SMS-based one-time passcodes have always been a compromise. Clinicians and patients accept them because they’re familiar, but security researchers have spent years documenting how easily they can be intercepted, SIM-swapped, or simply lost in a delayed message. Nokia’s Network as Code platform is now being used to replace them entirely in BeeHealthy, a software platform that healthcare providers use to deliver services across Europe and the Middle East. It’s a small integration with a pointed implication: the telecom stack itself can become a security layer, not just a pipe.

What the integration actually does

Rather than sending a six-digit code over SMS, the Network as Code platform authenticates users through network-level signals that are invisible to the end user. The process happens in the background, tied to the SIM identity at the operator level. For a clinician logging into a patient record system or a patient accessing telehealth services, the experience is simply faster and less interrupted. The friction that comes with waiting for a code, typing it in, and hoping the message arrived on time is gone.

BeeHealthy operates across multiple countries, which means its authentication problem is not a simple one. Different regulatory environments, different operator relationships, different device types. Solving that at scale, without asking users to change behavior, is genuinely hard. That’s where the marketplace model behind Network as Code becomes relevant.

Why telecom operators should pay attention

Nokia has been building Network as Code as a way for mobile operators to expose their network capabilities through standardized APIs, so that enterprises can build on top of them. Authentication is one of the cleaner use cases because the business logic is straightforward: operators already hold verified identity data at the SIM level, and enterprises need exactly that kind of verified identity to meet security and compliance requirements.

This BeeHealthy collaboration is being positioned as a monetizable enterprise use case for operators. That framing matters. Operators have struggled to articulate a business case for exposing network APIs beyond connectivity itself. Healthcare authentication, particularly in regulated environments where the cost of a breach is high, gives them a vertical where their infrastructure has genuine differentiation over a software-only solution.

The clinical and compliance angle

Healthcare is an obvious fit for this kind of integration. Regulations like GDPR and national eHealth frameworks across Europe increasingly demand strong authentication for systems that handle patient data. SMS OTPs technically satisfy multi-factor authentication requirements, but they do so weakly. Network-level authentication, tied to a verified operator identity, is harder to spoof and easier to audit.

For health IT teams, the compliance argument may be more persuasive than the user experience one. But both are real. Clinicians who access patient platforms dozens of times a day feel authentication friction acutely. Reducing that friction without reducing security is a trade-off that usually doesn’t exist. Here, it does.

What this signals for health tech more broadly

The interesting question isn’t whether this specific integration succeeds. It’s whether it represents a pattern. Telecom infrastructure has largely sat beneath the health tech stack, unnoticed except when connectivity fails. If network APIs can be used to solve problems like authentication, location verification, or device integrity checking, operators become more than connectivity providers in healthcare. They become part of the security architecture. That’s a different conversation, and it’s one that health entrepreneurs and CISOs in provider organizations should probably be having now.