Passwordless authentication in healthcare is now an identity problem

At a glance

What this is: Imprivata’s research argues that password dependence in healthcare is now both a security and workflow problem, with leaders reporting breach risk, risky workarounds, and strong interest in passwordless access.

Why it matters: IAM, PAM, and healthcare identity teams need to treat authentication design as an operational control, because password friction now drives both attack exposure and care disruption.

By the numbers:

• 46% reported risky password-related workarounds occurring in daily operations.
• 85% of healthcare IT and security leaders say passwordless authentication is very important or mission-critical.
• Only 7% have fully adopted passwordless access across their organizations.

Context

Passwordless authentication in healthcare is best understood as an identity governance problem, not just a user-experience upgrade. When clinicians move across shared workstations, remote access, and multiple applications, the authentication model has to balance security, attribution, and continuity of care at the same time.

Imprivata’s latest survey of more than 200 healthcare IT and security leaders shows that password dependence still shapes both risk and operations. The article’s core claim is that passwords are no longer a reliable control in healthcare because they create phishing exposure, reset dependency, and workflow workarounds that organizations then have to govern.

The practical issue is not whether healthcare should move away from passwords in theory. It is whether current identity controls can support fast, shared, high-pressure clinical workflows without pushing users into insecure exceptions.

Key questions

Q: Where do password-based access controls fail in healthcare environments?

A: They fail where speed, shared devices, and operational pressure force users into resets, overrides, or credential sharing. In those conditions, passwords stop acting like a control and start acting like a bottleneck that people work around. The result is higher exposure, weaker attribution, and more support-mediated access decisions that attackers can target.

Q: Why do help desk recovery workflows increase identity risk?

A: Help desk recovery workflows often rely on procedural checks that are easier to socially engineer than cryptographic factors are to steal. If an attacker can convince support to reset MFA, issue a temporary code, or enroll a new authenticator, the recovery process becomes an attack path. Identity assurance must extend to recovery actions themselves.

Q: What are the signs that password controls are failing in day to day use?

A: Common warning signs include frequent password resets, repeated purchase abandonment, password reuse across services, and people sharing credentials with family, colleagues, or friends. Another signal is the continued use of weak or written down passwords despite policy reminders. These behaviours show that the control is not aligned with how users actually work.

Q: Should healthcare teams prioritise passwordless access or better reset processes?

A: Passwordless access should come first when reset volume is driven by the credential model itself. Better reset processes reduce friction, but they do not remove the underlying dependence on passwords. If the goal is to reduce both support load and recovery risk, passwordless changes the problem at its source.

Technical breakdown

Why password-reliant healthcare access becomes phishable

Passwords remain attractive to attackers because they are reusable shared secrets that can be stolen, replayed, reset, or socially engineered. In healthcare, the problem is amplified by shared workstations, urgent access needs, and multiple authentication vendors that add complexity without removing the password from the flow. MFA helps, but if recovery, overrides, and fallback paths still depend on passwords, attackers can shift to those weaker paths instead of attacking the primary login directly.

Practical implication: map every password fallback path, not just the primary sign-in flow, because attackers often target the recovery layer first.

How password resets expand the attack surface in clinical operations

Reset and recovery workflows turn authentication failure into a service desk event, which creates both operational drag and a social-engineering target. When users cannot get in quickly, support teams are pressured to verify identity under time constraints, and that verification often becomes weaker than the original login control. In healthcare, those pressures are intensified by shift work, patient care urgency, and staff shortages. The result is an identity control that leaks risk from the front end into operations.

Practical implication: treat help desk reset and recovery processes as high-risk authentication surfaces, not back-office admin tasks.

Why passwordless changes attribution and auditability

Passwordless access is not just about removing a secret. It changes how organizations establish who did what, when, and from which context. Password-based workarounds such as credential sharing, session reuse, and repeated resets weaken attribution and make audit trails less reliable. In regulated environments, that matters because identity events should remain traceable even when access must be fast. The governance question becomes whether the identity system can preserve accountability without slowing care delivery.

Practical implication: tie passwordless rollout to audit trail integrity and shared-workstation governance, not only to login speed.

Threat narrative

Attacker objective: The attacker aims to obtain reliable authenticated access that can be reused across healthcare systems, support workflows, or clinical sessions.

