Single sign-on in hospitals: security and workflow gains in care

At a glance

What this is: This is a healthcare access management study showing that single sign-on and access management reduced login friction while improving security, privacy, and clinician workflow.

Why it matters: It matters because IAM programmes in healthcare have to balance strong authentication, auditability, and user productivity across human identity workflows that directly affect care delivery.

By the numbers:

• 3.3 million clinician hours were redirected annually from logging-in to patient care across the 55 participating hospitals.
• 60% reduction in desktop login time was measured after deployment of the single sign-on and access management solution.
• Over 50% faster application access was recorded after the solution was deployed.

👉 Read Imprivata's study on single sign-on and access management in hospitals

Context

Single sign-on in hospitals is not just a convenience feature. In clinical environments, every authentication prompt competes with patient-facing work, and every workaround creates both security and privacy exposure. This makes human identity governance part of operational safety, not only an IT control.

The article argues that when clinicians need access to many applications, repeated password entry drives fatigue, shared logins, and session shortcuts. Those behaviours weaken auditability and increase the chance that security controls are bypassed in practice, even when the policy design is sound.

Key questions

Q: How should hospitals reduce login friction without weakening access control?

A: Hospitals should reduce login friction by centralising authentication through single sign-on while keeping strong identity assurance at session start and reauthentication points. The goal is fewer prompts, not weaker accountability. When the access flow fits clinician work, teams are less likely to see shared accounts, delayed logouts, or other workarounds that erode auditability.

Q: Why do repeated passwords create security risk in clinical environments?

A: Repeated passwords create security risk because they encourage fatigue, workarounds, and inconsistent session discipline. In hospitals, clinicians under pressure may share logins, avoid logging out, or take shortcuts that weaken traceability. The result is a governance problem as much as a usability problem, because the identity control model no longer reflects actual behaviour.

Q: What do identity teams get wrong about user convenience in healthcare?

A: Identity teams often treat convenience as separate from security, but in healthcare the two are linked. If access is too slow or disruptive, staff will find alternate ways to work around it. A secure control that people bypass is weaker than a simpler control that preserves verification and auditability.

Q: How do security teams know whether access management is working in hospitals?

A: They should look for shorter login times, fewer authentication interruptions, fewer workarounds, and preserved audit trails. If clinicians can move through their shifts without sharing accounts or delaying logout, the access model is supporting both care delivery and governance. Success is measured in behaviour, not only in policy design.

Technical breakdown

How single sign-on changes clinical access workflows

Single sign-on reduces the number of separate authentications a clinician must complete by creating one trusted session that can be reused across applications. In healthcare, the value is not only fewer logins but also fewer interruptions during time-critical work. Access management layers add device, session, and reauthentication controls so the convenience gain does not become a security gap. The article’s point is that the workflow improvement comes from removing repeated credential entry while preserving traceable access across the clinical estate.

Practical implication: consolidate repetitive application logins into one controlled session and keep strong reauthentication where clinical risk demands it.

Why passwords create workflow and governance friction in hospitals

When clinicians must remember multiple passwords for desktops, EPRs, and clinical systems, the result is authentication fatigue. That fatigue often produces insecure workarounds such as shared accounts, delayed logouts, or avoiding sign-out altogether. From an identity governance perspective, the problem is not simply user annoyance. It is the erosion of accountability and session integrity, because the user experience no longer matches the security model. The article shows that access design has to fit real clinical practice if governance is to hold.

Practical implication: measure authentication friction as a governance metric, not just a usability metric, because friction drives policy bypass.

How two-factor authentication and smartcard integration support secure clinical access

The article describes a model where single sign-on is combined with two-factor authentication and NHS Spine smartcard integration. That pattern matters because it shows how identity assurance can be maintained while reducing repeated login effort. The technical design depends on strong initial verification, session continuity, and automatic locking with reauthentication when needed. In other words, the control objective is not to remove security steps, but to move them to the points where they add value instead of creating constant disruption.

Practical implication: pair single sign-on with identity assurance controls and session locking so fewer prompts do not mean weaker access governance.

NHI Mgmt Group analysis

Human identity governance fails when security controls create routine workarounds: In clinical environments, repeated password prompts are not a minor inconvenience. They push staff toward shared logins, delayed sign-outs, and other behaviours that weaken auditability and privacy protection. The governance failure is that policy assumes users will tolerate friction that real care delivery cannot absorb. The implication is that IAM design in hospitals must be judged against actual clinician workflow, not against control intent alone.

