Zero Trust Architecture in Healthcare: A Systematic Mapping Study

Abstract

Healthcare systems are increasingly digitized, expanding the attack surface and exposing sensitive medical data to growing cyber threats. Traditional perimeter-based security models were designed for static, bounded networks and are no longer adequate in environments where medical devices, cloud platforms, and remote access have dissolved the concept of a fixed perimeter. Zero Trust Architecture (ZTA) has emerged as an architectural response to these challenges, yet its application within the healthcare domain remains understudied and lacks systematic synthesis. This paper presents a Systematic Mapping Study (SMS) conducted across four major scientific databases covering literature published between 2016 and 2026, from which 10 peer-reviewed studies published between 2020 and 2025 were selected for analysis. The study is organized around four research questions addressing publication trends, study types, application domains, and proposed solution types. The findings show a clear growth in research activity from 2023 onward, a dominance of experimental and conceptual contributions with no case studies identified, a concentration of work on hospital systems and networks, and a significant underrepresentation of Internet of Medical Things (IoMT) and Electronic Health Records (EHR)-focused research. Framework-based proposals are the most prevalent solution type, with few validated architectures or empirically evaluated deployments reported. These results highlight a field still in its formative stage and identify empirical validation, IoMT-specific modeling, and real-world deployment studies as the most critical directions for future research.