On May 12, 2026, NYC Health + Hospitals disclosed a significant cybersecurity incident affecting approximately 1.8 million current and former patients, employees, and other individuals. According to the organization’s official notice, an unauthorized actor gained access to portions of its network over several months, exposing a broad range of sensitive information including protected health information (PHI), Social Security numbers, insurance information, medical records, and, in some cases, biometric information.
Official Notice from NYC Health + Hospitals
https://www.nychealthandhospitals.org/pressrelease/notice-of-data-breach/
TechCrunch Coverage
https://techcrunch.com/2026/05/18/nyc-health-and-hospitals-says-hackers-stole-medical-data-and-fingerprints-during-breach-affecting-at-least-1-8-million-people/
HIPAA Journal Coverage
https://www.hipaajournal.com/nyc-health-hospitals-data-breach-march-26/
The official notification states that investigators believe the intrusion likely originated through a compromise involving a third-party vendor. Most news coverage understandably focused on the number of people affected and the sensitivity of the stolen data.
From an identity governance perspective, however, there is another lesson that deserves equal attention.
This was not simply a third-party vendor breach.
It was also a breach that illustrates the importance of continuously governing who has access to what.
Beyond Authentication: The Authorization Problem
Most cybersecurity discussions begin with authentication. Security teams naturally ask how an attacker gained access. Were credentials stolen? Was phishing involved? Was multi-factor authentication bypassed? These are important questions because they explain how an attacker was able to assume the identity of a legitimate user.
Once that happens, however, the security problem changes completely. The question is no longer whether the identity can authenticate—it already has. The real question becomes: What is that identity authorized to access?
That distinction is one of the most important concepts in modern cybersecurity. Authentication verifies identity. Authorization determines permissions. Identity governance exists to ensure those permissions remain appropriate throughout the lifecycle of every human and non-human identity, reducing risk long after the initial login has occurred.
A Third-Party Vendor Is Still an Identity
Organizations often discuss third-party risk as though it exists separately from identity security. In reality, once a vendor is granted access to your environment, it becomes an identity governance issue.
A vendor may receive:
- Active Directory or Microsoft Entra ID accounts
- VPN access
- Cloud application accounts
- Administrative privileges
- API credentials
- Database permissions
- File share access
- Remote support accounts
- Service accounts
This is why authorization matters. The impact of a breach is frequently determined by the permissions an identity accumulated over time, not simply by how the attacker gained access. Continuous User Access Reviews help ensure vendor identities retain only the access they need, limiting the damage if one of those trusted identities is ever compromised.
The Question Every Healthcare Organization Should Ask
Imagine one of your vendors were compromised tomorrow.
Could your security team immediately answer these questions?
- Which vendor identities currently exist?
- Which systems can they access?
- Which Active Directory or Entra ID groups contain vendor accounts?
- Which accounts have administrative privileges?
- Which permissions were granted temporarily but never removed?
- Which accounts have not been reviewed in the past six months?
- Who approved each permission?
- Does every permission still have a documented business justification?
For many organizations, answering these questions requires searching spreadsheets, emails, ticketing systems, and multiple identity repositories.
That delay is exactly what attackers exploit.
Healthcare Creates Thousands of External Identities
Healthcare organizations depend on a vast ecosystem of third parties to deliver patient care and operate efficiently. These organizations routinely grant access to:
- Electronic Health Record (EHR) vendors
- Medical device manufacturers
- Billing providers
- Revenue cycle management companies
- Insurance clearinghouses
- Cloud hosting providers
- Laboratory partners
- Managed service providers
- Consultants
- Temporary clinicians
- Software support organizations
Every one of these relationships creates one or more digital identities inside the organization’s environment. Those identities are granted access because they have a legitimate business purpose.
The challenge is that business relationships change much faster than permissions. Projects end, contracts expire, applications are retired, and support personnel move on—but the access they were granted often remains.
Security professionals refer to this gradual accumulation of unnecessary permissions as authorization drift. It rarely makes headlines on its own, but it quietly expands an organization’s attack surface until a compromised identity—or an attacker—discovers it first.
Why User Access Reviews Matter
Many organizations think of User Access Reviews as an audit requirement.
Healthcare regulations such as HIPAA certainly expect organizations to implement appropriate access controls and periodically evaluate who can access sensitive information.
But User Access Reviews are much more than a compliance exercise.
They are one of the most practical ways to reduce cyber risk.
A well-executed User Access Review continuously asks questions such as:
- Does this vendor still require access?
- Is this level of access still appropriate?
- Has the project ended?
- Is this account dormant?
- Does someone still own this identity?
- Is least privilege being maintained?
- Can every permission be justified?
Those questions reduce unnecessary permissions long before an attacker has an opportunity to abuse them.
Identity Governance Reduces the Blast Radius
No identity governance platform can promise to stop every cyberattack.
Attackers will continue finding new phishing techniques, exploiting trusted vendors, and compromising credentials.
The objective of identity governance is different.
It is to reduce the blast radius after an identity has been compromised.
If an attacker gains control of an account that has excessive privileges, unnecessary application access, stale group memberships, and forgotten administrative permissions, the damage can spread quickly.
Not preventing every breach.
Preventing every breach from becoming a catastrophic one.
Where YouAttest Fits
The NYC Health + Hospitals breach serves as another reminder that security doesn’t end once an identity successfully logs in. Whether the identity belongs to an employee, contractor, service account, or third-party vendor, organizations must continuously verify that the access granted remains appropriate.
That is exactly what YouAttest User Access Reviews are designed to accomplish.
With YouAttest, organizations can identify dormant accounts, excessive permissions, stale group memberships, and vendor access that is no longer justified—before those permissions become an attack path. Every review is documented with a complete audit trail, providing both stronger security and defensible compliance evidence.
Healthcare organizations will always depend on vendors, partners, and contractors. The goal is not to eliminate those relationships. The goal is to ensure every identity—regardless of who owns it—is continuously governed using the principles of least privilege and ongoing accountability.
Learn more about YouAttest User Access Reviews:
https://youattest.com/solutions/user-access-reviews/
Because the most important question after a successful login isn’t “Who is this?”
It’s “What are they still authorized to access?”
Next Steps
By automating identity attestation and user access reviews, YouAttest helps organizations enforce least privilege, strengthen accountability, and maintain continuous assurance that access remains aligned with business need. To learn more, contact info@youattest.com or Contact YouAttest.
- AI Agents Are Privileged Identities. Their Access Needs to Be Reviewed. - October 3, 2026
- AI Is the Unrealized Insider Threat: Why Enterprise AI Security Starts With Existing User Access - September 20, 2026
- The Service Account Wasn’t the Initial Breach. It Became Part of the Attack. - September 13, 2026
