Shared hospital mobile access is amplifying healthcare identity risk

At a glance

What this is: This is an analysis of shared hospital mobile access in UK healthcare, showing that shared credentials, persistent sign-in, and unauthorized mobile access are driving measurable identity risk.

Why it matters: IAM teams, IGA leads, and clinical security owners need to treat shared devices as an identity governance problem, because workflow speed without session control turns mobility into standing access.

By the numbers:

• 77% of respondents admitted to sharing credentials on shared-use mobile devices, according to Imprivata.
• 74% said devices were frequently left signed in after use, according to Imprivata.
• 54% of healthcare organisations experienced a data breach due to unauthorised access via employees’ mobile devices, according to Imprivata.
• The 2025 Imprivata State of Shared Mobile Devices in Healthcare Report found that hospitals with shared mobile programs save an average of £522,000 annually.

Context

Shared hospital mobile access is an identity governance problem because the device is not the real control boundary. When clinicians share credentials or leave devices signed in, the access path outlives the task and the user, which weakens accountability and makes patient-data protection harder to prove.

In UK healthcare, digital transformation has expanded the number of vendors, contractors, and interconnected devices touching clinical workflows. That combination raises the value of fast access, but it also increases the cost of weak session management, especially where shared devices are central to care delivery.

Key questions

Q: What breaks when mobile devices stay signed in after clinical handoff?

A: When devices stay signed in, the next user may inherit access without re-authenticating, which undermines accountability and can expose patient data to the wrong person. It also confuses incident response, because logs may show a legitimate account while the actual operator changed. That is a governance failure, not just a usability issue.

Q: Why do shared credentials create more risk in healthcare than in many other sectors?

A: Shared credentials weaken attribution in environments where timing, responsibility, and patient safety all matter. In healthcare, staff hand off devices across shifts, contractors enter and leave quickly, and the same endpoint may touch sensitive records many times a day. That combination makes reuse and persistence especially dangerous because the identity trail becomes unreliable.

Q: How should hospitals measure whether shared device access is under control?

A: Track whether every handoff forces re-authentication, whether idle sessions are being locked, and whether logout events match actual clinical task completion. If devices remain signed in or re-used without a new identity event, the control is failing in practice.

Q: What is the difference between secure mobile access and secure identity governance on shared devices?

A: Secure mobile access focuses on protecting the device and its connectivity, while secure identity governance focuses on who is using it, what they can reach, and when that access must end. Hospitals need both, but the identity layer is what prevents inherited access across users.

Technical breakdown

Why shared mobile devices create standing access risk

Shared devices are not inherently insecure, but they become risky when the identity layer does not re-establish who is using the device at each handoff. Shared credentials, persistent sessions, and informal handovers turn a device into a reusable access path. In practice, the problem is not simply authentication at login. It is the absence of reliable session termination, re-authentication, and task-level accountability between users. In a hospital, that means the next clinician may inherit the previous clinician’s active access without a clear identity event to mark the transfer.

Practical implication: treat every shared-device handoff as a fresh identity event, not a continuation of the prior session.

How SSO and passwordless authentication change mobile access governance

Single sign-on and passwordless authentication can reduce friction, but only if they are paired with device-level governance and session control. SSO centralises trust, which is useful for clinicians moving across apps, yet it can also broaden the blast radius when one signed-in session remains open. Passwordless methods reduce credential reuse, but they do not solve shared-device re-entry or unattended access by themselves. The real architectural question is whether identity assurance is reasserted at the point of use, not just at the point of initial login.

Practical implication: use SSO and passwordless only with enforced timeout, re-authentication, and shared-device lockout rules.

Why healthcare mobile access depends on identity lifecycle control

Mobile access in hospitals often spans employees, contractors, and temporary staff, which makes lifecycle control as important as authentication. If access is granted for a shift, a ward, or a task, it must also be withdrawn cleanly when the role ends or the device changes hands. That is where identity governance and operational speed meet. Without disciplined provisioning and offboarding, shared mobile devices quietly become persistent access points that are hard to audit and harder to remediate after an incident.

Practical implication: align mobile device access with joiner-mover-leaver controls so access ends when the clinical need ends.

Threat narrative

Attacker objective: The objective is to use inherited or unattended mobile access to reach protected healthcare data and systems without triggering a new authentication event.

