How should healthcare teams handle MFA on shared workstations?

Why MFA Has to Match the Shared Workstation Model

MFA only adds real protection when the workstation, account model and session lifecycle all reinforce individual identity. On shared clinical desktops, the key question is not just whether MFA exists, but whether each user can prove who they are without leaving a usable session behind for the next person. That is why fast user switching, distinct accounts and automatic timeout matter as much as the factor itself.

When the workstation is shared, the control objective shifts from “challenge the login” to “preserve identity separation after login.” If the device stays signed in, the next user can inherit access without reauthenticating, which defeats the point of MFA even if the first sign-in was strong. Healthcare Identity Security Guide covers the shared-workstation pattern in clinical environments, including clinician access and tap-and-go style workflows.

How to Keep Clinical Access Individual, Fast and Defensible

The practical design goal is to make sign-in quick enough for busy care settings without collapsing into shared credentials. Badge-based or token-based sign-in can support this when it is tied to an individual account and a short-lived session, so the user identity is explicit even if the sign-in step is streamlined. The control fails when convenience is bought by making everyone share one login or one “generic” shift account.

Shared workstations also need a clean handoff between users. That means the previous session should end, the screen should lock promptly, and the next clinician should authenticate as themselves rather than inherit the previous user’s open chart, inbox or admin function. Workforce Identity Security Guide addresses phishing-resistant MFA, session theft and recovery patterns that are directly relevant when clinical access depends on fast reauthentication.

In environments with Epic, Cerner or similar EHR access, the question to answer is whether the authentication method preserves accountability at the point of action. If it does not, the environment may be faster, but it is not meaningfully controlled.

What Goes Wrong When MFA Is Treated as a Login-Only Control

The common failure is assuming that MFA on the first login prevents the downstream misuse of an unlocked workstation. It does not. If a user walks away and the session remains active, the next person can often view or act as that user without presenting MFA again, which creates patient privacy exposure and a clean path to inappropriate record access.

Another failure mode is credential sharing dressed up as operational efficiency. Once multiple people know the same account, MFA no longer proves which person accessed the record, and revocation becomes weak because you cannot separate one individual from the shared login. MFA Guide is useful here because it distinguishes strong MFA from weaker patterns such as push fatigue and other bypass paths, but the deeper issue on shared workstations is that a factor cannot compensate for a non-individual account model.

If the workstation supports badge tap-in, the badge must still be treated as a personal authenticator, not as a substitute for identity governance. The operational risk is not only misuse by insiders, but also accidental exposure when a busy ward creates a habit of “whoever is nearby can use the open terminal.”

Risk and Threat Considerations

Shared clinical workstations raise both privacy risk and access-control risk because the easiest failure is session inheritance. If MFA is only enforced at the front door and not at handoff, a legitimate user can leave an active session that becomes an open invitation for the next person, whether by mistake or by misuse.

Failure mechanism: The workstation remains authenticated after the first user leaves, or the organisation uses shared credentials that make MFA non-individual. In both cases, the next person can act inside the system without a new proof of identity, which undermines accountability and can expose patient records.

Impact: Teams lose confidence in who actually accessed the chart, and sensitive patient data can be viewed, changed or exported by the wrong person. In regulated care settings, that can create reportable privacy exposure and a difficult investigation trail because the access path no longer maps cleanly to one clinician.

Practitioner Guidance

What to verify: Confirm that every shared workstation has an enforced idle lock or logoff policy, that the next user must authenticate individually, and that no “shared shift account” is being used as a workaround. If the workstation can be reused without a new identity event, the MFA design is incomplete.

Decision rule: If the workflow depends on speed, use a personal fast-authentication method such as badge or token sign-in tied to a named account, then combine it with short session timeouts and clear user handoff. If the workflow cannot preserve individual accountability, simplify the access model rather than weakening the control.

Practitioner takeaway: On shared workstations, MFA is only effective when identity remains individual after sign-in, because the real control boundary is the session handoff, not the login screen.

Related resources from NHI Mgmt Group

• Why do shared workstations create so much access friction in healthcare?
• How should security teams handle idle sessions on shared workstations without disrupting access for legitimate users?
• What breaks when MFA is not applied consistently to healthcare workers, shared devices, and legacy access paths?
• How should healthcare organisations implement Zero Trust when clinicians rely on shared workstations and fast user switching?