Topic starter
06/11/2026 6:37 pm
TL;DR: Shared terminals expose a weakness in conventional multi-factor authentication because many methods still assume one worker, one device, and a personal phone, according to OLOID. In practice, that model can preserve policy compliance on paper while failing to tie each session to a named individual.
Editorial analysis by NHI Mgmt Group, based on content published by OLOID: “Multi-Factor Authentication Examples: Methods, Use Cases, and Best Practices”.
By the numbers:
- MFA blocks more than 99.2% of account compromise attacks, according to Microsoft's published research cited by OLOID.
Key questions
Q: How should teams authenticate workers on shared devices without using shared logins?
A: Use individual identities with device-bound authentication, such as badge tap, smart card, biometric sign-in or a short-lived token, so each worker can authenticate without a shared username or password.
Q: Why do SMS one-time passwords fail in frontline and shift-based environments?
A: SMS one-time passwords fail where staff cannot reliably receive or protect a handset, because the code travels over a phone number rather than a managed device or strong authenticator.
Q: What is the difference between traditional MFA and passwordless authentication?
A: Traditional MFA usually adds a second factor on top of a password, so the login flow still depends on a shared secret.
Practitioner guidance
- Define individual attribution requirements for shared terminals Specify that every session on a shared workstation must be attributable to a named worker, even when the device is reused across shifts.
- Remove personal-phone dependency from frontline access Map where SMS OTP, push approval, and app-based codes fail because staff cannot carry phones, then replace them with methods that work on the floor.
- Adopt passwordless flows for shared workstations Use biometrics, badge-based login, or cryptographic keys to keep access tied to the individual rather than to a reusable shared password.
Bottom line: Shared terminals create an attribution problem that conventional MFA does not resolve when one device serves many workers across a shift.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Standard MFA does not solve individual attribution when the session itself is shared. The control may still satisfy a checklist requirement, but the governance outcome is different when one workstation is reused by multiple people over a shift. In that environment, the real problem is not factor count but identity continuity, and that is why shared-terminal authentication should be evaluated as a session governance issue, not just a login method choice.
A question worth separating out:
Q: What should healthcare teams do to keep shared workstation access attributable?
A: Healthcare teams should assign each user an individual sign-in, then capture a session trail that records who accessed the shared workstation, when they did so and which application or record they opened. Timeouts, re-authentication and central logging keep the access attributable even when the device itself is shared, which supports audit, incident review and access governance. session trail
👉 Read our full editorial: Standard MFA breaks on shared terminals without individual attribution