Topic starter
24/06/2026 11:18 pm
TL;DR: Healthcare organisations are still relying on passwords even as 42% of surveyed leaders say they raise breach risk and 46% report risky workarounds in daily operations, according to Imprivata’s research on passwordless authentication. The real issue is not just stolen credentials, but authentication models that do not fit clinical workflows or help desk realities.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Why healthcare organisations need to stop trusting passwords”.
By the numbers:
- 46% reported risky password-related workarounds occurring in daily operations.
- 60% of healthcare organisations still rely heavily on passwords.
- Only 7% have fully adopted passwordless access across their organisations.
Key questions
Q: What breaks when healthcare access still depends on passwords?
A: Passwords break down when clinical speed and security are forced into the same rigid workflow.
Q: Why do manual password reset processes create security risk in healthcare?
A: Manual recovery creates uneven assurance because each technician may verify identity differently, and that inconsistency is easy to exploit through social engineering.
Q: How should organisations decide which users can move to passwordless first?
A: Start with personas and use cases, not with a blanket policy.
Practitioner guidance
- Map password-heavy workflows that create unsafe shortcuts Identify clinical, enterprise, and remote access steps where users routinely bypass intended controls because passwords are too slow or too brittle for the work.
- Treat reset and recovery paths as privileged access flows Review help desk scripts, manual verification steps, and override approvals as if they were high-risk identity transactions.
- Reduce dependency on reusable shared secrets Prioritise phishing-resistant passwordless methods where they fit clinical operations, and remove password fallback paths that remain central to normal access.
Bottom line: Passwords in healthcare now create both security exposure and operational friction, especially where clinicians rely on shared devices and urgent access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:05 am
Password dependence in healthcare is now a control failure, not a user habit. The article shows that passwords persist because they are embedded in clinical workflow, help desk recovery, and multi-vendor access sprawl. That makes the problem structural: the organisation is governing access through a mechanism that the environment itself keeps defeating. The practitioner conclusion is that authentication design must be evaluated against actual care delivery, not idealised login behaviour.
A question worth separating out:
Q: What is the difference between passwordless authentication and MFA?
A: Passwordless changes the primary login factor by replacing passwords with possession or biometric proof. MFA is broader and requires more than one factor, regardless of whether one of those factors is passwordless. In practice, many secure deployments combine both, because passwordless alone does not guarantee strong identity assurance.
👉 Read our full editorial: Passwordless authentication is becoming a healthcare security control