Shared mobile devices are reshaping clinical identity governance

At a glance

What this is: This report argues that shared mobile devices have become central to clinical workflows, and that the real governance issue is not device ownership but how access, accountability, and workflow speed are controlled together.

Why it matters: It matters because healthcare IAM teams now need to govern shared devices as identity-bearing endpoints, where lockouts, shared credentials, and missing assignment controls can directly affect care delivery and PHI exposure.

By the numbers:

• 92% of healthcare leaders say mobile devices are essential tools in care facilities.
• 99% expect the use of shared mobile devices to increase over the next two years.
• 79% of employees share credentials on shared mobile devices.
• 23% of devices are lost annually.

Context

Shared mobile devices are no longer just a usability choice in healthcare. They are a governance problem because the device, the user, and the clinical workflow all move between hands, shifts, and departments.

The article shows why the old one-device-per-person model breaks down in care settings: speed matters, shared access is common, and manual assignment or ad hoc credential use creates both operational delay and identity risk.

For identity teams, the key question is not whether mobile devices are useful. It is how to preserve accountability, reduce friction, and prevent shared-device access from becoming shared-credential exposure.

Key questions

Q: What breaks when shared clinical devices are not tied to clear ownership?

A: When shared clinical devices lack clear ownership, organisations lose the ability to answer basic questions about who used the device, where it is, and what access it carried. That weakens incident response, increases unnecessary remote lock or wipe actions, and makes HIPAA decisions harder to defend.

Q: Why do shared mobile devices create identity risk in clinical environments?

A: They create identity risk because multiple people use the same endpoint, so access state can outlive the person who initiated it. If credentials are shared or sessions remain active, accountability weakens and patient data protection suffers. The risk is highest when policy is incomplete and device state is not reliably reset.

Q: How should security teams reduce credential sharing on shared devices?

A: Security teams should replace slow, user-specific login flows with fast authentication methods that preserve accountability on shared endpoints. The goal is not merely stronger login strength. It is to make the secure path easier than the workaround, while maintaining session attribution, auditability, and support for shift-based work.

Q: When do shared mobile workflows become a patient-data exposure problem?

A: They become an exposure problem when devices stay signed in, are reassigned informally, or are left unattended after use. At that point, the risk is not just lost hardware but unauthorised access to PHI through a live session that was never properly closed.

Technical breakdown

Why shared mobile changes identity assurance in clinical workflows

Shared mobile devices collapse the normal assumption that one person owns one authenticated endpoint. In clinical settings, the same device may serve multiple staff members across a shift, which means authentication, session state, and device trust all have to be re-established repeatedly. That makes the access model closer to a managed kiosk pattern than a personal handset model. The core identity issue is not mobility itself, but how the organisation binds a person, a device, and a clinical action at the moment of use.

Practical implication: design shared-device access so the user session is explicitly re-bound at every handoff, not inherited from the previous user.

How credential sharing and signed-in devices weaken clinical accountability

When staff share credentials or leave devices signed in, the organisation loses attribution for who accessed patient data and when. That weakens auditability, complicates incident review, and creates a direct path to unauthorized access if a device is lost or left unattended. The article’s figures show that these are not edge cases but operating realities in many facilities. Identity governance has to account for both authentication failure and session persistence, because the risk comes from the combination.

Practical implication: require per-user authentication and enforced sign-out so shared devices never operate as de facto shared accounts.

Why manual device assignment creates hidden security and workflow debt

Manual checkout, first-come distribution, and inconsistent policies turn shared mobile into an administrative bottleneck. The delay is not just an efficiency issue. Every minute spent locating, assigning, or reassigning a device increases the chance that staff will bypass controls, use personal devices, or reuse credentials to keep care moving. In practice, workflow friction and security weakness are coupled. If the process is slow, staff will build workarounds, and those workarounds become the real control plane.

Practical implication: automate checkout and tracking so workflow pressure does not push clinicians into insecure bypass behaviour.

Threat narrative

Attacker objective: The objective is to obtain unauthorised access to patient information or clinical systems through weak shared-device governance.

1. Entry occurs when clinical staff fall back to shared credentials or stay logged into a device after use, creating a usable access path for the next person.
2. Escalation follows when a misplaced, unattended, or reassigned device carries forward the prior session and exposes patient records without a fresh identity check.
3. Impact is unauthorized access to PHI, loss of accountability, and delayed care when device handling, authentication, and assignment are not controlled together.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Shared mobile is now a clinical identity governance problem, not a device procurement problem. The article makes clear that shared devices are useful because they fit the pace of care, but that utility only works when identity, session control, and assignment policy are treated as one operating model. That shifts the governance question from who owns the device to who is accountable for the access path. Practitioners should manage shared mobility as part of identity architecture, not endpoint logistics.

