TL;DR: Shared-use mobile devices in healthcare deliver an average $1.1 million in annual savings, but the 2025 Imprivata survey of 400 leaders found that organisations with fully implemented policies see 63% greater ROI, while 44% still lack a formal management policy. Weak credential practices and signed-in devices are eroding both financial and clinical value.
At a glance
What this is: This report argues that shared-use mobile devices in healthcare produce strong savings only when formal governance, authentication, and lifecycle controls are in place.
Why it matters: It matters because IAM and mobility teams must treat shared devices as governed identity endpoints, not informal clinical conveniences, or the savings case erodes through credential sharing, signed-in sessions, and loss exposure.
By the numbers:
- Organisations with fully implemented policies see 63% greater ROI, with $1.4 million compared with $860,000.
- 44% of respondents say their organisation has no formal policy to manage shared mobile devices.
- 79% of staff share credentials and 74% leave devices signed in after use.
Context
Shared mobile devices are clinical endpoints that move between people, shifts, and care settings. In that environment, the identity control problem is not simply device custody. It is whether authentication, session handling, and offboarding are strong enough to preserve privacy, accountability, and operational continuity.
The governance gap becomes visible when shared devices are treated as a convenience layer rather than a managed access surface. Without formal policy, organisations inherit credential sharing, lingering sessions, and inconsistent assignment practices that reduce the return on the mobility programme and increase avoidable operational risk.
Key questions
Q: What breaks when shared healthcare devices have no formal policy?
A: The access model breaks because device handoff becomes informal, sessions persist between users, and accountability for data access becomes unclear. In practice, that means clinicians can inherit access, signed-in states can outlive a shift, and the organisation cannot reliably prove who accessed what at a given moment.
Q: Why do shared devices reduce ROI when credential hygiene is weak?
A: Weak credential hygiene turns a savings programme into an access-risk programme. If users share credentials or leave devices signed in, the organisation absorbs the operational benefit of shared hardware while also taking on privacy exposure, audit weakness, and avoidable rework after each handoff.
Q: How do organisations know whether shared-device governance is working?
A: They should look for short access times, low workaround behaviour, clean audit trails, and consistent session resets at handoff. If staff are bypassing controls to keep care moving, governance is failing even if the devices are technically secure. Clinician satisfaction is also a useful signal because low usability often predicts policy drift.
A: Healthcare teams should design access around the clinician workflow, not around the workstation. Use strong authentication that is fast enough for real clinical pace, pair it with session continuity, and keep shared devices available between users. The goal is to reduce repeated logins and delays while preserving accountability, limiting exposure on workstations on wheels, mobile devices, and the EHR.
Technical breakdown
Why shared mobile devices become an identity problem
Shared healthcare devices are not just assets, they are access endpoints. When a clinician picks up a device, the identity state attached to that device determines who can see records, place orders, message teams, or move into a patient workflow. If the organisation has no formal policy, the device can drift between users with no reliable re-authentication point, no consistent logout control, and no visible accountability chain. The result is not only inefficiency. It is an access model that depends on informal behaviour instead of enforceable governance.
Practical implication: define shared-device access as an IAM control surface, not an equipment-management task.
Why session persistence erodes clinical and security value
A signed-in shared device preserves convenience only until it preserves the wrong state. If users leave sessions open, the next clinician inherits access that was never intentionally granted. In healthcare, that can expose patient data, create ordering mistakes, and make attribution impossible after the fact. The policy issue is therefore not abstract hygiene. It is the lack of a control boundary that forces each new user to establish a fresh identity context before interacting with clinical systems.
Practical implication: enforce re-authentication and session closure rules that remove inherited access between users.
How lifecycle controls preserve ROI on shared devices
ROI falls when devices disappear into ad hoc handling, untracked assignments, or inconsistent cleaning and charging routines. Lifecycle governance covers where the device is, who has it, when it was last used, and whether it is ready for the next shift. That is why automated asset tracking, managed mobility services, and identity-driven authentication belong in the same control model. The financial value of shared mobility only holds when device availability, identity assurance, and return-to-service processes are managed together.
Practical implication: align device lifecycle controls with identity workflows so availability does not come at the expense of governance.
Breaches seen in the wild
- iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Shared mobility becomes an IAM governance problem as soon as multiple clinicians use the same endpoint. The policy gap is not about device ownership in the abstract. It is about whether identity context follows the person or gets left behind on the device, which is where exposure begins. Healthcare teams should treat shared endpoints as access brokers that require explicit policy, not informal trust.
