The Badge That Opens Too Many Doors

Both extremes are wrong for this timeline. A full RBAC redesign across 4,200 badges, 1,800 staff, and three sensitive areas is a 9–18 month program; attempting it in four months produces a half-migrated system with more orphaned profiles, not fewer. Deferral leaves a known 38% over-entitlement rate in a hospital facing a survey and a live patient-safety exposure.

Recommend a risk-tiered remediation that decouples the sensitive areas from the general redesign:

1. Immediate (weeks 1–4): Pull pharmacy, data center, and morgue out of the shared clinical access group and into dedicated groups with explicit, named authorization. This is a configuration change on existing hardware, not a re-badge event, so it does not trigger the 20-minute onboarding objection.
2. Weeks 2–8: Run an automated reconciliation of every badge against HR/contractor records to flag orphans and transfers. Revoke or downgrade the flagrant cases; this is data cleanup, not re-badging.
3. Weeks 8–16: Fix the process that created the problem - require revocation of the prior profile as a step in the transfer workflow - so the leak stops refilling while the redesign proceeds.
4. Post-survey: Execute the full RBAC redesign on a realistic schedule.

This respects the CISO's goal, the facilities director's budget reality, and nursing's operational constraint, while closing the highest-consequence gaps before the survey.

It redirects the solution from credential replacement to entitlement correction. Re-badging is a physical/logistics act; correcting entitlements is a database act. Most of the over-entitlement can be fixed without touching a single badge in a nurse's pocket.

The technical design implication: separate identity (the badge number and holder) from authorization (what the badge opens). If the access control system ties entitlements to the badge rather than to the person's role record, then any transfer requires re-issuance - which is exactly the trap the hospital is in. The fix is to key entitlements to an HR-sourced role attribute and push updates automatically, so a transfer changes access without changing the badge.

Where physical re-badging is unavoidable - for the small population holding pharmacy/data center/morgue access - scope it to that population only, schedule it in batches during low-census periods, and pre-stage the new badges so the swap takes under two minutes. That converts a 20-minute onboarding delay into a targeted, scheduled event affecting a fraction of staff.

The lesson: a stated operational constraint is often a signal that the architecture is wrong, not that the control must be abandoned.

Document the decision and its rationale, not just the completed work. Surveyors and, later, plaintiffs ask not only 'what did you find' but 'what did you do about it, and why did you choose that?'

The record should contain:

• The audit methodology and findings (200-badge sample, 38% over-entitlement), stated as a measured fact with its sampling limitation.
• A risk ranking of the affected areas - pharmacy, data center, morgue - with the clinical, privacy, and regulatory consequences of unauthorized access to each.
• The options considered (full RBAC, deferral, tiered remediation) and the explicit reasoning for the chosen path, including the timeline and staffing constraints that drove it.
• Interim compensating controls in place while the full redesign is pending (reconciliation cadence, supervisor spot checks, sensitive-area group separation).
• Ownership and dates for each remaining action.

Why it matters: a documented, reasoned, risk-tiered response demonstrates a functioning security program even where remediation is incomplete. An undocumented deferral looks like neglect. The documentation is also the artifact that protects the organization if an incident occurs before the redesign finishes - it shows the risk was identified, assessed, and actively managed rather than ignored.