Topic starter
25/06/2026 2:42 pm
TL;DR: Shared-use mobile devices are now central to UK hospital workflows, but Imprivata reports that 77% of respondents share credentials, 74% leave devices signed in, and 54% have seen breaches from unauthorised mobile access. The security case is no longer abstract: identity controls must keep pace with clinical speed, not fight it.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Tech and Innovation Improve Care and Deliver Tangible Savings for UK Hospitals”.
By the numbers:
- 77% of respondents admitted to sharing credentials on shared-use mobile devices, according to Imprivata.
- 74% said devices were frequently left signed in after use, according to Imprivata.
- 54% of healthcare organisations experienced a data breach due to unauthorised access via employees’ mobile devices, according to Imprivata.
Key questions
Q: What breaks when mobile devices stay signed in after clinical handoff?
A: When devices stay signed in, the next user may inherit access without re-authenticating, which undermines accountability and can expose patient data to the wrong person.
Q: Why do shared credentials create more risk in healthcare than in many other sectors?
A: Shared credentials weaken attribution in environments where timing, responsibility, and patient safety all matter.
Q: How should hospitals measure whether shared device access is under control?
A: Track whether every handoff forces re-authentication, whether idle sessions are being locked, and whether logout events match actual clinical task completion.
Practitioner guidance
- Enforce re-authentication at every shared-device handoff Require a fresh identity check when control of a clinical device changes hands, and block inherited sessions from continuing across users.
- Shorten session lifetime on ward devices Set aggressive idle timeouts and automatic lock behavior for devices used in shared clinical workflows so unattended access does not persist between tasks.
- Bind mobile access to task-scoped privileges Grant the minimum access needed for a shift or clinical function, then remove it when the task ends or the device leaves the care area.
Bottom line: Shared hospital devices become risky when credentials are reused and sessions remain open across users, because the identity boundary disappears at the handoff.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:49 pm
Shared mobile access is an identity governance issue before it is a device issue. The article shows that the core risk comes from credentials, sessions, and handoffs, not from mobility alone. In hospitals, shared devices are part of the care model, so the control model has to assume repeated user changes under time pressure. The practitioner conclusion is that access governance must move to the point of device use, not stay anchored only in account issuance.
A question worth separating out:
A: Secure mobile access focuses on protecting the device and its connectivity, while secure identity governance focuses on who is using it, what they can reach, and when that access must end. Hospitals need both, but the identity layer is what prevents inherited access across users.
👉 Read our full editorial: Shared hospital mobile access is amplifying healthcare identity risk