IAM cycle in action: a hospital across public and private sector

Three in the morning in the emergency room

At three in the morning an ambulance brings an unconscious man into the emergency room at Metro Health. He was transferred from the cardiology ward an hour earlier, and the doctor on duty has no standing rights to the cardiology unit’s charts. There’s no time to file an access request and wait for an approval. What happens on that screen in the next ten seconds is an IAM decision, and getting it wrong in either direction is serious: refuse access and a patient may die, grant it silently and the hospital has a privacy hole it can’t explain.

Sara leads IAM at Metro Health, and she has to design for that night and for a thousand ordinary mornings. We’ve covered the operational cycle and JML in depth. This article runs them under real constraints, starting with healthcare because no other sector puts more pressure on the same machinery: life-or-death urgency, privacy stakes that can’t be undone, high turnover and, in this example, an organization that lives in two sectors at once.

Metro Health Network is a regional system with a 600-bed public hospital, funded and partly staffed through the government health service, and an attached private clinic that runs on commercial terms. Same campus, in places the same medical records platform, but two payrolls, two HR worlds and two compliance regimes, and one set of doctors who often work in both. If you can run JML cleanly here, you can run it anywhere. The question that frames the whole case, “who is the authoritative source for this person?”, has no single answer at Metro Health. A cardiologist might be a private-sector contractor in the clinic and hold admitting privileges in the public hospital at the same time. The whole design depends on answering that question per relationship, not per person.

Six populations, six sources

Metro Health doesn’t have “employees”. It has six distinct groups of identities, each with its own lifecycle and its own source of truth.

The first design decision is to resist a single HR feed. Each group has a different system that holds the truth about it, and the IGA platform has to aggregate all of them into one master record, joining on the person where the groups overlap, as with the doctors who work in both wings, but keeping the relationships separate.

A new clinician’s identity is assembled from more than one source, and the platform has to know which source wins for which attribute. The legal name and government ID come from whoever employs the person, the government HR system on the public side or Workday on the private side. The medical license and specialty come from the credentialing system, because only credentialing verifies and renews licenses. The current rotation and supervisor come from the academic registry, because residents belong to a training program, not to a payroll. A contractor’s end date comes from supplier management, because contractors lapse rather than resign. And department and location come from the employing source. All of them publish events onto a message bus that the IGA platform reads, the same event-driven pattern that lets onboarding finish before a clinician’s first shift. The key rule built into all of this is that licensing always defers to credentialing, whoever employs the person. A doctor employed by the private clinic still has their right to open a chart governed by the license record held by the public credentialing authority.

Joiner: a doctor who works in both wings

Dr. Elena Ruiz, a cardiologist, is hired by the private clinic and given admitting privileges at the public hospital, both starting the same week. That’s two joiners for one person, and getting it right means provisioning the clinic relationship and the hospital relationship separately while tying both to one master identity.

sequenceDiagram
  accTitle: Onboarding a dual-affiliation physician at Metro Health
  accDescr: The credentialing system confirms Dr. Ruiz's active license to the IGA platform, which creates or reuses one master identity. Workday signals the private-clinic employment relationship and the public hospital's privileging system signals the admitting relationship. The IGA platform provisions a clinic access set and a separate hospital access set, both gated on the active license, and records everything to the audit store.
  participant CRED as Credentialing
  participant IGA as IGA platform
  participant WD as Workday
  participant PUB as Privileging
  participant APPS as Clinical apps
  CRED->>IGA: Active license verified (Dr. Ruiz)
  IGA->>IGA: Create or reuse master identity
  WD->>IGA: Private-clinic employment starts
  PUB->>IGA: Admitting privileges granted
  IGA->>APPS: Clinic access (license-gated)
  IGA->>APPS: Hospital access (license-gated)
  IGA->>IGA: Two relationships, one identity, both audited

What makes this correct rather than merely convenient is that the two sets never mix. The clinic role gives Dr. Ruiz the clinic’s scheduling and billing and its part of the medical record; the hospital privilege gives her inpatient cardiology records and order entry. If her clinic contract ended tomorrow, the clinic access would be removed while her hospital privileges, a separate relationship, stayed untouched.