1. Entry occurs when hospital staff share credentials or remain signed in on shared-use mobile devices, creating reusable access paths across clinical shifts.
2. Escalation happens when an unauthorised user inherits an active session and can reach patient records or systems without a fresh identity check.
3. Impact follows when that inherited access is used for unauthorised data exposure or breach activity, undermining patient trust and operational resilience.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Shared mobile access is an identity governance issue before it is a device issue. The article shows that the core risk comes from credentials, sessions, and handoffs, not from mobility alone. In hospitals, shared devices are part of the care model, so the control model has to assume repeated user changes under time pressure. The practitioner conclusion is that access governance must move to the point of device use, not stay anchored only in account issuance.

Session persistence is the control gap that makes clinical speed dangerous. Leaving devices signed in converts convenience into standing access, which erodes accountability and makes patient-data exposure harder to constrain. That pattern is especially problematic in environments with contractors, temporary staff, and rotating shifts. The implication is that shared access programs need identity assurance at each transaction, not just at enrollment.

Shared-device trust debt: when hospitals normalise shared credentials and unattended sessions, they accumulate access that is operationally convenient but governance-light. The more the workflow depends on inherited access, the less meaningful traditional account-centric controls become. That creates a control gap that cannot be solved by policy alone, because the risk lives in day-to-day handoff behaviour. The conclusion is that hospitals need governance designed for identity transfer, not just identity creation.

Clinical mobility now tests the boundary between usability and assurance. The article’s figures show that organisations can gain efficiency from shared device models, but only if oversight, compliance, and session discipline keep pace. Otherwise, the programme shifts risk from endpoint management into identity sprawl. The practitioner conclusion is that healthcare security leaders should evaluate whether mobile access programs are measuring actual handoff control, not just deployment scale.

Hospital identity programmes need to govern the handoff, not only the user. Shared devices collapse the assumption that one person, one session, and one device stay aligned long enough for conventional access review to matter. In a shift-based environment, the better control question is whether the next user inherits any residual trust from the previous user. The implication is that identity governance must account for device-sharing patterns as a first-class part of access risk.

What this signals

Shared-device trust debt: hospitals that normalise shared credentials and persistent sign-in create a governance gap that will not be fixed by mobile rollout speed alone. The control question is whether identity is re-established at every handoff, because that is where clinical convenience either becomes controlled access or residual exposure.

In healthcare, mobile access should be judged by handoff integrity, not by adoption rates. If the access model cannot show who used the device, when the session ended, and whether the next user had to authenticate again, the programme is operating with avoidable identity risk.

For practitioners

• Enforce re-authentication at every shared-device handoff Require a fresh identity check when control of a clinical device changes hands, and block inherited sessions from continuing across users.
• Shorten session lifetime on ward devices Set aggressive idle timeouts and automatic lock behavior for devices used in shared clinical workflows so unattended access does not persist between tasks.
• Bind mobile access to task-scoped privileges Grant the minimum access needed for a shift or clinical function, then remove it when the task ends or the device leaves the care area.
• Add shared-device events to access review evidence Capture login, logout, handoff, and failed re-authentication events so recertification reflects real mobile usage rather than static account ownership.

Key takeaways

• Shared hospital devices become risky when credentials are reused and sessions remain open across users, because the identity boundary disappears at the handoff.
• Imprivata reports that 77% of respondents share credentials, 74% leave devices signed in, and 54% have seen breaches from unauthorised mobile access.
• Hospitals need identity controls that reassert trust at the point of use, not just at the point of login, or shared mobility will continue to expand exposure.

Key terms

• Shared Device Handoff: The transfer of a mobile device from one user to another in a clinical workflow. In identity terms, the handoff is the moment when access must be re-established, not assumed to continue. If the previous session remains active, accountability and containment both weaken.
• Session persistence: The tendency for access to remain valid after the original authentication event has ended or been revoked upstream. In browser-centric incidents, this is the gap between killing the login and actually terminating the live SaaS or application session that the attacker is still using.
• Identity Handoff: The controlled transfer of access from one user to the next on a shared device or application session. In manufacturing, the handoff must close the prior session, preserve auditability, and prevent residual access from carrying into the next operator’s activity.
• Task-Scoped Access: Task-scoped access is permission granted for one defined purpose and removed once the task is complete or the session expires. For non-human identities, it reduces standing privilege and limits how long an attacker can exploit a stolen credential.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.