1. Entry begins with phishing, password theft, or manipulation of password recovery workflows in a healthcare environment where passwords still anchor access.
2. Escalation happens when attackers exploit MFA prompts, reset processes, or help desk pressure to move from initial compromise into a usable authenticated session.
3. Impact follows through credential misuse, workflow disruption, and exposure of clinical and enterprise systems that depend on the compromised identity path.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Password dependence is now an identity governance failure, not a user training gap. Healthcare organizations have already invested in awareness, MFA, and policy enforcement, yet the article shows that password-centred access still produces breach risk and operational friction. That means the weak point is no longer user knowledge alone. The governance problem is the continued reliance on shared secrets as the primary control for environments that need fast, shared, high-trust access.

Reset and recovery workflows are the real control boundary. Once users cannot authenticate cleanly, the system moves into human verification, override, and support-mediated recovery. That is where attackers focus because those steps inherit urgency, staffing pressure, and inconsistent verification. The implication for practitioners is that password risk must be managed as a lifecycle and workflow issue, not only as an authentication method issue.

Passwordless in healthcare is a clinical continuity control as much as a security control. The article makes clear that authentication failures are affecting patient care, staffing efficiency, and auditability at the same time. That creates a cross-domain identity problem spanning human access, workstation use, and governance evidence. Healthcare programmes that treat login design as separate from care delivery are now carrying avoidable operational and compliance debt.

Shared workstations expose the identity blast radius of password-based access. In fast-moving care settings, one secret often becomes the easiest way to keep multiple people moving through the same devices and apps. That creates a visible boundary problem: the identity being used is not always the identity performing the work. The concept to watch is identity blast radius, because every workaround extends how far one compromised or shared credential can travel.

Passwordless adoption is validating a broader shift in how healthcare should govern access. The article shows strong leadership support for passwordless, but low full adoption, which suggests the market is still in transition rather than finished. For identity teams, the practical conclusion is that access design has to be evaluated against care workflows, shared-device realities, and evidence quality at the same time, not as separate projects.

From our research library:

• 60% of healthcare organisations do not assess a vendor's security before signing a contract that grants access to protected health information, according to Ponemon Institute's 2023 Third-Party Risk in Healthcare report.

What this signals

Identity controls in healthcare have to be judged against workflow reality. Shared workstations, shift-based care, and high interruption rates mean that an authentication method is only effective if it still works when clinicians are under pressure. Passwordless planning should therefore be tied to care continuity, not just to security architecture.

Identity blast radius is the right lens for clinical access. When one shared secret can unlock multiple systems, the impact of a single compromise expands quickly across care, support, and administration. Healthcare teams should focus on reducing the number of places where the same credential can be reused or recovered.

Passwordless adoption is only useful if attribution survives the transition. Faster sign-in is not enough on its own. The real test is whether the organisation can still prove who accessed which record or system when work happens on shared devices and under time pressure.

For practitioners

• Map password fallback paths Inventory every reset, recovery, override, and support-assisted path that still depends on a password or one-time secret. Prioritise the flows used by clinicians on shared workstations and remote access because those are the paths attackers and frustrated users both pressure.
• Harden help desk verification Treat password reset and account recovery as high-risk authentication events. Require step-up verification that matches the sensitivity of the account and the care environment, and remove discretionary shortcuts that are routinely used under time pressure.
• Reduce shared-secret dependence Move high-volume healthcare access toward passwordless and adaptive authentication patterns that preserve speed without relying on reusable credentials. Focus first on workflows where password friction is already driving lockouts, session sharing, or repeated resets.
• Protect auditability in clinical workflows Validate that passwordless design still preserves reliable attribution across shared devices, emergency access, and delegated support actions. If a workflow cannot prove who acted, the identity control is incomplete even if login is faster.

Key takeaways

• Password dependence in healthcare is creating both breach exposure and operational friction, which is why authentication has become a governance issue as much as a security issue.
• The article’s evidence links password workarounds, reset volume, and care delays, showing that the problem extends well beyond stolen credentials alone.
• Passwordless programmes need to preserve attribution and recovery control, otherwise they simply move the risk from the login screen into support workflows and clinical operations.

Key terms

• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Authentication recovery: Authentication recovery is the process used when a user cannot complete primary sign-in and needs access restored. It matters because recovery pathways can be weaker than the main authentication stack, especially for privileged accounts, and attackers often target those fallback controls when they are under-governed.
• Shared Workstation Session: A shared workstation session is a login state used by more than one person across a shift or handoff. It is risky because the authenticated session may outlive the user who opened it, so accountability depends on sign-out, device binding, and traceability rather than login strength alone.
• Identity Attribution: Identity attribution is the ability to determine which entity performed an action and under what authority. For AI agents, it requires separate identities, structured logs, and traceable decision records so investigations can distinguish human intent from autonomous execution.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.