TL;DR: Healthcare organisations are under strain from clinician shortages and burnout, and Imprivata says 62% of clinicians struggle to access shared devices quickly while nearly one in four devices are lost each year. The real issue is not mobility itself but whether identity controls can reduce friction without weakening access governance.
At a glance
What this is: This is an Imprivata analysis of how shared mobile programs can reduce login friction and clinician stress while preserving secure access governance.
Why it matters: It matters because healthcare IAM teams must simplify access on shared devices without weakening role-based controls, provisioning discipline, or trust in clinical workflows.
By the numbers:
- 62% of clinicians struggle to access shared devices quickly, according to Imprivata research.
Context
Shared mobile devices in healthcare are a governance problem as much as an operational one. When clinicians lose time at the point of care, identity controls are no longer just about access security. They become part of workforce sustainability, workflow reliability, and patient care quality.
Imprivata argues that shared mobile programs can reduce friction if they are deployed with role-based access controls, automated provisioning, interoperability across systems, passwordless authentication, single sign-on, and IAM policy discipline. The central question for healthcare leaders is how to make shared access fast enough for clinical work without turning convenience into unmanaged exposure.
Key questions
Q: How should healthcare organisations secure shared mobile devices without slowing clinicians down?
A: Use individual identity, passwordless re-authentication, and strong session controls so staff can move quickly without sharing credentials or leaving devices signed in. The aim is to make access fast for legitimate users and hard to inherit accidentally. In healthcare, if the control adds friction but does not reduce shared access, it is not solving the real problem.
Q: Why do shared mobile programs often create more friction than they remove?
A: They fail when identity controls are designed around individual device ownership instead of shift-based clinical work. Repeated logins, inconsistent access paths, and manual provisioning make shared mobility feel slower than legacy workflows, which drives workarounds and reduces trust in the programme.
A: The clearest signs are repeated manual logins, slow task completion, low user acceptance, and staff working around controls to get clinical work done. If clinicians avoid a system because access is too slow, security becomes a barrier rather than an enabler. A workable solution should reduce friction while preserving traceability.
Q: How should security teams govern passwordless authentication for enterprise access?
A: Security teams should govern passwordless authentication the same way they govern other privileged identity paths: assign ownership, define enrollment standards, enforce expiry, and require rapid revocation. Passwordless reduces phishing exposure, but it still depends on device integrity, recovery controls, and policy enforcement. Treat it as an identity lifecycle problem, not only an authentication upgrade.
Technical breakdown
Why shared mobile access fails in clinical workflows
Shared mobile environments fail when authentication and device access are designed around individual logins rather than shift-based clinical work. Clinicians often need quick handoff across devices, wards, and systems, so repeated credential entry creates delay at exactly the point where speed matters most. In healthcare, that friction is not just a user-experience issue. It increases the chance that staff work around controls, reuse access paths, or avoid the tools entirely. The technical challenge is to preserve identity assurance while reducing the number of times a clinician has to prove the same thing in the same shift.
Practical implication: Design shared mobile access around workflow speed, not around a one-user-one-device assumption.
How role-based access and provisioning reduce access friction
Role-based access control assigns access according to clinical role rather than treating every login as a fresh permission design exercise. When paired with automated provisioning, it reduces manual setup, shortens onboarding for shared devices, and helps keep access aligned to the work a clinician actually performs. Interoperability matters because the same role often touches multiple systems, and fragmented identity handling turns each app into a separate bottleneck. Passwordless authentication and SSO further reduce login steps, but only if they sit inside a governed IAM model that still distinguishes between roles, contexts, and device states.
Practical implication: Use role-based access, provisioning automation, and SSO together so access is fast without becoming ad hoc.
What secure shared-device governance has to cover
Shared device governance is not complete unless identity, device lifecycle, and access policy are managed together. If a device is lost, reissued, or used by multiple clinicians without clear session and entitlement boundaries, the organisation inherits both productivity loss and security uncertainty. That is why access policy must follow the device as well as the user role, with provisioning, authentication, and system interoperability treated as one control surface. In practice, the security model has to support rapid reuse while keeping each handoff auditable and each entitlement traceable to a defined clinical purpose.
Practical implication: Treat shared mobile devices as governed identity assets with lifecycle, access, and audit controls.
NHI Mgmt Group analysis
Shared clinical mobility only works when access is treated as a governed workflow. The article shows that clinician burnout and login friction are now operational risks, not just productivity complaints. In healthcare, every extra authentication step competes with time at the bedside, so access design becomes part of care delivery. The implication is that IAM teams should evaluate shared mobile programs as workflow infrastructure, not as isolated device management projects.
