Shared devices are endpoints used by multiple people in the same operating environment, common in healthcare settings. They create authentication challenges because users need quick access without weakening accountability or privacy. Passwordless methods can help, but only when they are designed to work cleanly across shift changes and clinical handoffs.
What Shared Devices Are in Practice
Shared devices are not just “shared laptops” in a loose sense, they are operational endpoints that many people use across shifts, roles, or handoffs. The security question is how to let each person get fast access without turning the device into a weak point for accountability, privacy, or access control.
In healthcare, the term usually points to clinical workstations, bedside terminals, carts, and kiosks where speed matters and users rotate constantly. That operating model changes the authentication design problem: the device must support rapid re-entry, but the security posture cannot collapse into one common login for everyone.
Why Shared Devices Are Different from Single-User Endpoints
A single-user endpoint can often rely on stable login state, long sessions, and user-specific local settings. A shared device cannot safely assume that the next user is the same person, or even in the same role, so session boundaries, logout behavior, and re-authentication become part of the core design.
This matters because the device itself is not the only asset. The real exposure is the mix of identities, records, applications, and permissions that move through it during a shift. If one session leaks into the next, the endpoint becomes a handoff problem rather than a normal workstation.
Shared devices also create a usability tension. If controls are too strict, staff work around them. If controls are too loose, the device can expose records, permit unintended access, or make it difficult to prove who performed an action.
Authentication, Accountability, and Privacy on Shared Devices
Authentication on shared devices has to support fast user switching, short-lived access state, and clear attribution. A device that stays unlocked, caches the wrong session, or makes re-authentication cumbersome can blur who accessed what and when.
That is why passwordless and proximity-based methods can be attractive in these environments, but only when they preserve strong user binding and do not create cross-user session leakage. A method that is elegant on a personal laptop may fail on a shared terminal if it cannot recover cleanly after a badge handoff or an interrupted clinical workflow.
Privacy is equally important. Shared devices often display sensitive information in public or semi-public spaces, so screen locking, session timeout, and profile separation are not just convenience features. They are part of preventing accidental disclosure to the next user, nearby staff, or patients.
Operational Patterns That Make Shared Devices Safe
The safest shared-device model treats login, session cleanup, and handoff as one continuous workflow. The user experience should make it easy to end one session completely before the next begins, because partial logout is often worse than no logout at all.
Strong device governance also depends on consistent baseline hardening. A shared endpoint should present as a controlled access surface, not a general-purpose workstation with lingering browser state, reusable credentials, or unmanaged local data. For baseline hardening approaches, CIS Benchmarks provide a practical reference for securing endpoint configurations.
Where shared devices are used to reach protected systems or sensitive APIs, the authentication design should favour mechanisms that reduce secret reuse and improve user attribution. The IETF’s RFC 7523: JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants is a useful example of how signed assertions can replace shared secret in some authentication flows.
Risk and Threat Considerations
Shared devices concentrate access into a small number of endpoints, so one weak session, one forgotten unlock, or one stale login state can expose multiple users and multiple records. The biggest risks are unauthorized viewing, mistaken attribution, and privacy leakage during rapid handoffs.
Failure mechanism: The device retains user state too long, reuses cached credentials, or fails to force a clean boundary between users, allowing the next person to inherit access or see prior activity.
Impact: Sensitive information can be disclosed, actions can be misattributed, and attackers or insiders can exploit an already-authenticated session instead of bypassing authentication directly.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 provides the primary governance reference for this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Shared devices depend on strong user authentication for each rotating user. |
| IA-5 — Authenticator Management | Shared-device workflows depend on credential lifecycle and controlled authenticator handling. | |
| AC-12 — Session Termination | Shared devices need clean logout and session closure between users. | |
| Recommendation — Require each shared-device user to authenticate before access is granted. Manage authenticators so shared-device access does not rely on reusable secrets. Terminate sessions promptly when a shared-device user ends their work. | ||
Related resources from NHI Mgmt Group
- What breaks when shared clinical devices are not tied to clear ownership?
- How should security teams handle authentication for shared retail devices?
- Why do shared clinical devices create problems for standard IAM controls?
- How should security teams govern access on shared devices in manufacturing environments?
