Topic starter
25/06/2026 12:13 am
TL;DR: Shared mobile devices in healthcare are frequently left signed in, with 79% of staff sharing credentials and 74% of devices often remaining authenticated after use, according to Imprivata research. The security problem is not device mobility itself but weak identity governance around shared access, which turns workflow convenience into patient-data exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “The Hidden Security Risk Undermining Healthcare Efficiency”.
By the numbers:
- 74% of shared-use devices are often left signed in after use.
- 79% of staff admit to sharing credentials.
- 44% of respondents cite data security as the most frequent challenge for shared-use device adoption.
Key questions
Q: What breaks when clinicians rely on shared logins or leave medical devices signed in to one user?
A: Shared logins and unattended sessions break accountability, data integrity, and access control.
Q: Why do shared credentials create more risk in healthcare than in many other sectors?
A: Shared credentials weaken attribution in environments where timing, responsibility, and patient safety all matter.
Q: When should healthcare teams prioritise passwordless access over passwords on shared devices?
A: Teams should prioritise passwordless access when clinicians use shared devices repeatedly during a shift and password entry creates lockouts, workarounds, or credential sharing.
Practitioner guidance
- Enforce automatic session termination on shared devices Require sign-out or session expiry at handoff points so the next clinician must re-establish identity before any patient data is visible.
- Replace shared passwords with fast verified access Use single sign-on, passwordless methods, or biometrics so clinicians do not need to share credentials to regain access during care delivery.
- Inventory devices that remain signed in after use Track which shared endpoints routinely retain authenticated sessions, then prioritise those locations for tighter logout and re-authentication rules.
Bottom line: Shared clinical devices expose a governance gap when sessions, credentials, and user accountability are allowed to drift apart.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:04 am
Shared clinical device risk is an IAM governance problem disguised as endpoint convenience. The article shows that workflow efficiency can conceal unmanaged access persistence, credential sharing, and weak authentication state. In clinical settings, the core issue is not whether the device is mobile but whether the identity attached to it is still governed when the user moves on. The practitioner takeaway is that device sharing must be treated as a controlled identity lifecycle, not a convenience exception.
A few things that frame the scale:
- 60% of healthcare organisations do not assess a vendor's security before signing a contract that grants access to protected health information, according to Ponemon Institute's 2023 Third-Party Risk in Healthcare report.
A question worth separating out:
Q: How do organisations know shared-device IAM is actually working?
A: Shared-device IAM is working when devices do not stay authenticated across handoffs, clinicians do not need to share credentials, and help desk lockouts decline without increasing unsafe shortcuts. The clearest signal is that access is re-established quickly for each user while audit trails still tie actions to a single identity.
👉 Read our full editorial: Shared healthcare devices expose identity gaps in clinical IAM