Credential sharing is the clearest sign that the access model has outgrown the workflow. When 79% of staff share credentials and 74% leave devices signed in after use, the programme is already relying on human memory instead of enforceable control. That pattern weakens accountability, makes audit trails unreliable, and turns privacy obligations into a soft control rather than an operational one.
Identity-driven authentication is the named concept that preserves the economics of shared devices. The savings case survives only when the device can be rapidly re-associated with a verified user and then cleanly returned to a neutral state. That is a governance design choice, not a feature preference, and it should be evaluated alongside clinical throughput.
Formal policy is the difference between mobile efficiency and mobile entropy. Without explicit rules for sign-in, handoff, charging, and tracking, the organisation pays twice, once in lost time and again in lost control. Shared mobility should be governed as a lifecycle discipline across human identity, device state, and access assurance.
Healthcare mobility programmes need to be measured on control consistency, not device count. High adoption and strong savings do not prove that governance is working. The real test is whether the programme can prevent inherited access, identify where devices are, and maintain a trustworthy session boundary across shifts.
What this signals
Identity-driven authentication is the control that keeps shared mobility from turning into inherited access. When a device moves between clinicians, the programme has to re-establish identity state before the next action, or the workflow is effectively borrowing trust from the previous user.
Healthcare leaders should measure shared-device success by the stability of the access handoff, not by adoption alone. A fleet can be widely used and still be governed poorly if sessions persist, credentials are shared, and lifecycle tracking is inconsistent.
Policy is doing the work that informal clinical habit cannot do at scale. Once shared devices become part of routine care delivery, the governance model has to cover assignment, logout, readiness, and recovery as one continuous access flow.
For practitioners
- Define a shared-device access policy Set rules for sign-in, sign-out, reassignment, and escalation so each device has a clear identity handoff between users.
- Enforce session termination at handoff Require logout or re-authentication before a device changes hands, and remove any workflow that leaves the prior clinician session active.
- Track devices through their full lifecycle Use automated asset tracking to show where each shared device is, who last used it, and whether it is ready for the next shift.
- Align charging and availability controls Place smart hubs or managed charging points into the workflow so devices return to a known, usable state without informal workarounds.
Key takeaways
- Shared-use mobile devices can reduce cost, but the savings only hold when identity and session controls follow the device between users.
- The report links weak policy to credential sharing, persistent sign-ins, and lost accountability across clinical workflows.
- Healthcare teams should govern shared devices as a lifecycle and access-control problem, not as a simple hardware deployment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CSA Cloud Controls Matrix, NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while DORA defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Shared healthcare devices hinge on access governance, authentication, and session control. |
| Recommendation — Map shared-device workflows to IAM controls and enforce identity handoff at every user change. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centers on who can access shared devices and how those entitlements are governed. |
| Recommendation — Apply PR.AA-05 to ensure shared-device permissions are explicit, current, and reviewable. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential sharing and persistent sign-ins point directly to authenticator lifecycle control. |
| Recommendation — Use IA-5 to control shared-device credentials, session reuse, and authenticator handling. | ||
| CIS Controls v8 | CIS-5 — Account Management | Shared mobile programmes fail when account handoff and usage are not centrally managed. |
| Recommendation — Use CIS-5 to govern account assignment and revoke access cleanly between users. | ||
| DORA | Operational resilience governance | Healthcare mobility governance mirrors resilience concerns around controlled operations and process continuity. |
| Recommendation — Embed shared-device controls into resilience governance so workflow continuity does not bypass access control. | ||
Key terms
- Shared-use device: A shared-use device is an endpoint used by multiple people across different sessions, such as a workstation or mobile device in a clinical setting. Security depends on preserving user attribution, session isolation, and auditability, because the device itself no longer proves who accessed patient data.
- Identity Handoff: The controlled transfer of access from one user to the next on a shared device or application session. In manufacturing, the handoff must close the prior session, preserve auditability, and prevent residual access from carrying into the next operator’s activity.
- Session persistence: The tendency for access to remain valid after the original authentication event has ended or been revoked upstream. In browser-centric incidents, this is the gap between killing the login and actually terminating the live SaaS or application session that the attacker is still using.
- Device Lifecycle Governance: Device lifecycle governance is the set of controls that cover provisioning, assignment, use, recovery, and retirement of shared endpoints. It matters because a device that is managed only at enrollment can still become risky if ownership, status, and decommissioning are not kept current.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 25, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org