Executive summary
According to a Forrester Consulting Total Economic Impact study, modern identity security delivers a 216% ROI, a payback period under six months, and a 90% reduction in identity-related breach risk over three years. For healthcare providers, payers, and pharma, these controls protect PHI, automate HIPAA compliance reviews, and secure emerging clinical AI agents.
Identity security ROI in healthcare is notoriously hard to pin down. Security investments are easy to cost and hard to credit when nothing goes wrong—which is exactly why a new third-party study is useful: It puts a number on what a modern identity security investment is actually worth.
Forrester Consulting's new Total Economic Impact™ (TEI) study of Okta's identity security fabric found that a composite organization built from six real customer interviews achieved a 216% return on investment, a less-than-six-month payback period, and a 90% reduction in the likelihood of an identity-related breach over three years.
The study's composite organization is a $3 billion, 9,000-employee, industry-agnostic enterprise—not a hospital system or payer specifically—so the exact dollar figures won't map one-to-one onto any single healthcare organization. But the shape of the findings—where the risk concentrates, where the time savings come from, and how fast an identity investment pays for itself—translates directly to how provider, payer, and pharma organizations operate.
Here's what the study found and what it means when the identities in question belong to clinicians, claims adjusters, patients, and a fast-growing population of AI agents that handle protected health information (PHI).
Key financial and operations findings (three-year composite)
| Metric | Forrester TEI result | Healthcare impact (PHI and care delivery) |
|---|---|---|
| ROI | 216% | Offsets high-cost breach exposures |
| Payback period | <6 months | Accelerates time-to-value across complex clinical infrastructures |
| Breach likelihood | 90% reduction | Prevents unauthorized credential access to EHRs, lab data, and portals |
| Incident response | 90% faster ($11 million present value) | Stops lateral movement across connected care systems in real time |
| Access certification effort | 90% administrative drop | Simplifies recurring HIPAA Security Rule and OCR audit compliance |
| Tool consolidation | $2.4 million saved; 4% SaaS waste cut | Shrinks vendor footprints and required business associate agreements |
How identity security mitigates PHI breach risks
The TEI study found that centralizing identity security—real-time threat detection, continuous posture management, and phishing-resistant authentication working together instead of as disconnected point tools—reduced the composite organization's likelihood of an identity-related breach by 90%, driven by the finding that 60% of all breaches in the model were identity-based to begin with:
- Stops lateral EHR compromise: In a healthcare environment, risk reduction isn't just a cost-avoidance exercise. A compromised credential at a health system doesn't just risk financial loss; it risks direct access to electronic health records (EHRs), lab results, and care-coordination systems. For a payer, it risks claims and eligibility data tied to millions of members.
- Reduces reportable incidents: A breach triggers HIPAA breach notification obligations, OCR reporting, and the kind of patient-trust damage that doesn't show up on a balance sheet the way remediation costs do.
- Eliminates blast radius: The study's interviewees described phishing-resistant multi-factor authentication (MFA) and real-time threat detection as the controls that mattered most here—the same controls that stand between a stolen clinician or claims-adjuster credential and a reportable breach.
Why faster containment drives the largest cost savings
The single largest benefit in the TEI study—a three-year present value of $11 million, by far the biggest line item in the model—came from reducing the mean time to remediate (MTTR) identity-related incidents by 90%, cutting response time from hours to effectively real time:
- Automated incident containment: The study's interviewees described how identity incidents—brute-force attempts, suspicious session activity, credential exposure—that once took hours to investigate and contain are now resolved automatically, often before they ever reach an employee or disrupt a workflow.
- Preventing cross-system cascades: Healthcare's identity environments are exactly the kind of interconnected, high-stakes systems where that speed compounds. A health system's EHR connects to lab systems, imaging, referral networks, and billing systems; a payer's claims platform connects to provider portals, eligibility systems, and third-party administrators. In a care-delivery setting, that's the difference between an identity incident staying contained to a single system and one that cascades across every connected application a compromised session can reach.
Consolidation reduces the number of systems holding PHI—and the number of vendor agreements that come with them
The study found $2.4 million in three-year savings from consolidating legacy point solutions and reclaiming unused software licenses—a 4% reduction in SaaS waste plus a two-thirds cut in the staff needed to administer fragmented identity tooling.
For healthcare organizations, every point solution in an identity stack is also a system that may handle PHI, and often a business associate agreement that must be tracked, reviewed, and audited. Consolidating onto a single identity layer doesn't just save license fees—it shrinks the number of systems in scope for a HIPAA risk assessment and the number of vendor relationships a compliance team has to monitor. The study's interviewees also pointed to faster, less manual access certification campaigns (a 90% reduction in administrative effort) as a meaningful win—directly relevant to any provider or payer running recurring access reviews to satisfy HIPAA Security Rule or payer compliance requirements.
How identity governance helps solve AI agent risk
This is arguably the most urgent finding for healthcare specifically. AI scribes documenting patient encounters, clinical decision-support tools, and automated prior-authorization or claims-processing agents are already operating with standing access to PHI and claims data—often provisioned the same way a new employee's laptop would be, with far less oversight. Among the study's qualitative benefits, interviewees pointed to improved visibility into AI agents and "shadow AI" as a foundational, if still-emerging, source of value:
- Agent sprawl and real-time revocation: Centralized identity controls made it possible to see which AI tools were connecting to enterprise systems and to revoke access in near-real time when something looked wrong.
- Preemptive identity guardrails: The study's interviewees were candid that most organizations are only beginning to address AI governance, with one noting it's "much easier to establish the right security controls at the beginning than it is to go back later and try to find and govern all of these AI agents." For healthcare organizations layering AI into clinical and administrative workflows faster than their governance processes can keep up, that's not a future problem—it's a current one.
Where identity security delivers the biggest impact for providers, payers, and pharma
- Healthcare providers: The MTTR and breach-risk findings map most directly onto EHR and clinical system access. A health system's biggest exposure is the sheer number of connected systems a single compromised clinician or staff credential can reach—faster containment and consistent policy enforcement across that network is where the study's largest benefit (faster incident response) has the most leverage.
- Payers and health plans: The findings on legacy consolidation and access governance are most relevant here. Payers run frequent, large-scale access certification cycles across claims, eligibility, and provider-portal systems to satisfy compliance obligations—the study's 90% reduction in access review administrative effort speaks directly to that recurring operational burden.
- Pharma and life sciences: The AI agent governance findings carry the most weight. As life sciences organizations adopt AI across clinical trial operations, R&D, and commercial workflows, the study's recommendation to establish identity guardrails "at the beginning" rather than retrofitting them later is a direct warning for any pharma organization scaling AI agents without a governance layer already in place.
Moving from fragmented identity risk to consolidated resilience
Forrester's study wasn't built on healthcare data, and healthcare organizations shouldn't treat its dollar figures as a literal benchmark. But the pattern it surfaces—breach risk concentrated in identity, incident response speed as the single biggest value driver, and AI agent governance as the most urgent unaddressed gap—maps closely onto what provider, payer, and pharma security leaders are already telling us they're worried about.
The question worth asking isn't whether the exact numbers would hold for your organization; it's whether your identity environment looks more like the fragmented "before" state the study describes, or the consolidated "after."
Read the full Forrester TEI study to see the complete benefit, cost, and risk breakdown.
These materials are intended for general informational purposes only and are not intended to be legal, privacy, security, compliance, or business advice. © 2026 Okta, Inc. and/or its affiliates.