Credential sharing on shared devices is a control failure, not a user convenience metric. When 79% of employees share credentials and 74% of devices stay signed in, the programme has already lost the boundary between authenticated user and usable session. The issue is not merely policy non-compliance. It is that the access model no longer proves who acted, which undermines both auditability and patient-data protection. The implication is that session enforcement must be as important as device availability.

Identity blast radius: In shared clinical mobility, one weak handoff can expose an entire shift of patient workflows. Shared devices connect assignment, authentication, coordination, and documentation, so a single bypass can affect multiple people and multiple records. That is why the usual one-user-one-device mental model fails in healthcare. Security teams need to think in terms of blast radius across handoffs, not just endpoint hardening.

Automated checkout and check-in are governance controls, not convenience features. The article’s figures on manual assignment delays and lost devices show that operational slowness is also a security problem. If a device can be assigned, signed in, and left behind without a tracked handoff, the organisation cannot reliably prove custody or responsibility. Practitioners should treat automated issuance and return as accountability infrastructure, not IT optimisation.

Shared mobile validates identity-driven access management as the only sustainable control pattern for clinical mobility. The real challenge is not whether devices are shared, but whether the organisation can preserve secure, frictionless access while maintaining attribution, workflow speed, and PHI protection. That aligns with NIST CSF thinking on access permissions and authorisations as part of operational resilience. The practical conclusion is straightforward: clinical mobility programmes need identity governance at the center, or they will keep trading speed for risk.

What this signals

Shared mobility only scales when identity controls move with the workflow. Healthcare programmes that treat device assignment as an operations task and authentication as a separate IT task will keep recreating the same gap. The useful model is one where custody, sign-in, and session closure are managed as a single lifecycle.

Clinical mobility exposes the limits of badge-and-password thinking. When staff move between shared devices, fixed credentials and slow logins become a work-around trigger, not a security solution. The programme should be designed around fast re-authentication, explicit attribution, and traceable handoff.

Identity governance has to follow the device, not just the user. In shared environments, the control point is the endpoint session, because that is where patient data becomes accessible. If the session is not treated as governed identity state, accountability will remain partial.

For practitioners

• Define a shared-device assignment policy Replace first-come, first-served distribution with a formal assignment model that records who has custody of each device and when custody changes.
• Enforce per-user authentication at each handoff Use tap-and-go or equivalent re-authentication so the next clinician must establish a fresh identity before accessing applications or records.
• Eliminate credential sharing on shared devices Remove any process that allows staff to reuse credentials across shifts or departments, and make shared sessions attributable to a single named user.
• Automate checkout and check-in workflows Build device issuance, return, and tracking into the workflow so identity controls are not bypassed when care teams are under time pressure.
• Track lost and unattended devices as identity incidents Treat missing devices and persistent signed-in sessions as security events because they can expose PHI even when the hardware is still inside the facility.

Key takeaways

• Shared mobile devices are now part of the identity governance surface in healthcare, because access, attribution, and clinical speed depend on the same control model.
• The report’s strongest warning is that credential sharing and persistent sign-in turn a shared device into a reusable access path rather than a controlled workflow tool.
• Healthcare teams should formalise assignment, enforce re-authentication, and automate handoff controls so patient care speed does not come at the cost of accountability.

Key terms

• Shared Device Handoff: The controlled transfer of a mobile device from one user to another in a way that preserves accountability and prevents session carryover. In healthcare, the handoff must include sign-out, re-authentication, and custody tracking so the next user does not inherit the previous user’s access state.
• Clinical identity governance: The discipline of controlling access in healthcare so clinicians, patients, and vendors can use systems safely without disrupting care. It combines authentication, authorisation, auditability, and usability so identity decisions support clinical operations instead of interfering with them.
• Session Persistence Risk: The security exposure created when a privileged automation process retains state between commands. That state can be useful for authentication, but it also increases the impact of parsing bugs, malformed input, and process hangs if the session is not tightly governed.
• Identity-Driven Access Management: Identity-Driven Access Management is an access control approach that makes identity the primary signal for deciding who or what can reach a resource. It combines authentication, authorization, context, and continuous evaluation across users, service accounts, workloads, and agents to reduce implicit trust and align access with verified identity state.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.