The tempting shortcut is to give a doctor like her one “super role” covering everything. It’s a privacy and audit disaster. You can no longer say why she has a given access, you can’t remove one affiliation without the other, and an auditor can’t work out which hat she was wearing when she opened a chart. Keep the relationships separate even when the person is the same.

Mover: when a resident becomes an attending

The defining mover in a teaching hospital is the resident who finishes training and becomes an attending physician. Everything about their access changes at once. They leave the academic registry’s authority and move to the public HR system or the private payroll. Their supervised, limited access becomes independent privileges. And a stack of training-program entitlements has to be removed rather than carried forward.

A correct mover recalculates the whole expected set from the new relationship and reconciles in both directions. It grants independent order entry, the authority to prescribe within their license and attending-level access to the medical record. It removes the resident’s supervision constraints, the training program’s shared resources and the academic registry’s access, everything that only made sense during training. And it re-checks separation of duties for any conflict the new authority creates.

The failure is the universal one from the JML article: granting the new attending access and leaving the old resident access in place, so a senior physician quietly accumulates a decade of training permissions nobody remembers granting. In a hospital that isn’t just untidy. It’s a path into systems and groups of patients the attending no longer has any clinical reason to touch.

Leaver: the rhythms of departure

Departures at Metro Health come in three very different rhythms, and the leaver flow has to handle each one. Cohorts leave on schedule: residents and students go in waves at the end of each rotation, so every cohort identity is tied to a fixed end date and its access expires on its own, just-in-time access at the scale of a whole group, followed by reconciliation to sweep up stragglers. Contractors lapse: when the biomedical engineering firm’s contract ends, the supplier system sends the termination and access to device-management consoles and the relevant parts of the medical record is revoked. Because contractors lapse quietly, a missing or extended end date is treated as an exception to review. And some departures are urgent: a clinician dismissed after a serious incident needs access cut within minutes, sessions ended and a forensic review of every record they touched, none of which can wait for a nightly batch.

In all three, disabling first and deleting later matters more than usual. Clinical records the person wrote, signed or co-signed have to stay attributable for years, so the account is disabled and kept, never deleted on day one, until the regulatory retention period runs out.

Break-glass

Back to the emergency room. What makes healthcare unique is that refusing access can kill someone. The answer is break-glass, a controlled emergency override.

flowchart TB
  accTitle: Break-glass emergency access flow
  accDescr: A clinician requests emergency access to a record outside their normal rights. The system grants access immediately, but flags the session as break-glass, writes a high-priority audit event, time-boxes the access, and automatically opens a mandatory post-hoc review by the privacy office, which either clears the access as justified or escalates it as a violation.
  REQ[Clinician needs a record<br/>outside normal rights] --> GRANT[Grant access immediately]
  GRANT --> FLAG[Flag session as break-glass]
  FLAG --> LOG[High-priority audit event]
  FLAG --> BOX[Time-box the access]
  LOG --> REVIEW[Mandatory post-hoc review<br/>by privacy office]
  REVIEW -->|justified| CLEAR[Clear & document]
  REVIEW -->|not justified| ESC[Escalate as violation]

The principle is that prevention is traded for detection, never for accountability. The doctor gets in at once, with no approval queue between them and a dying patient, but the system makes the access loud: a high-priority log entry, a time-limited window and a review afterwards that isn’t optional. Most break-glass events turn out to be fully justified and are documented as such; the few that aren’t become privacy investigations. What matters is that every one is reviewed, which is what stops the override from quietly becoming a back door.

When a license lapses

The second control specific to healthcare is automatic suspension when a license lapses. Because the credentialing system is authoritative for licenses, it sends expiry dates to the IGA platform, which schedules the lifecycle around them: reminders to the doctor and the credentialing office in the weeks before and, if the license isn’t renewed by the expiry date, automatic suspension of access to every clinical system.

