Multifactor authentication in healthcare still fails on workflow friction

At a glance

What this is: NHI Mgmt Group's analysis, drawing on OLOID's blog post: Healthcare MFA breaks down when clinical workflow, device constraints and recovery paths are not designed into the authentication model.

Why it matters: This matters because identity teams in healthcare have to balance strong authentication with clinical speed, auditability and emergency access without driving users toward insecure exceptions.

By the numbers:

• Hacking and IT incidents accounted for more than 80% of large healthcare breaches on the HHS breach portal in 2025, according to HIPAA Journal’s analysis of OCR data cited by OLOID.
• Business associates were involved in 127 of the 345 breaches reported to OCR by mid-2025, according to GovInfoSecurity cited by OLOID.

Context

Healthcare authentication is not just an access-control problem. It is a governance problem where the control has to work across shared terminals, constrained devices, emergency access and regulated workflows without breaking attribution.

The baseline assumption behind generic MFA is one user, one device, one stable session. In clinical environments that assumption fails quickly, so identity teams have to govern authentication as part of workforce identity design rather than as a bolt-on control.

Key questions

Q: How do I tell whether a login flow is really multifactor authentication?

A: A login flow is really multifactor authentication only when it requires two or more different categories of proof, such as something you know, something you have, or something you are. If the flow reuses the same category twice, such as two passwords or two knowledge-based questions, it is not MFA. A true MFA design also binds the second factor to the session or device.

Q: How should healthcare teams handle MFA on shared workstations?

A: Healthcare teams should use MFA in a way that matches shared workstation controls, so the person authenticates individually and the session is not left open for the next user. Fast user switching, separate accounts, session timeout, and badge or token-based sign-in help prevent credential sharing and patient record exposure. Shared logins should be avoided because MFA loses meaning when identity is not individual.

Q: Why do phishing-resistant authenticators matter more for remote work environments?

A: Phishing-resistant authenticators matter because remote work expands exposure to credential theft, spoofed login pages, and email-driven attacks. When authentication relies on secrets that can be copied or replayed, attackers gain a path into government and enterprise systems. Public key based authenticators reduce that risk by binding access to a cryptographic factor that is much harder to steal and reuse.

Q: What should teams do first when emergency access is needed in a hospital?

A: The first step is to use break-glass credentials under a documented emergency process with immediate audit logging and post-use review. Access should be limited to the smallest necessary scope, tied to a named accountable user where possible, and revoked or reset as soon as normal access is restored. That keeps emergency privilege usable without becoming standing access.

Technical breakdown

Why password plus PIN is not multifactor authentication

MFA only qualifies when the factors come from separate categories, such as knowledge plus possession or possession plus inherence. A password and PIN are both knowledge factors, so they remain single-factor authentication even if they produce two prompts. In healthcare, that distinction matters because auditors assess the factor types, not the number of steps in the login flow. The real design question is whether the authentication mechanism produces independent assurance, not whether it feels cumbersome or strong to the user. See the MFA Guide.

Practical implication: Validate every healthcare login flow against factor-category independence before calling it MFA.

Shared workstations and clinical floors change the authentication model

Shared nursing stations, workstations on wheels and medication carts create fast user-switching pressure that traditional office MFA rarely faces. If the control is slow, clinicians will keep sessions open, share logins or bypass the intended workflow. That is why shared-device environments need authentication that preserves individual attribution while allowing frequent handoffs. The control objective is not just sign-in strength. It is per-person session integrity across devices that are reused many times in a shift. See the Workforce Identity Security Guide.

Practical implication: Design shared-device authentication around fast user switching, session locking and individual attribution.

Phishing resistance is uneven across common MFA methods

Not all MFA methods resist interception or relay. SMS codes can be intercepted or redirected, push approvals can be exhausted through fatigue, and weak recovery flows can undermine otherwise strong factors. Phishing-resistant methods such as FIDO2 security keys, passkeys and certificate-based smart cards bind the authentication event to the legitimate site or device. In healthcare, that matters most for remote access, email and privileged accounts where credential theft creates the highest blast radius. See the Passwordless and Passkeys Guide.

Practical implication: Reserve phishing-resistant factors for remote and privileged access, then measure where weaker methods still remain.

Threat narrative

Attacker objective: The attacker’s objective was to gain trusted remote access that could be used to disrupt and exploit healthcare operations at scale.