Access management is a patient-safety control, not just a productivity control: The article links authentication delays to care disruption, fatigue, and burnout, which means identity design affects operational health as well as cybersecurity. When login overhead consumes attention during high-pressure clinical work, the security programme becomes part of the service burden. That makes access governance a frontline dependency for healthcare delivery. Practitioners should treat secure access as part of clinical resilience, not a separate technical layer.

Session integrity is the named concept this study surfaces: Fast access only matters if the identity session remains auditable, locked when idle, and tied to the right person at the right time. The study shows that session integrity can be preserved with automatic locking, reauthentication, and smartcard-backed access while removing repeated login pain. That is the governance pattern hospitals should examine when balancing usability and accountability. The implication is to redesign access around verified sessions rather than repeated authentication events.

Hospital IAM programmes should stop measuring success only by login control strength: The stronger signal is whether clinicians can complete work without bypassing the control model. This study shows that human IAM can improve both security and throughput when it is aligned to actual workflow conditions. That matters beyond healthcare because many identity programmes still optimise for control visibility while ignoring user behaviour under pressure. Practitioners should assess whether their access model survives contact with real operations.

Identity control quality in healthcare must be judged by both assurance and adoption: A technically sound login process that staff cannot live with becomes a governance liability. The article’s results show that reducing authentication friction can return time to care without sacrificing security. That creates a broader lesson for human IAM and lifecycle governance: controls that fit work patterns are more likely to remain in force, and controls that fight work patterns will be bypassed. Practitioners should design for compliance that people can sustain.

From our research:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to Ultimate Guide to NHIs.
• Only 5.7% of organisations have full visibility into their service accounts, which shows how often identity inventory remains incomplete in practice.
• That visibility gap is why teams should also review NHI Lifecycle Management Guide for a practical lifecycle control baseline.

What this signals

Hospitals that modernise access should treat identity design as an operational dependency, not a back-office control. If clinicians still have to fight the login process, the programme is already paying a hidden cost in workarounds and lost trust.

Session integrity: the next frontier in human IAM is not just stronger authentication, but access that remains traceable and usable under real workload pressure. That matters wherever high-friction logon patterns push staff toward shared sessions or bypass behaviour.

The broader signal for identity leaders is that user experience and security outcomes are now inseparable in regulated environments. Teams that tune access controls for the work actually being done will see better adoption, cleaner audit evidence, and lower governance drift.

For practitioners

• Measure authentication friction as a control risk Track login duration, frequency of reauthentication, and the rate of shared-account workarounds across clinical workflows. Treat those indicators as evidence that the access model is misaligned with operational reality.
• Consolidate repeated application access into controlled sessions Use single sign-on to reduce redundant credential prompts while preserving strong initial assurance, automatic locking, and reauthentication where the workflow demands it. Keep session traceability intact across all clinical systems.
• Pair access simplification with strong identity assurance Integrate two-factor authentication and trusted device or card-based controls so reduced friction does not lower confidence in who is accessing patient systems. Verify that fast access remains auditable.
• Eliminate workarounds that undermine auditability Identify places where clinicians delay logout, reuse sessions, or share credentials to avoid interruptions. Replace those behaviours with access paths that are faster than the workaround and easier to govern.

Key takeaways

• Repeated authentication in hospitals is a governance problem because it drives workarounds that weaken accountability and privacy.
• The study links single sign-on and access management to measurable gains in login speed, clinician time, and secure access.
• Healthcare IAM should be judged by whether it preserves auditability while reducing friction for frontline staff.

Key terms

• Single Sign-On: Single sign-on lets a user authenticate once and access multiple applications without repeating the login process. In healthcare, it reduces interruption during care delivery while preserving central control over session identity, reauthentication, and audit visibility across clinical systems.
• Access Management: Access management is the set of controls that decides how, when, and under what conditions an identity can enter systems. In practice it combines authentication, session control, device or card trust, and logging so access remains both usable and accountable.
• Session Integrity: Session integrity is the assurance that an active session remains tied to the right identity and can be trusted for its full duration. It matters when access is simplified, because faster entry must still support locking, reauthentication, and auditability when risk changes.
• Clinical Workflow Friction: Clinical workflow friction is the operational burden created when security steps slow or interrupt patient care tasks. In identity governance, it is a useful signal because excessive friction often leads to workarounds, weaker compliance, and reduced confidence in the access model.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.

This post draws on content published by Imprivata: single sign-on and access management in hospitals in the UK and Ireland. Read the original.