Shared-use mobile devices expose healthcare identity gaps in UK hospitals

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Imprivata's research: Shared-use mobile devices create material savings for UK hospitals, but policy, credential sharing, and session hygiene gaps weaken control.

Why it matters: It matters because shared clinical devices turn access governance into a frontline patient-data control problem, affecting human identity workflows, privileged operational oversight, and non-human device accountability.

By the numbers:

• Nearly half of organisations, 47%, have not fully implemented a policy for managing shared-use mobile devices.
• Imprivata says 77% of respondents report that users share credentials when accessing shared-use mobile devices.
• Imprivata reports that 74% of respondents say shared-use mobile devices are frequently left signed in by staff after use.

Context

Shared-use mobile devices are handheld clinical endpoints that multiple staff members use across shifts, wards, and care tasks. In identity terms, they are not just devices. They are shared access surfaces that depend on reliable sign-in, session termination, and policy enforcement to protect patient data and maintain accountability.

The governance gap is that many healthcare organisations have adopted the workflow benefits of shared devices without closing the identity controls that make sharing safe. When users share credentials or leave sessions open, the device becomes a conduit for misattribution, data exposure, and operational confusion rather than a controlled clinical tool.

This is primarily a human IAM and device-governance problem, with adjacent NHI implications where endpoint, MDM, and access-management processes behave like service identities in practice. The article shows a typical early-adoption pattern: organisations recognise the value before they fully operationalise the controls.

Key questions

Q: What breaks when clinicians rely on shared logins or leave medical devices signed in to one user?

A: Shared logins and unattended sessions break accountability, data integrity, and access control. In a clinical setting, another user can act under the wrong identity, audit logs become unreliable, and patient records can be updated under the wrong clinician. That creates both compliance exposure and operational risk, because the organization can no longer trust who accessed the device or what was recorded.

Q: Why do shared clinical devices create identity and access risk?

A: Because the device is reused by multiple people across shifts, so the organisation must prove who had access, when the session ended, and whether the endpoint was reset. If those controls are weak, credential sharing and lingering sign-in sessions become routine workarounds.

Q: How should healthcare teams govern shared mobile device access without slowing clinicians down?

A: They should make authentication fast, device state visible, and session handoff explicit. Badge tap, single sign-on, and biometric access reduce friction, but they must be paired with audit trails and clean-return workflows so the next clinician does not inherit an open session or stale trust state.

Q: When does shared-device convenience become an identity control failure?

A: It becomes a control failure when the organisation cannot tell who accessed the device, cannot prove the session ended, or cannot recover the device state after loss or handoff. At that point, convenience has overridden governance, and the shared endpoint is operating outside the intended trust model.

Technical breakdown

Why shared devices break traditional sign-in assumptions

Shared-use mobile devices disrupt a core IAM assumption: one person, one persistent device, one stable session context. In hospital settings, that assumption fails because the endpoint is reused across staff, shifts, and clinical tasks. Access therefore depends less on enrolment and more on rapid authentication, context-aware session handling, and reliable termination after each use. Where sign-out is unreliable, identity becomes attached to the device state instead of the person using it. That creates misattribution risk, especially when clinicians move quickly between patients and cannot afford friction-heavy workflows.

Practical implication: treat shared clinical endpoints as ephemeral access surfaces, not standard user workstations.

Credential sharing and lingering sessions create identity drift

Credential sharing on shared devices is a symptom of workflow pressure, but it also destroys accountability. If multiple users know the same login or leave a session open for the next shift, audit trails no longer prove who accessed patient data. This is an identity drift problem, where the effective user and the recorded user diverge. In regulated care environments, that undermines both privacy expectations and incident reconstruction. Session persistence on shared devices is therefore not just a usability defect. It is a governance failure that turns normal operations into ambiguous access events.

Practical implication: require per-user authentication and enforced session closure at every handoff.

Policy is the control plane for shared mobile devices

The report shows that device value does not translate into control maturity unless the organisation has a defined policy for allocation, sign-in, tracking, and recovery. Policy is what connects mobile device management, identity governance, and operational accountability. Without it, lost devices, uncharged devices, inconsistent configuration, and left-open sessions accumulate into security and workflow failures. In healthcare, that makes policy design as important as device deployment. A shared device programme succeeds when governance defines who can use the device, how identity is proven, and what happens when a device disappears or a session is abandoned.

