A 6-Figure Settlement Over Sessions That Never Failed
In 2023, a Washington state hospital paid $240,000 to settle a federal investigation after security guards working at the facility were found to have accessed patient medical records they had no clinical or operational reason to view. The guards weren't outside attackers. They didn't steal credentials or exploit a technical vulnerability. They used sessions that were, by every measure an identity system checks, completely legitimate.
The Detail Worth Sitting With
Nothing about the access looked wrong from the identity provider's point of view. The accounts were real, the logins were successful, and the sessions were authorized in the sense that the identity system understands authorization: the right person entered the right credentials at the start. What the system had no way to evaluate was whether looking at those particular records, at that particular time, matched what the person using the session was actually there to do.
The Shape Unauthorized Access Actually Takes
This is the shape unauthorized access takes in health systems more often than most security teams expect. It isn't usually a dramatic breach with a clear intrusion point. It's a session that stayed exactly within its technical bounds while the human behind it did something the organization never intended, and by the time anyone noticed, the access had already happened, sometimes for months.
Why Nothing Caught It While It Was Happening
An identity architecture built entirely around the authentication event has no mechanism for catching this while it's happening. The guards' sessions would have looked identical whether they were doing their jobs or reading records that had nothing to do with their jobs, because "identical" is exactly what a valid, authenticated session looks like from the outside. Detecting the difference requires a signal that has nothing to do with whether the login succeeded, and everything to do with whether the behavior inside the session matches what that identity is actually there to do.
The Piece Still Missing
That's the piece missing from most health systems identity programs today, and from most continuous identity platforms generally, and it's the piece the rest of this series builds toward: not a better lock on the door, but a way to notice when what's happening inside the room stops matching who was let in.