What are the signs that security controls on medical devices are being applied in ways that create new risk?

When medical-device security controls start creating workarounds

Controls are becoming counterproductive when they protect the device on paper but interfere with clinical work in practice. The warning signs are behavioural and operational: staff bypass the control path, share credentials to save time, move devices out of service for “temporary” exceptions, or treat authentication as optional because the process slows care. That is a control failure, not a user-training problem.

In healthcare, the practical test is whether the control still preserves both safety and accountability. A device control that cannot be used during routine care will usually be bypassed, and once that happens the organisation has lost both the intended protection and a reliable audit trail for who did what.

Signals that the control design no longer matches clinical reality

The clearest signal is friction that keeps appearing in the same place. If a control adds repeated delays at the bedside, during device handoff, or in emergency use, clinicians will naturally look for shortcuts. Those shortcuts often include shared logins, “badge-and-go” behaviour that is not actually individual accountability, or delayed logouts that leave sessions open longer than intended. On connected devices, the same mismatch can show up as repeated lockouts, frequent support calls, or a rising number of exceptions after deployment.

Another sign is when the control is technically present but socially bypassed. That usually means the implementation has not matched the workflow, the risk model is too abstract, or the exception path is easier than the compliant path. For medical devices, this is often where strong device security collides with urgent operational use, so the real question becomes whether the control can be applied without making clinicians choose between speed and compliance.

The problem is often visible in account and device lifecycle behaviour too. If passwords are shared, devices are routinely taken out of service, or local authentication is constantly disabled after rollout, the control is no longer functioning as a control. The organisation may still have a policy, but it no longer has effective enforcement.

How to judge whether the security control is helping or hurting

A useful way to judge the situation is to ask what the control changes in day-to-day care. If it improves traceability, reduces misuse, and still allows timely access in normal and urgent cases, it is doing its job. If it mainly generates delays, exception tickets, and informal workarounds, the control design is misaligned and should be reworked before it hardens into a permanent bypass culture.

For device environments, that usually means testing controls against real clinical scenarios rather than idealised workflows. The control should be measured against time-to-access, frequency of exceptions, and the number of users who need to rely on someone else’s credentials. If those indicators are trending the wrong way, the organisation should treat the issue as a design defect in the control path, not merely a compliance gap.

When a control is necessary but too disruptive, the right response is usually to reduce friction without removing accountability. That may mean improving identity proofing at the point of use, narrowing when step-up authentication is required, or separating routine access from high-risk actions so that clinicians are not forced through the same friction for every task.

Risk and Threat Considerations

Controls that are awkward to use often fail in predictable ways: they drive credential sharing, encourage bypasses, and create blind spots where the organisation believes protection exists but no longer has reliable enforcement. On medical devices, that creates both safety exposure and security exposure, because the same workaround that speeds care can also weaken attribution and make misuse harder to detect.

Failure mechanism: The control adds enough delay or interruption that staff optimise around it, turning a protective measure into an exception-driven process with weaker accountability and broader access than intended.

Impact: Shared access, open sessions, and repeated exceptions reduce traceability, increase the chance of unauthorised action, and can expose patient care systems to misuse or compromise.

Practitioner Guidance

What to verify: Check whether clinicians are bypassing the control at the bedside, whether exceptions are concentrated on a small set of devices, and whether support teams are repeatedly resetting or suspending the same safeguard. Those are stronger signals than policy compliance metrics.

Decision rule: If the control cannot support urgent care without frequent workarounds, redesign the workflow before tightening enforcement. A stricter control that users cannot realistically follow usually increases risk rather than reducing it.

What good looks like: The control should be visible, reliable, and fast enough that staff use it without needing an unofficial shortcut, while still preserving individual accountability for access and actions.

Practitioner takeaway: In medical-device environments, the safest control is not the most restrictive one, it is the one clinicians can actually use under pressure without being tempted to bypass it.

Related resources from NHI Mgmt Group

• Why do connected medical devices create identity security risk for hospitals?
• Why do AI deployments create new data security risk even when traditional cloud controls are in place?
• Why do traditional network controls create risk for medical devices in hospitals?
• What are the signs that a consumer agent is being treated like a human user in ways that create security risk?