Shared mobile devices expose healthcare IAM gaps and access risk

At a glance

What this is: This Imprivata research shows that shared mobile devices in healthcare are often left signed in, credentials are widely shared, and password-based access still persists.

Why it matters: It matters because shared clinical devices sit at the intersection of patient data access, workflow speed, and identity governance, so weak access handling creates both security and operational friction.

By the numbers:

• 74% of shared-use devices are often left signed in after use, according to Imprivata research.
• 79% of staff admit to sharing credentials, according to Imprivata research.
• 44% of respondents cite data security as the most frequent challenge for shared-use device adoption, according to Imprivata research.
• 26% of organisations still rely on traditional usernames and passwords to access shared devices, according to Imprivata research.

Context

Shared mobile devices in healthcare are a workflow and identity problem, not just an endpoint problem. When multiple clinicians use the same device, the access model has to support rapid handoff, immediate sign-out, and dependable identity verification without slowing care delivery.

Imprivata's research shows that many organisations are still leaning on usernames and passwords, even as shared-device use increases. That creates a governance gap between how frontline teams actually work and how access is controlled in practice.

The result is a familiar healthcare pattern: shared assets are treated as convenience tools while identity controls remain generic. In that environment, access drift becomes routine and patient data protection depends on user discipline rather than enforced design.

Key questions

Q: What breaks when clinicians rely on shared logins or leave medical devices signed in to one user?

A: Shared logins and unattended sessions break accountability, data integrity, and access control. In a clinical setting, another user can act under the wrong identity, audit logs become unreliable, and patient records can be updated under the wrong clinician. That creates both compliance exposure and operational risk, because the organization can no longer trust who accessed the device or what was recorded.

Q: Why do usernames and passwords create risk on shared healthcare devices?

A: Usernames and passwords authenticate a person, but they do not manage rapid user turnover on the same device. In a shared clinical setting, that means credentials are easy to reuse, share, or leave active after a handoff. The risk is not just weaker login security, but a mismatch between static authentication and dynamic care workflows.

Q: How should healthcare organizations reduce workflow friction without weakening access control on shared clinical devices?

A: Healthcare teams should design access around the clinician workflow, not around the workstation. Use strong authentication that is fast enough for real clinical pace, pair it with session continuity, and keep shared devices available between users. The goal is to reduce repeated logins and delays while preserving accountability, limiting exposure on workstations on wheels, mobile devices, and the EHR.

Q: Should hospitals treat shared mobile devices as an IAM priority or a device management issue?

A: They should treat them as both, but IAM has to lead because the core risk is identity reuse and session persistence. Device management can secure the hardware, but it cannot by itself solve who is authenticated, when access ends, or how the next user is reassociated. Shared-device governance only works when identity and device controls are designed together.

Technical breakdown

Why shared device sessions become identity exposure points

A shared mobile device only stays safe if the session state is tightly managed between users. If a clinician remains signed in after handoff, the next user inherits access context that was never intended for them. In healthcare, that matters because the device is often both the entry point and the working surface for patient records, messaging, and care coordination. The control problem is not just authentication at login. It is session termination, device handoff, and identity reassociation at the point of use.

Practical implication: treat session persistence on shared clinical devices as an access control failure, not a user habit problem.

Why usernames and passwords do not fit shared clinical workflows

Traditional credentials assume a stable human-to-device relationship, but shared care environments break that assumption. A password authenticates the person, yet it does not prove who should inherit the device after a shift change, a room change, or an urgent handoff. That makes username-password access fragile when access must be fast, repeatable, and auditable across many users. Passwordless authentication and single sign-on reduce friction, but the bigger point is that the access model has to match shared-use reality rather than retrofitted convenience.

Practical implication: replace password-centric shared-device access with methods that support rapid reauthentication and clean user context switching.

How biometric and single sign-on controls change the device trust model

Biometric identification and single sign-on do not just speed access. They can reduce the amount of time a shared device spends in an ambiguous state, where the system knows a session exists but not whether it still belongs to the right clinician. In practice, this changes the trust model from static shared access to controlled, user-specific access with less manual credential handling. In healthcare, that matters because the more often credentials are typed, shared, or reused, the more likely access control becomes detached from the actual care workflow.

Practical implication: use biometric and SSO controls to shorten the window between identity verification and clinical task completion.

