Why do shared clinical workstations create identity governance risk?

Why This Matters for Security Teams

Shared clinical workstations turn identity governance into a live operational problem because the device is not owned by one person for one session. In a ward, emergency department, or medication round, the same terminal may be touched by nurses, physicians, pharmacists, and support staff within minutes. If the workstation does not enforce fast lockout, reliable reauthentication, and clean user switching, audit trails can no longer be trusted to reflect the real actor.

That matters for privacy, billing, medication safety, and incident response. Governance teams often focus on directory policy and password rules, but the failure point is usually the session layer, where a valid login outlives the person who originally authenticated. NIST’s NIST Cybersecurity Framework 2.0 frames this as an access and accountability issue, not just a technical convenience problem. NHIMG research on the Ultimate Guide to NHIs shows how often identity controls fail when credentials or sessions outlive their intended use, and the same pattern appears on shared endpoints in clinical settings.

In practice, many security teams discover ambiguous attribution only after a charting error, medication issue, or privacy complaint has already forced a forensic review.

How It Works in Practice

The safest model is to treat the workstation session as a governed identity state, not a casual convenience. Each handoff should end the prior user’s access, reassert the next user’s identity, and preserve an auditable record of who was active when clinical actions occurred. That typically means badge tap, smart card, or other rapid reauthentication, plus automatic screen lock on inactivity and forced logout at shift change or role change.

Practically, the control stack should include:

• Unique user authentication for every clinical action that requires accountability.
• Automatic session timeout tuned to clinical workflow, not generic office use.
• Fast user switching that clears prior context, cached forms, and open approvals.
• Step-up authentication for privileged actions such as prescribing, reconciliation, or release of sensitive records.
• Central logging that ties the session, device, timestamp, and application action to one accountable identity.

Where possible, align endpoint policy with identity controls rather than relying on physical proximity or workstation location. The NIST CSF 2.0 and the NHIMG lifecycle guidance for NHIs both reinforce the broader principle: access should be time-bounded, attributable, and revoked when the task ends. In clinical environments, that means using short-lived sessions and explicit reauth before access to EHR, prescribing, or patient-facing systems resumes.

These controls tend to break down when staff are under severe time pressure and the workstation design forces repeated logins without an equally fast, reliable handoff experience.

Common Variations and Edge Cases

Tighter session controls often increase friction at the bedside, so organisations must balance attribution quality against clinical throughput. That tradeoff is real: if reauthentication is too slow, staff will work around it; if it is too loose, accountability degrades.

Guidance is strongest for shared, public-facing terminals, but best practice is still evolving for hybrid scenarios such as bedside tablets, virtual desktop sessions, and roaming carts. Some environments use proximity badges or tap-to-auth workflows, while others rely on SSO with device binding. There is no universal standard for this yet, so the right pattern depends on patient risk, workflow speed, and local privacy obligations.

Edge cases also matter. Break-glass access, emergency overrides, and shift handoffs may justify temporary exceptions, but those exceptions should be narrowly scoped and heavily logged. High-acuity areas may need shorter timeouts and stronger step-up checks, while lower-acuity administrative areas may tolerate slightly longer sessions. NHIMG’s regulatory and audit perspectives are useful here because they emphasize that auditability is only defensible when the identity record matches the actual operator.

Shared workstations become most dangerous when logout discipline is inconsistent across shifts, because even a well-designed policy loses value once clinicians begin inheriting someone else’s active session.

Related resources from NHI Mgmt Group

• When does AI help identity governance, and when does it create new risk?
• Why do shared social media accounts create a governance risk?
• Why do static roles create governance risk in modern identity environments?
• Why do manual onboarding processes create risk in clinical identity programmes?