clinicians working in a hospital
/content/eds-citrix/blogs/authors/cletis-earle
Cletis Earle
2026-11-10T00:00:00.000Z
eds-citrix:topics/supply-chain,eds-citrix:topics/healthcare,eds-citrix:topics/security-compliance,eds-citrix:topics/zero-trust,eds-citrix:products/citrix-platform

The hidden risk in healthcare: managing secure third-party application access

Healthcare organizations invest enormous time and effort securing patient records, clinical systems, and connected medical devices. Yet one of the fastest-growing sources of cyber risk now sits outside the hospital walls: the extended ecosystem of suppliers, manufacturers, consultants, and service providers who help keep care delivery running.

Medical device manufacturers monitor inventory levels for critical implants. Pharmaceutical suppliers coordinate replenishment of high-demand medications. Group Purchasing Organizations (GPOs) help optimize contracts and costs. These external partners need access to the business applications healthcare organizations rely on every day. That access keeps operations moving, but it also creates a growing security challenge.

Healthcare data breaches cost an average of $7.42 million per incident, the highest of any industry, and organizations take an average of 279 days to identify and contain an attack. As hospitals extend application access to medical device manufacturers, pharmaceutical suppliers, and procurement partners, securing third-party access is a critical component of both cybersecurity and supply chain resilience.

For healthcare leaders, the question is no longer whether suppliers need digital access. It is how to provide that access without exposing the broader organization to unnecessary risk.

Healthcare's extended care team is bigger than ever

Healthcare delivery depends on what could be called the "extended care team."

This team can include:

While these groups may never interact directly with patients, their work directly impacts patient care.

A delayed implant shipment can postpone surgery. A medication shortage can disrupt treatment plans. Missing inventory data can create costly inefficiencies across the organization. Today, material shortages are the leading medical supply chain concern, cited by 46% of respondents in a symplr 2026 survey.

Healthcare organizations face a difficult balancing act. They must provide frictionless access to the applications these stakeholders need while maintaining strict security controls.

VPNs weren’t built for clinical trust

Modern healthcare supply chains operate on real-time information.

A medical device supplier cannot effectively replenish inventory if they cannot see consumption trends. A pharmaceutical distributor cannot proactively prevent shortages without visibility into demand patterns. Procurement teams cannot optimize spending without coordinating across multiple systems and stakeholders.

To solve these challenges, healthcare organizations increasingly rely on specialized procurement, inventory, workforce, and ERP applications, including platforms such as Vizient, symplr, GHX, Workday, and Coupa. These platforms help hospitals manage everything from sourcing and purchasing to inventory optimization and supplier performance.

The challenge is that many external users need access to these applications but should never have access to the entire hospital network.

Historically, organizations often solved this problem through VPNs or other forms of network-level access. While effective for connectivity, these approaches create more exposure than necessary. A supplier may only need one inventory, procurement, or ERP application, but a VPN can extend trust to the broader hospital network. Once connected, users can gain visibility into systems and resources far beyond what their role requires including patient records. If credentials are compromised or vendor access is not removed quickly, that broad connectivity can increase the risk of lateral movement and make third-party access harder to govern.

That model is no longer acceptable with today's threat landscape.

Why zero trust changes the conversation

The traditional security question was:

"How do we give external users access to our network?"

The zero trust question is fundamentally different:

"What specific application does this person need to access?"

That shift is significant.

Instead of extending network access, organizations can provide application-level access. Suppliers have permissions for only the applications required for their role. Consultants see only the systems relevant to their projects. Remote workers gain secure access to approved resources without exposing broader infrastructure.

This principle of least-privilege access reduces risk while improving operational flexibility.

Healthcare organizations can onboard suppliers faster, support distributed workforces more effectively, and respond more quickly to supply chain disruptions without expanding their attack surface.

The result is both stronger security and greater operational resilience.

Application access matters more than network access

A manufacturer may require visibility into inventory levels within a platform such as GHX, Vizient, or an ERP application. They do not need access to clinical systems, EHR environments, file shares, or internal network resources.

Similarly, a procurement consultant working on spend optimization may need access to Workday, Coupa, or symplr. They do not need unrestricted access to the organization's broader IT environment.

This is where application-centric security becomes valuable.

By delivering applications securely rather than extending network connectivity, healthcare organizations can provide access based on:

Access becomes tightly aligned with business need instead of expansive network permissions.

Secure application delivery for the extended healthcare ecosystem

Citrix helps healthcare organizations deliver secure access to the applications that suppliers, consultants, contractors, and remote workers need without exposing broader corporate resources.

Rather than providing unrestricted network access, healthcare organizations can use Citrix Desktop as a Service (DaaS) or Citrix SecurAccess with Chrome Enterprise to securely deliver procurement, ERP, and inventory management applications to suppliers, consultants, and remote workers. With Citrix Platform Flex, organizations gain additional agility to scale secure application access up or down as supplier relationships, mergers, staffing requirements, and care delivery models change.  Citrix Platform Credits provides the consumption-based licensing model for Citrix Platform Flex. It helps align costs with the needs of different personas, making it easier to match access, governance, and cost models to how third parties actually work.

With Citrix’s support for zero trust principles, organizations can:

This approach is particularly valuable during periods of disruption, when healthcare organizations may need to rapidly onboard new suppliers, adjust vendor relationships, or expand remote access requirements.

Organizations need to provide suppliers, contractors, and other third parties with permissions to critical applications and data. Application-level access and centralized governance help reduce third-party risk while maintaining business continuity.

Cyber resilience is now supply chain resilience

For years, healthcare leaders viewed cybersecurity and supply chain operations as separate disciplines. That distinction is disappearing.

Every supplier connection, inventory portal, procurement platform, and third-party integration represents both an operational dependency and a potential security risk. Organizations that continue relying on broad network access models will increasingly struggle to balance collaboration with security. Embracing application-centric zero trust delivers secure access for the extended care team without exposing the broader organization.

If a system is breached, DaaS helps hospitals recover quickly by keeping work decoupled from any single location, device, or network. When Atlantic Health System faced a major cyber incident during the CrowdStrike disruption, it maintained secure access for more than 15,000 users and recovered operations rapidly, showing how application delivery can support continuity even when the broader environment is under pressure.

Because in modern healthcare, supply chain resilience is no longer measured solely by whether medical supplies arrive on time. It’s also measured by whether the people, partners, and suppliers who keep healthcare running can reach the applications they need while the rest of the environment remains protected.

Explore how Citrix helps healthcare organizations deliver secure application access while supporting continuity of care at Citrix healthcare solutions.