Notifications
Clear all
Topic starter
25/06/2026 2:42 pm
TL;DR: Shared-use mobile devices are now central to UK hospital workflows, but Imprivata reports that 77% of respondents share credentials, 74% leave devices signed in, and 54% have seen breaches from unauthorised mobile access. The security case is no longer abstract: identity controls must keep pace with clinical speed, not fight it.
NHIMG editorial — based on content published by Imprivata: Tech and Innovation Improve Care and Deliver Tangible Savings for UK Hospitals
By the numbers:
- 54% of organisations experienced a data breach due to unauthorised access via employees’ mobile devices.
- 77% of respondents admitted to sharing credentials, while 74% said devices were frequently left signed in after use.
- The 2025 Imprivata State of Shared Mobile Devices in Healthcare Report found that hospitals with shared mobile programs save an average of £522,000 annually.
Questions worth separating out
Q: How should hospitals secure shared mobile devices without slowing clinicians down?
A: Hospitals should make access fast for the individual clinician and strict for the device state.
Q: Why do shared credentials create more risk in healthcare than in many other sectors?
A: Shared credentials weaken attribution in environments where timing, responsibility, and patient safety all matter.
Q: What breaks when mobile devices stay signed in after clinical handoff?
A: When devices stay signed in, the next user may inherit access without re-authenticating, which undermines accountability and can expose patient data to the wrong person.
Practitioner guidance
- Enforce per-user session termination Require automatic sign-out and session reset on every shared clinical device so the next user never inherits the previous identity state.
- Remove shared credentials from ward workflows Replace shared usernames and passwords with individually attributable authentication so access can be tied to a named clinician in audit and incident review.
- Map shared devices into access reviews Include shared mobile endpoints in recurring access recertification, with special attention to contractor use, shift handoffs, and any device that persists across users.
What's in the full article
Imprivata's full article covers the operational detail this post intentionally leaves for the source:
- The hospital mobile workflow findings behind the reported savings, adoption, and compliance metrics.
- The practical detail on shared-device access, sign-in behaviour, and how clinical teams are using mobility at scale.
- The source framing around secure access, SSO, and passwordless authentication in healthcare environments.
- The specific survey results and device-management observations that underpin the article's conclusions.
👉 Read Imprivata's analysis of shared mobile devices and healthcare access risk →
Shared hospital mobile access: what IAM teams need to know?
Explore further
25/06/2026 3:49 pm
Shared clinical devices have become an identity governance problem, not just a mobility problem. The article shows that access, accountability, and patient trust all collapse when a device is treated as a shared convenience layer rather than an attributable identity endpoint. That is a governance failure because the identity model no longer matches the way work is actually performed. Practitioners should treat shared mobile programmes as part of access governance, not endpoint hygiene.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities -- 46% confirmed, 26% suspected, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, which shows how quickly access-control weakness can repeat once governance breaks down.
A question worth separating out:
Q: What should identity and security teams review when hospitals expand shared mobile programmes?
A: They should review session timeout behaviour, per-user attribution, contractor access, and whether mobile devices are included in access reviews. Shared programmes fail when they are managed as endpoint deployments only. They need the same lifecycle discipline applied to any other access path that can expose patient data.
👉 Read our full editorial: Shared hospital mobile access is amplifying healthcare identity risk
