The identity gap putting Australia's healthcare data at risk

Australia's healthcare sector continues to invest heavily in cybersecurity, but recent breaches show that protecting systems holding sensitive patient data is only part of the challenge. A more fundamental concern remains about who has access to Australians' health data, and whether that access can be reliably removed when it is no longer needed.

This is becoming more urgent as healthcare organisations expand their digital footprints, adopt cloud services, embrace AI and connect more clinicians, contractors, partners and patients. That increases both regulatory pressure and exposure to cyberattacks, where the consequences can extend beyond data loss to direct impact on patient care and safety. 

Recent events have demonstrated the consequences when sensitive healthcare information falls into the wrong hands. In June, a cyberattack on Australian healthcare provider Partnered Health resulted in personal and medical information being taken from 21 clinics, including Medicare and insurance details, consultation notes, referral letters and pathology or diagnostic results.

These developments point to a broader issue - the healthcare security perimeter is no longer simply the network. It is identity.

Confidence isn't the same as control

Research from the FIDO Alliance and HID indicates there is a significant gap between organisations' confidence in their identity controls and what happens in practice.

The survey of 500 global IT and cybersecurity decision makers showed 94% were confident that physical and logical access could be revoked within 24 hours when an employee left the organisation. Yet 35% said their organisation had actually experienced delays or failures revoking access when an employee left during the previous two years. Overall, 70% reported experiencing at least one identity-related security event during that period.

For healthcare, the consequences of getting this wrong are particularly serious. Access is often spread across regional networks, smaller practices and a workforce that relies heavily on temporary and contact staff, making credential creation and revocation harder to track. A departing employee may have had access to clinical applications, patient records, medication information, diagnostic systems, physical facilities and devices. If those identities are managed separately, access can remain active in one environment even after it has been removed elsewhere. 

Healthcare can't afford identity siloes

Historically, physical and logical access have been managed by different teams. For example, the IT department manages usernames, passwords and applications while the physical security team manages cards, badges and doors. Each system can work perfectly in isolation,  but problems emerge when they need to work together.

The FIDO Alliance and HID research found only half of enterprises had unified reporting ownership for physical and digital identity, while just 48% had unified budget ownership. In healthcare specifically, 51% reported unified reporting and 53% unified budget ownership. This meant that nearly half of the healthcare organisations surveyed had disparate reporting mechanisms and siloed budgets across physical and digital identity management. 
 
That fragmentation creates complexity and a high level of risk around protecting patient data.

The answer isn't another security layer

The instinct following a cyber incident is often to add another security control. But healthcare organisations don't need more disconnected layers. They need better connected identity infrastructure where physical and digital identity are parts of the same security architecture. This allows healthcare organisations to also comply with Australian Signals Directorate's Essential 8 requirements for phishing resistant authentication with a single authenticator that opens everything between the front door and the applications on the workstations.

Consider the lifecycle of a healthcare employee. When a new clinician joins, they need access to a building, workstation, clinical application, electronic medical record and other systems. Those permissions change when they change roles, and when they leave, access must be removed - everywhere and immediately. Automating that lifecycle reduces the possibility of an overlooked credential becoming an open door.
Yet the FIDO Alliance and HID research show there is still considerable reliance on manual processes, with 64% of organisations reporting automated credential revocation, meaning a significant proportion still rely primarily on manual processes. 

Identity security should cover the whole lifecycle

The Australian healthcare sector is likely to continue adopting technologies such as AI scribes and cloud-based clinical systems that make patient care more connected, efficient and personalised.

Additionally, remote care, mobile devices and digital patient services will continue to expand the number of identities and credentials that organisations need to manage.

The lesson from recent healthcare breaches is that the identity infrastructure needs to mature alongside the technology it supports. The path forward is not necessarily to add another tool, but to understand the existing identity and access management (IAM) environment, define a clear authentication strategy and consolidate identity services where it makes sense. The FIDO Alliance and HID research suggest organisations have already recognised the need to adapt to a future where credentials converge, with 95% saying physical and logical convergence exists somewhere in their identity strategy, while 91% find a unified credential model appealing.

For Australian healthcare organisations, this means the next stage of cyber resilience must go beyond protecting systems.  It must protect the trust that sits behind them. This means ensuring identity is unified, automated and fundamentally harder to compromise - from the front door of a clinic to the systems containing the patient's most sensitive information. This is the only way Australian healthcare organisations can protect the valuable clinical information entrusted to them by patients both now and into the future.
 
HID has now joined the FIDO Alliance Board of Directors to help accelerate the shift to passwordless authentication and futureproof healthcare and other enterprises. Sean Dyon, Vice President of the HID Authentication Business Unit, will serve as the company's Primary Board Delegate, bringing a real-world perspective to the Alliance's work advancing interoperability, lifecycle management and deployment at scale.