That isn’t optional hygiene. Regulations require that only currently licensed staff reach protected health information, and with hundreds of doctors on rolling renewal cycles, tracking it by hand is impossible. The HIPAA Security Rule requires access controls and audit controls over electronic health information, and NIST SP 800-66, the guide to implementing it, turns those into concrete account-management and logging practices. Break-glass, license gating and a complete record of who opened what aren’t extras; they’re how a hospital shows it meets the “minimum necessary” and accountability principles the rule demands.

Devices and service accounts

Metro Health’s largest single group isn’t clinicians. It’s the roughly 1,800 medical devices and service accounts in the CMDB. Infusion pumps, imaging workstations, lab analyzers and the integration accounts that move data between the medical record and a dozen other systems are all identities. They authenticate, they hold access and, left ungoverned, they’re the softest target in the building.

These non-human identities break JML’s assumptions in useful ways. They don’t join through HR and they never resign, so their lifecycle belongs to the CMDB and the biomedical engineering team, not to HR. A device is provisioned when it’s commissioned, its access changes when it moves between units, and it has to be deprovisioned when it’s decommissioned, a leaver event that in practice is the one most often skipped. A retired imaging workstation whose service account still has live access to the medical record is an orphan with a network port. The rules mirror the human lifecycle with a twist. Every device and service account has a named human owner, because an identity nobody owns is an identity nobody will offboard. Credentials are rotated and kept in a vault, never shared in a spreadsheet. And decommissioning is a tracked leaver event, reconciled against the CMDB, because a device’s account outliving the device is exactly what orphan reconciliation exists to catch. Non-human identity gets its own domain later in the program; the point here is that a hospital can’t run JML for people and ignore the larger population of things. Attackers don’t care whether the credential they steal belongs to a cardiologist or a CT scanner.

Who opened this record?

Healthcare is where audit stops being hygiene and becomes the product. Under HIPAA, a patient can ask who looked at their record, and the hospital has to answer completely and credibly. Every lifecycle event above, joiner, mover, break-glass, leaver, license suspension, writes to an audit store precisely so that question can be answered months or years later. It records not just sign-ins but access to individual records: which clinician opened which patient’s chart, when, from where and on what authority, routine, role-based or break-glass.

Two things make that audit trustworthy rather than theater. Attribution outlives the person: because leavers are disabled and kept rather than deleted, a record a nurse who left three years ago opened is still attributable to her, whereas deleting the account too early leaves holes in the trail exactly where an investigation needs it. And anomalies are surfaced, not just stored: a hospital that only keeps logs is performing compliance, while a mature one runs detection over them, catching the employee who opens a celebrity’s chart, the clinician browsing patients they never treated, the burst of access just before a resignation. That’s the point where IAM hands over to identity threat detection, a later domain.

The lesson goes well beyond healthcare: audit is only as good as the lifecycle discipline beneath it. You can’t reconstruct who did what if identities are merged, leavers are deleted and break-glass isn’t logged. A hospital just makes the stakes impossible to ignore.

Two HR clocks

The dual-sector structure causes a subtler problem than the doctors who work in both wings: the two halves of Metro Health run HR on different clocks. The government HR system behind the public hospital moves at civil-service pace; changes are batched overnight, approvals go through committees and a role change can take a week to arrive. The private clinic’s Workday is close to real time. The same IGA platform reads both, and one rigid workflow can’t serve them.

Design JML around the slow source and the private clinic suffers needless friction on day one; design it around the fast source and your automations expect events the public system won’t send for days. Sara’s answer is to treat latency as an attribute of the source. Public-side joiners are prepared well in advance, because the authoritative event arrives late, so the identity is built ahead of the slow feed and switched on when it’s confirmed. Private-side joiners follow the real-time event directly, with little preparation. And urgent leavers on the public side can’t wait for the overnight batch, so they get a manual real-time override.