Role-based access is the control that makes shared access scalable. The central constraint in shared mobile environments is not the device itself but the mismatch between clinical roles and repeated login handling. Role-based access reduces per-session friction by aligning entitlements to function, while automated provisioning keeps that model usable at scale. Practitioners should see this as a governance mechanism that prevents shared access from becoming arbitrary access.
Passwordless and SSO reduce friction only when policy remains explicit. Simplifying login does not mean relaxing governance. If passwordless authentication and SSO are added without clear IAM policy boundaries, the organisation may remove clicks but not risk. The field lesson is that convenience controls need entitlement discipline, or they just move the complexity somewhere less visible.
Identity governance in healthcare now has a workforce sustainability dimension. The article ties access friction directly to burnout, trust, and patient care quality. That makes access governance measurable in operational terms, not just audit terms. Healthcare leaders should treat reduced login friction, lower device loss, and faster access as programme outcomes that support both staff retention and safe care delivery.
Shared mobile programs create a named governance pattern: clinical access friction debt. That debt accumulates when repeated authentication, device delays, and inconsistent access handling force clinicians to spend cognitive and operational energy on access instead of care. The longer that debt persists, the more likely staff are to route around controls or disengage from the intended workflow. Practitioners should frame the issue as debt in the access layer, not as a simple usability complaint.
What this signals
Shared mobile programmes should be evaluated as identity workflows, not just device deployments. When clinicians spend time fighting login friction, the programme is already undermining the operational benefit it was meant to deliver.
Clinical access friction debt: repeated authentication, handoff delays, and inconsistent access handling accumulate into a governance burden that affects both staff experience and care delivery. Healthcare leaders should treat that debt as a measurable signal that identity design is out of step with how care is actually delivered.
For practitioners
- Map shared mobile access to clinical roles Define which clinical functions need which applications, sessions, and device states so access is granted by role rather than by repeated manual approval.
- Automate device provisioning and re-provisioning Build provisioning flows that can issue, reset, and hand off shared devices quickly when staff shift, devices are lost, or workflows change.
- Deploy passwordless access inside governed IAM policy Use passwordless authentication and SSO to reduce login friction, but keep policy boundaries, entitlement review, and device-state checks explicit.
- Track shared-device loss and login delay as governance signals Measure how often devices are lost, how long clinicians wait to access them, and where access handoffs stall so the programme can be tuned against real workflow friction.
Key takeaways
- Shared mobile access in healthcare is a governance issue because login friction affects both workforce sustainability and care delivery.
- Imprivata cites 62% of clinicians struggling to access shared devices quickly and nearly one in four devices being lost each year.
- Role-based access, automated provisioning, passwordless authentication, and SSO only help when they are embedded in explicit IAM policy and device lifecycle control.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5, OWASP ASVS, CSA Cloud Controls Matrix and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Shared mobile access depends on role-aligned entitlements across clinical workflows. |
| Recommendation — Apply PR.AA-05 to keep shared-device access tied to clinical role and explicit authorisation. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article centres on reducing login friction while maintaining secure authentication discipline. |
| Recommendation — Use IA-5 to govern authentication methods and streamline clinician login without weakening control. | ||
| OWASP ASVS | V6 — Authentication | Passwordless access and SSO are authentication design choices discussed in the article. |
| Recommendation — Align shared mobile authentication flows with V6 so access is simpler but still trustworthy. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | The article is fundamentally about cloud-era identity governance for shared healthcare access. |
| Recommendation — Use IAM controls to coordinate shared access, provisioning, and entitlement governance across systems. | ||
| NIST SP 800-63 | SP 800-63B — Authentication | Passwordless authentication and SSO are identity assurance mechanisms covered by digital identity guidance. |
| Recommendation — Apply SP 800-63B principles to keep clinician authentication usable, strong, and policy-driven. | ||
Key terms
- Shared Mobile Access: A model where multiple workers use the same mobile device or device pool across shifts, tasks, or locations. In healthcare, the identity problem is making access fast enough for frontline work while preserving accountability, session hygiene, and role separation across users.
- Role-Based Access Control: A model that grants permissions by assigning identities to predefined roles. It works well when jobs are stable and access patterns are predictable, but it becomes brittle when exceptions pile up. In practice, role design must stay small enough to audit and broad enough to avoid endless custom variants.
- Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
- Single Sign On: Single Sign On is a login method that lets a user access multiple applications with one authenticated session. Technically, an identity provider issues a trusted authentication assertion or token after the user signs in, and connected services accept that proof instead of requiring separate passwords for each application.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org