Practical implication: write the shared-device policy before scaling the fleet.

NHI Mgmt Group analysis

Shared clinical devices expose an access-governance gap, not a device problem. The report is really about whether identity controls can keep pace with high-tempo care delivery. When organisations treat shared endpoints as a procurement decision instead of an access model, they inherit ambiguous authentication, weak session closure, and poor accountability. The practical conclusion is that the control plane matters more than the hardware.

Credential sharing on shared mobile devices is a failure of identity attribution. Once staff share logins or leave sessions active, the audit trail no longer maps cleanly to a person. That matters in healthcare because access evidence is part of both patient privacy protection and operational traceability. The implication is that shared-use workflows need controls that preserve per-user accountability even when the device is communal.

Shared-use mobility should be governed as a lifecycle problem. Joiner, mover, and leaver logic applies even when the identity is transient and the endpoint is shared across shifts. Access assignment, session handoff, and offboarding all need explicit ownership, or the environment will drift into informal workarounds. The conclusion is that lifecycle discipline is what turns shared-device convenience into repeatable control.

Clinical endpoint accountability: Shared devices need a governance model that ties access, session state, and device condition to a known user at every handoff. The report shows that visibility and control degrade when organisations cannot reliably track who used the device last. That makes endpoint accountability the named control concept this market still needs to operationalise.

Healthcare programmes that optimise for speed before governance will keep paying for rework. The article shows the trade-off clearly: shared devices can improve workflow and save money, but only if sign-in, policy, and device management are aligned. Where they are not, clinicians absorb lockouts, missing devices, and broken session state. The practitioner conclusion is that adoption metrics without governance metrics are incomplete.

What this signals

Shared-use mobility only works when identity state is reset as carefully as device state. Hospitals that scale communal endpoints without enforced sign-out and per-user attribution will keep seeing the same failure pattern: workflow gains on paper, ambiguity in practice. The programme question is no longer whether devices can be shared, but whether the access model survives sharing intact.

Access review alone is not enough for shared clinical endpoints. If sessions persist and credentials are reused, the meaningful control point is issuance and handoff, not after-the-fact review. UK healthcare teams should therefore focus on the operational joins between IAM, mobile device management, and workflow design rather than treating them as separate programmes.

For practitioners

• Define a shared-device identity policy Specify who can use each device class, how authentication occurs at handoff, and what state must be cleared before reassignment.
• Enforce per-user sign-in and sign-out Require unique authentication for every clinician and force session closure before the device is handed to the next user.
• Track device state and location continuously Link mobile device management records to active sessions so missing, uncharged, or misconfigured devices are visible before patient care is affected.
• Eliminate shared credentials in clinical workflows Replace common logins with individual access methods so audit trails remain attributable and patient-data access can be investigated accurately.
• Formalise offboarding for communal endpoints Ensure that lost devices, returned devices, and abandoned sessions trigger immediate access review and recovery steps.

Key takeaways

• Shared-use mobile devices can deliver clear operational value in hospitals, but the security model fails when authentication and session control are left informal.
• The report shows a substantial policy gap, with 47% of organisations lacking a fully implemented shared-device policy and 77% reporting credential sharing.
• Healthcare teams need per-user identity, enforced sign-out, and explicit handoff rules if they want shared endpoints to remain auditable and safe.

Key terms

• Shared-use device: A shared-use device is an endpoint used by multiple people across different sessions, such as a workstation or mobile device in a clinical setting. Security depends on preserving user attribution, session isolation, and auditability, because the device itself no longer proves who accessed patient data.
• Session Handoff Control: Session handoff control is the governance that ensures one user’s access does not silently continue into another user’s shift or task. It is especially important on shared devices because the risk is not just initial authentication, but who retains control after the operational context changes.
• Identity Attribution: Identity attribution is the ability to determine which entity performed an action and under what authority. For AI agents, it requires separate identities, structured logs, and traceable decision records so investigations can distinguish human intent from autonomous execution.
• Shared-device Policy: The governance rules that define how communal endpoints are assigned, authenticated, tracked, and recovered. It connects mobile device management, IAM, and operational workflow so that shared devices remain secure, usable, and accountable across shifts and care settings.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.