physicians with access to their hospital or health system’s data from wherever they’re providing care.

According to the National Institute of Standards and Technology, identity management is “establishing and managing the roles and access privileges of individual network users.” This process includes how staff are onboarded into various systems, what systems and data they have access to, and what the process is when someone leaves or changes roles, explains Sandeep Kumbhat, vice president and global field CTO at Okta.

“Identity is the foundational security control that makes safe, connected care possible,” he says.

DISCOVER: How can hospitals strengthen their foundation for care anywhere?

The Importance of Identity Management in Healthcare

It’s not uncommon for health systems to have multiple, often disparate systems, requiring staff to remember various usernames and passwords. However, organizations with a focus on security and modernization have a unified approach to access: Relying on an identity management system, staff use a single, secure login to gain entry to the network — whether remotely or on campus — and access to whatever applications and information they need, explains Kumbhat. This method of connection allows for access wherever staff are.

Behind the scenes, the hospital’s IT team manages automations tied to the organization’s directory and HR systems, ensuring that only employed staff can log in to the network. When these systems communicate, a traveling nurse going from campus to campus doesn’t have to log in to multiple networks, and a physician on their first day already has the access they need to provide care.

In healthcare, a secure identity management system also safeguards protected health information. At the University of Pittsburgh Medical Center, identity management has been a major focus for decades. The system is connected to Active Directory, which ensures that onboarding and offboarding are done seamlessly and that access depends on privilege level and role. Layered onto their identity management process is multifactor authentication.

“Patients trust us with their most sensitive information, and we have a responsibility to protect it,” says Ed McCallister, senior vice president and CIO at UPMC.

Click the banner below to find out how IAM improves healthcare security and simplifies access.

Identity Management Enables Care Anywhere

At many health systems across the country, care is being delivered at multiple locations — whether it’s another hospital in the system, an affiliated clinic or the patient’s house — and clinicians need access to the network in order to provide care.

“Identity management enables flexibility to ensure users can securely and consistently access the systems they need, regardless of where care is delivered,” says McCallister. “Healthcare today is not confined to a single location, and neither are the people delivering care.”

Kumbhat describes this shift in care delivery as impacting the “perimeter” of the “traditional security model,” where any device or user connected inside a network (e.g. on-premises) has been automatically deemed safe. In an increasingly digital world, where clinicians are traveling to multiple locations or working from their own homes for telehealth appointments, what constitutes a “safe” user or device must pivot to outside the hospital’s physical location. “Identity becomes the new perimeter,” says Kumbhat.

“It doesn’t matter if a physician is accessing records from the ICU or their home office: What matters is that their identity is verified and their access is governed by consistent policies across every touchpoint,” he adds.

Common Challenges in Identify Management

The long-term success of identity management hinges on policies and continued attention. “Building and maintaining an effective identity management program takes time, coordination across teams and consistent adherence to standards and processes,” says McCallister. “Without that discipline, organizations may implement solutions but never fully realize their value.”

That value extends into two areas: improved user experience as staff more efficiently and easily gain access to the systems they need, when they need it, and a strengthened cybersecurity foundation for the organization, says McCallister.

EXPLORE: Five IAM trends to watch in 2026 and how to prepare for them.

A particularly vulnerable access point in healthcare is compromised credentials, explains McCallister. “Once access is gained, it can impact system availability and, ultimately, our ability to deliver care.”

In this worse-case scenario, when a health system also requires multifactor authentication, sensitive information remains protected, says Kumbhat. By removing unauthorized access and limiting permissions for staff to their roles and responsibilities, IT leaders can bolster security measures to help prevent potential breaches.

“Identity management is foundational to everything we do in healthcare IT today,” says McCallister. “As care delivery becomes more distributed and digital, and as cybersecurity threats continue to evolve, the importance of identity will only increase.”

The Future of Identity Management

All too often, IT leaders come into their role with the looming task of connecting various antiquated and siloed systems into something cohesive and functional; this may be due to outdated legacy systems or as a result of a merger or acquisition. Whatever the reason, Kumbhat says, leaders should modernize one thing at a time, starting with business applications and getting single sign-on and multifactor authentication established. The next phase includes automating permissions and looking at clinical workflows.

The steps taken to modernize an identity management system are also steps toward modernizing the overall health system, adds Kumbhat, including “interoperability, better digital experiences for patients and AI-powered workflows that all require a trustworthy identity layer to function securely.”

“The health systems that make the most progress treat identity as an ongoing program rather than a one-time project,” says Kumbhat.

Galeanu Mihai/Getty Images