Topic starter
25/06/2026 2:45 pm
TL;DR: Generic MFA fails in clinical settings because shared workstations, device handoffs, and time-critical workflows require fast, repeatable re-authentication and tight EHR integration, according to Imprivata. Healthcare access security only works when authentication is designed around clinician operations, not adapted after the fact.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Why “one-size-fits-all” multifactor authentication (MFA) fails healthcare providers”.
Key questions
Q: Why does generic MFA fail in healthcare environments?
A: Generic MFA fails in healthcare when it assumes a fixed user-device relationship and slow re-authentication tolerance.
Q: When should healthcare teams prioritise workflow fit over stricter MFA prompts?
A: Healthcare teams should prioritise workflow fit whenever stricter prompts would slow time-critical clinical work and encourage unofficial shortcuts.
Q: What are the signs that MFA is misaligned with clinical operations?
A: Common signs include repeated re-login frustration, informal shared access, clinicians avoiding the intended workflow, and heavy dependence on manual exceptions.
Practitioner guidance
- Map authentication to clinical workflows Identify where clinicians move between shared workstations, device handoffs, and EHR sessions, then redesign MFA requirements around those points of friction.
- Prioritise secure authenticator enrollment Review how authenticators are bound to verified individuals, including whether enrollment is supervised, auditable, and suitable for regulated clinical use.
- Test passwordless options against real clinical constraints Validate whether badge tap, facial recognition, PIN, and similar factors still work when clinicians are gloved, mobile, or unable to rely on personal phones.
Bottom line: Healthcare MFA fails when it is designed for generic office access instead of shared workstations, device handoffs, and clinical time pressure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:52 pm
Clinical MFA fails when identity controls are designed around static endpoints rather than mobile care delivery. Healthcare access is fundamentally shift-based, shared, and interruption-sensitive. A control that works well for office workers can become operationally unworkable in a ward, and once that happens, policy drift and informal workarounds become the real access architecture. Practitioners should treat clinician mobility as a core design constraint, not an exception.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Who should own passwordless governance in a healthcare organisation?
A: It should be shared across IAM, security operations, help desk leadership, and clinical application owners. Passwordless changes how people authenticate, how support teams recover access, and how clinicians work under pressure, so ownership must extend beyond a single technology team to include the workflows it changes.
👉 Read our full editorial: Purpose-built MFA for healthcare: why generic access fails