Topic starter
25/06/2026 12:12 am
TL;DR: Shared-use devices are often left signed in after use, staff frequently share credentials, and traditional usernames and passwords still underpin access for many organisations, creating a persistent security and workflow gap in healthcare, according to Imprivata research. The underlying issue is that identity controls for shared clinical devices have not kept pace with how care teams actually work.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “The Hidden Security Risk Undermining Healthcare Efficiency”.
By the numbers:
- 74% of shared-use devices are often left signed in after use, according to Imprivata research.
- 79% of staff admit to sharing credentials, according to Imprivata research.
- 44% of respondents cite data security as the most frequent challenge for shared-use device adoption, according to Imprivata research.
Key questions
Q: What breaks when clinicians rely on shared logins or leave medical devices signed in to one user?
A: Shared logins and unattended sessions break accountability, data integrity, and access control.
Q: Why do usernames and passwords create risk on shared healthcare devices?
A: Usernames and passwords authenticate a person, but they do not manage rapid user turnover on the same device.
A: Healthcare teams should design access around the clinician workflow, not around the workstation.
Practitioner guidance
- Enforce automatic session termination Configure shared clinical devices to end sessions at handoff so the next user does not inherit access context from the previous user.
- Move shared-device access off passwords Adopt passwordless authentication and single sign-on for shared clinical workflows so users can re-enter access quickly without credential reuse.
- Build explicit device handoff controls Define a clean sign-out and reassociation process for care-team devices so identity state follows the clinician, not the hardware.
Bottom line: Shared mobile devices in healthcare create an identity governance problem when sessions remain open and credentials are reused across care teams.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:02 am
Shared mobile devices in healthcare expose a governance gap, not just an endpoint hygiene problem. The central issue is that access control is being asked to support a workflow built around rapid handoff, repeated authentication, and shared device use. When identity controls are designed as if each device has one stable user, they fail at the exact moment clinical teams need them most. The practical conclusion is that healthcare IAM has to be engineered for shared-state access, not single-owner assumptions.
A few things that frame the scale:
- 60% of healthcare organisations do not assess a vendor's security before signing a contract that grants access to protected health information, according to Ponemon Institute's 2023 Third-Party Risk in Healthcare report.
A question worth separating out:
Q: Should hospitals treat shared mobile devices as an IAM priority or a device management issue?
A: They should treat them as both, but IAM has to lead because the core risk is identity reuse and session persistence. Device management can secure the hardware, but it cannot by itself solve who is authenticated, when access ends, or how the next user is reassociated. Shared-device governance only works when identity and device controls are designed together.
👉 Read our full editorial: Shared mobile devices expose healthcare IAM gaps and access risk