On top of that sit the public sector’s own rules: civil-service protections, union agreements that limit which access changes may come with a role change, and public-records obligations that pull in a different direction from HIPAA’s privacy mandate. None of them changes the shape of JML; joiner, mover and leaver still apply. But they change its timing and approvals, and that’s the real lesson of a dual-sector organization: the lifecycle has to absorb two cadences, or one half of the house will spend its days fighting a workflow built for the other.

What Sara measures

Metro Health uses the JML metrics from the lifecycle article but leans them towards the controls that keep patients safe and auditors satisfied. In a regulated hospital the metrics aren’t reporting overhead; they are the evidence. Sara watches whether a new clinician has working access before their first shift rather than in their first week; whether access is suspended exactly at license expiry, with reminders weeks before; whether every break-glass event is reviewed, most of them within days; whether the orphan rate among devices and service accounts is heading to zero through CMDB reconciliation; and whether rotation access expires on schedule without anyone offboarding residents by hand.

Two of those are where hospitals tend to fail audits. Break-glass review completion is the honest test of whether emergency access is a controlled override or a quiet back door. If events pile up unreviewed, the control only exists on paper, and a runaway number means the access model is so tight that clinicians break glass routinely just to do their jobs, which is a finding in itself. The timing of license suspensions proves that license gating actually runs. An auditor will pick a doctor whose license lapsed and ask for the exact time access was cut, and “we suspend automatically at expiry, here’s the log” is a very different conversation from “someone checks a spreadsheet every month”.

Healthcare simply makes measurable what every sector should measure anyway. A time-to-deprovision you can defend, an orphan rate heading to zero and a complete audit trail are the universal signs of a working program; the hospital just answers to a regulator who will actually ask to see them.

Telehealth stretches the perimeter

The newest pressure on Metro Health’s lifecycle is telehealth. Remote clinicians, some employed and some affiliated specialists consulting across regions, now reach patient records from outside the hospital on devices the hospital may not own. That stretches every control above. The identity has to be proofed to a higher level, because there’s no badge reader confirming the person is physically there, and the access decision has to weigh the device and network, not just the credentials.

Here practitioners lean on identity-proofing standards, NIST SP 800-63 defines assurance levels for exactly this “I can’t see you in person” problem, and on conditional access that treats an unmanaged home laptop differently from a hospital workstation. The lifecycle doesn’t change, a telehealth specialist is still a joiner, mover or leaver, but the joiner now includes stronger identity verification, and sign-in leans on context, much as the startup’s just-in-time access and the consultancy’s device checks do. Telehealth previews a theme the whole program keeps returning to: as the perimeter dissolves, identity and context become the control plane, and the operational cycle has to provision and govern people it will never meet in person.

What the hospital teaches

Metro Health distills lessons that apply well outside healthcare. One person can have many relationships, so access is governed per relationship, not per person, as Dr. Ruiz showed. Licensing overrides employment, so the authoritative source is chosen per attribute, not per person. Cohorts arrive and leave in waves, so whole groups are time-limited rather than offboarded one by one. Refusing access can be dangerous, so sometimes prevention is traded for detection, as in the emergency room at three in the morning, but never for audit. And records outlive people, so accounts are disabled and kept, and deletion is the last step, not the first.

The deepest lesson is the dual-sector structure. When an organization spans two employment regimes, the identity is shared but the relationships aren’t, and an IAM program that merges them loses the ability to provision, remove and audit each one independently. Keep the person single and the relationships plural.

Three questions to test yourself

1. A doctor’s private-clinic contract ends, but she keeps her public-hospital privileges. Describe exactly what should be removed, what should stay, and how the audit trail proves the difference.
2. Your break-glass review queue has 400 events this month and the privacy team can review 50. What does that number tell you about your access model, and what would you change so that break-glass becomes rare rather than routine?
3. A resident becomes an attending. List the entitlements you’d remove and the ones you’d grant, and explain why skipping the removal is more dangerous in a hospital than in most organizations.