1. Entry occurred through stolen credentials used against a remote access portal that had no multifactor authentication.
2. The absence of MFA let the attacker authenticate as a legitimate user rather than forcing a second verification step.
3. From that foothold, the attacker could access systems linked to claims, pharmacy and clinical operations at scale.
4. Impact followed when the healthcare workflow was disrupted across claims and pharmacy payment operations for weeks.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Healthcare MFA is a workflow governance problem before it is a factor-selection problem. The sector’s hardest failures happen when authentication design ignores how clinicians actually move between shared devices, phone-restricted units and emergency contexts. That means the control has to be evaluated against work patterns, not only against policy wording. For practitioners, the real question is whether the programme can preserve individual accountability without creating routine bypasses.

Shared-device environments expose the weakest assumption in generic MFA programmes. Office-style authentication assumes one person can own one session for long enough that the control remains usable. In wards and pharmacies, sessions are handed off constantly, so weak attribution or slow login flows push people toward shared accounts. The implication is that healthcare identity governance must treat device-sharing as a core design constraint, not an exception.

Break-glass access is the clearest test of whether a healthcare authentication programme is actually governed. If emergency access can be activated without expiry, review and monitoring, then the programme has created an uncontrolled side channel. That is a governance failure, not merely a technical gap. The practical conclusion is that clinical urgency must be bounded by explicit identity lifecycle rules.

Password-plus-PIN is the classic false comfort in healthcare authentication. The control looks stronger on paper while still relying on a single knowledge category. That matters because audit, incident response and insurer scrutiny all care about the assurance property, not the prompt count. Practitioners should stop measuring MFA by user friction alone and measure whether each factor adds independent proof.

Vendor and contractor access needs the same authentication discipline as staff access. Healthcare environments extend trust to business associates, locum staff and support providers, which widens the identity boundary beyond employees. The stronger pattern is to treat third-party access as time-boxed and individually attributable, with the same review discipline applied to privileged and remote sessions. That is the baseline for reducing inherited risk.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Clinical authentication has to move from factor count to workflow assurance. Healthcare programmes cannot treat MFA as a checkbox if the control collapses under shared devices, PPE and emergency care. The programme design question is whether each access path can preserve attribution without forcing unsafe workarounds.

Break-glass governance is a lifecycle control, not an exception-handling footnote. If emergency credentials exist, they must be created, time-bounded, monitored and retired like any other privileged identity. Otherwise the emergency path becomes a shadow access channel that will outlive its original purpose.

Frontline recovery is part of identity security. When staff lack corporate email or a personal phone, enrolment and reset processes determine whether the organisation can actually deploy strong authentication. Poor recovery design pushes people toward shared access and undermines the whole programme.

For practitioners

• Define MFA by factor-category independence Review every healthcare login path to confirm that two categories are present, not just two prompts. A password plus PIN still fails the MFA test because both are knowledge factors. See the MFA Guide.
• Prioritise remote and privileged access first Deploy strong authentication first where stolen credentials create the biggest blast radius, especially remote access portals, email and admin consoles.
• Engineer for shared-device sign-in Use authentication patterns that support rapid user switching, session locking and per-person attribution on workstations on wheels and shared nursing stations.
• Time-box emergency access accounts Predefine who can use break-glass credentials, set explicit expiry, and require post-use review after every emergency session.
• Test recovery for frontline staff Validate supervised enrollment and recovery paths for staff who do not have company email or a personal phone available during a shift.

Key takeaways

• Healthcare MFA often fails when the control is designed for office users rather than shared clinical workstations and time-critical care.
• The article’s examples show that factor choice, recovery paths and break-glass design all affect whether authentication preserves unique user identity.
• The strongest healthcare deployments tie remote and privileged access to phishing-resistant methods while keeping emergency access bounded and reviewable.

Related NHI Mgmt Group resources: Workforce Identity Security Guide · Passwordless and Passkeys Guide · MFA Guide · Uber breach 2022

Key terms

• Multi-Factor Authentication: Multi-factor authentication requires two or more independent verification factors before access is granted. In practice, it reduces the chance that a stolen password alone will open a system, but it only works well when applied consistently across all high-risk access paths and identity types.
• Break-glass Access: Break-glass access is an emergency path that bypasses normal access controls when standard authentication fails or a critical incident demands immediate intervention. It must be tightly time-bound, logged, and reviewed, because it exists to restore operations without becoming a permanent back door.
• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Shared Workstation: A shared workstation is a computer used by more than one person, often in shifts or in common work areas. In identity security, it creates higher risk because sessions, cached credentials, and local access can cross users, so controls such as strong authentication, session isolation, and automatic logout are needed.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.