Threat narrative

Attacker objective: The objective is unauthorized access to patient data and clinical workflows through weakly governed shared-device sessions and credential reuse.

1. Entry occurs when a shared device remains signed in after use, allowing the next user to inherit an active session without fresh identity verification.
2. Credential abuse follows when staff share credentials or reuse login access to move quickly between tasks and users.
3. Impact emerges as patient data becomes accessible under the wrong user context, while help desk load and lockout friction continue to degrade clinical operations.

Breaches seen in the wild

• iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Shared mobile devices in healthcare expose a governance gap, not just an endpoint hygiene problem. The central issue is that access control is being asked to support a workflow built around rapid handoff, repeated authentication, and shared device use. When identity controls are designed as if each device has one stable user, they fail at the exact moment clinical teams need them most. The practical conclusion is that healthcare IAM has to be engineered for shared-state access, not single-owner assumptions.

Traditional usernames and passwords are a poor fit for shared-care environments. They authenticate a person, but they do not manage the transfer of access between people using the same device across a shift. That creates a gap between identity proofing and operational handoff. For healthcare IAM teams, the lesson is that access design must account for the reality of device sharing, not just policy compliance.

Clinical device access needs a lifecycle model, not a one-time login model. Shared devices are repeatedly signed in, reused, and left in ambiguous states unless identity context is actively cleared. That means access governance must address session end, user transition, and reauthentication as part of the same control plane. Practitioners should treat shared-device access as lifecycle-managed identity, not as a static login event.

Named concept: shared-device identity drift. This is the state where the device’s active session, the user currently holding it, and the identity the system believes is in control no longer match. In healthcare, that drift is driven by pressure for speed, lockout avoidance, and the continued use of password-based access. The practical conclusion is that governance has to focus on the handoff point, where identity and workflow most often separate.

Health systems should read this as an access governance signal, not a narrow usability complaint. The report's combination of signed-in devices, credential sharing, and password dependence shows that operational convenience is already shaping control design. When shared-device access is not intentionally governed, security outcomes depend on user discipline instead of enforceable policy. Practitioners need to align IAM, clinical workflow design, and device session controls around the same operating model.

From our research library:

• 60% of healthcare organisations do not assess a vendor's security before signing a contract that grants access to protected health information, according to Ponemon Institute's 2023 Third-Party Risk in Healthcare report.

What this signals

Shared-device identity drift: healthcare organisations need to govern the moment a device changes hands, not just the moment a user logs in. That is where session persistence, reused credentials, and delayed sign-out combine into avoidable access exposure.

Shared clinical workflows demand access models that can survive constant user turnover without depending on memory or manual logout behaviour. Passwordless authentication and single sign-on are useful because they reduce friction, but the real control objective is clean user context transfer between clinicians.

For practitioners

• Enforce automatic session termination Configure shared clinical devices to end sessions at handoff so the next user does not inherit access context from the previous user.
• Move shared-device access off passwords Adopt passwordless authentication and single sign-on for shared clinical workflows so users can re-enter access quickly without credential reuse.
• Build explicit device handoff controls Define a clean sign-out and reassociation process for care-team devices so identity state follows the clinician, not the hardware.
• Treat lockouts as a control signal Track frequent help desk lockouts and repeated credential sharing as indicators that the access model is misaligned with clinical workflow.

Key takeaways

• Shared mobile devices in healthcare create an identity governance problem when sessions remain open and credentials are reused across care teams.
• The article shows that 74% of shared-use devices are often left signed in and 79% of staff admit to sharing credentials, which makes access drift a routine operating risk.
• Healthcare organisations should align IAM, session control, and clinical workflow design so access handoff is explicit rather than informal.

Key terms

• Shared-device identity drift: The condition where a device's active session no longer matches the clinician currently using it. In healthcare, this usually happens when logouts are missed, credentials are reused, or handoffs are informal, creating a gap between operational reality and access control.
• Session persistence: The tendency for access to remain valid after the original authentication event has ended or been revoked upstream. In browser-centric incidents, this is the gap between killing the login and actually terminating the live SaaS or application session that the attacker is still using.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Authenticator Lifecycle Management: Authenticator lifecycle management is the governance of a credential from issuance to renewal, replacement, and retirement. For human identity programmes, it ensures that keys, smart cards, and certificates stay tied to the right user and are removed when the user, role, or device is no longer trusted.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.