Shared Clinical Logins and 1,100 Orphaned Accounts
Calder Regional Health employs 12,400 staff and 3,100 contractors across 14 sites. Clinical staff use shared ward and theatre workstations, where an average login takes 47 seconds and nurses report logging in up to 30 times per shift. To cope, wards created 240 generic accounts such as WARD4NURSE, which are excluded from MFA and audited only annually. An access review found 1,100 accounts still active for people who left more than 90 days ago, including 12 with domain administrator rights, and found that the HR feed to the identity system runs nightly but excludes agency staff. A smartcard rollout funded two years ago stalled at 40% because theatre staff cannot use cards under lead aprons and gloves. The CISO proposes an 18-month identity programme; the clinical director states that any change adding more than five seconds to login will be rejected by staff.
1. How should the programme eliminate the 240 generic accounts and the orphaned access without adding more than five seconds to clinical login?
Read the worked answer
The generic accounts exist because authentication is too slow and too frequent, so removing them without fixing the cause will simply push staff to workarounds that are harder to detect, such as shared passwords on paper.
- Fix the frequency problem first. Forty-seven seconds multiplied by up to 30 logins per shift is over 20 minutes of lost care time daily. Fast user switching, tap-and-PIN badge login, proximity cards or virtual smartcards on shared devices, plus clinically appropriate session lock timers, cut the number of full authentications rather than the security of each one.
- Replace generic accounts with attributable shared-device sessions. Each clinician authenticates once to the device and receives a personal, role-scoped session; the device, not the person, is on the ward. No activity should be possible under WARD4NURSE.
- Close the orphaned access at source. Fix the HR feed to include agency rosters and to run more than nightly, or add an authoritative agency data source. Add automatic disablement triggers: no login in 45 days, contract end date passed, or no matching active HR or agency record.
- Treat the 12 domain-admin accounts as an emergency. Move them into a privileged access management vault with just-in-time elevation, individual credentials and session recording, ahead of the wider programme.
- Prove it clinically. Run a two-ward pilot and measure total task time, not login time, before the clinical director is asked to endorse the design.
2. Design the authentication model for ward and theatre workstations and explain how you would prove it meets the clinical director's constraint.
Read the worked answer
The constraint is real but it is being measured on the wrong metric, so the design should answer both the perception and the measurement.
Design:
- Single sign-on with a long-lived device session on shared clinical workstations, re-authenticating only for sensitive actions such as prescribing controlled drugs, overriding allergy alerts or accessing VIP records.
- Tap-and-PIN badges or contactless cards carried on a lanyard, not a smartcard in a wallet, because theatre staff in lead aprons and gloves cannot reach a card but can tap a badge reader mounted at theatre height. Keyboards are a poor fallback with gloves.
- Proximity auto-lock and auto-resume so walking away locks the session and returning resumes it without a full login.
- Break-glass for the genuine emergency, with reason codes and retrospective review.
- Second factor reserved for risk moments rather than every session: remote access, privileged actions, and access from outside the clinician's usual site.
To prove it:
- Baseline time-and-motion study on two wards and one theatre suite measuring logins per shift, seconds per login, and time to first order after a shift start.
- Compare pilot against control after eight weeks, using an interrupted time-series, and publish the result to the clinical governance committee.
- Track workaround indicators too, such as generic-account usage and shared-password reports, because those reveal whether the design is actually being used.
3. What controls make break-glass emergency access both usable and defensible in an audit?
Read the worked answer
Break-glass fails in two opposite ways: it is either hidden and unused, or so frictionless that it becomes the normal route. Good design makes it deliberate, fast and loud.
- One action, minimal friction. A single prominent control on the locked screen, a required reason code from a short list and, if possible, a biometric or badge tap. It must work when the network authentication service is down, so a locally cached credential or offline path is essential.
- Scoped, not unlimited. Emergency access should grant the record in front of the clinician, or a defined emergency role, for a bounded period such as four hours, rather than standing full-clinician rights.
- Automatic alerting. Every activation pages the clinical informatics lead and the security operations centre in real time, so an unusual pattern is seen during the event and not in a quarterly report.
- Mandatory retrospective review within 48 hours by a clinician and a privacy officer, with a documented clinical justification; unjustified use goes to the medical director, not just to IT.
- Metrics that make it auditable: activations per 100 admissions, percentage reviewed on time, percentage justified, and time to restore normal access. A rising activation rate is a signal that the standard authentication path is failing, and should be investigated as an availability problem rather than a discipline problem.
- Test it at least twice yearly in a live exercise, including the offline path.