The healthcare sector has long been described as the next major frontier for digital identity, yet meaningful adoption has lagged behind banking, payments, and travel. In a conversation on ID Talk, FaceTec Chief Identity Technology Strategist Jay Meier argues that the reason has less to do with technology and more to do with how the industry understands the core security threat. Healthcare, he says, is now the “bullseye for fraud,” not because of novel attack techniques but because it concentrates the largest volume of high-value identity, entitlement, and payment information in any major vertical.
According to Meier, the common assumption that each sector faces unique identity threats has held back modernization. “The attack vector is a valid credential that represents privileges and gets passed to somebody who is not authorized to use it,” he explained. “It does not matter what industry you are in.” Device-level protections, secure messaging, and cryptographic safeguards do not address that gap. The foundational failure is the lack of a reliable method to bind a real human being to the identity and privileges being exercised.
The result, Meier notes, is predictable. Fraud follows the richest concentration of identity-linked benefits, and in the United States those benefits largely reside in Medicare, Medicaid, and Veterans Affairs programs. Together they account for the majority of healthcare expenditures, creating an environment in which attackers can exploit patient identities, provider credentials, and reimbursement workflows at scale. Recent enforcement activity, including multibillion-dollar fraud cases, illustrates how deeply embedded these vulnerabilities have become.
Meier emphasizes that the industry’s continued reliance on “secure channels” has created a false sense of protection. Messaging layers may be encrypted, but the systems transmitting those messages cannot determine who pressed send, who approved an action, or whether privileges were delegated to unauthorized personnel. At the healthcare standards event where FaceTec recently presented for the first time, he says attendees immediately recognized the problem. “How do you know who sent the email?” he recalls asking one vendor. “They were just dumbfounded.” That distinction between device security and person-to-privilege binding resonated strongly, particularly around workflows such as electronic controlled substance prescriptions, pharmacy pickup, and home healthcare visit verification.
One example that struck healthcare officials was the use of identity binding in home healthcare fraud mitigation. A former Deputy Secretary of Health and Human Services, after hearing the UR Code concept explained, immediately responded, “Medicaid fraud,” identifying how person-verified timestamps and geolocation could prevent common types of false billing and unauthorized care delivery. Meier says reactions like this suggest the industry is beginning to reassess long-standing assumptions about identity.
Structural challenges continue to slow large-scale change. Healthcare remains one of the most heavily regulated environments in North America and Europe, and legacy systems are deeply entrenched. But Meier notes that regulatory and legal pressure is shifting, and courts are increasingly evaluating whether liability for downstream fraud can extend back to the organizations that failed to safeguard identity data at the outset. At the same time, regulators are paying closer attention to identity-centric controls rather than device-centric ones, mirroring trends observed in other sectors covered by ID Tech, including recent developments in financial services and government credentialing.
Taken together, these forces may accelerate long-awaited reform. Meier’s assessment is that the technical capability to solve the problem has finally arrived, and the next step is aligning healthcare security with the actual attack vector rather than the one the industry has historically assumed.
To hear Jay’s full suite of insights on the new identity opportunity in healthcare, listen to the full episode through the media player below, or wherever you get your podcasts.
–
By the ID Tech Editorial Team
