MFA for shared clinical workstations should protect each staff member’s account without turning every room change into a long sign-in process. The starting point is to distinguish a shared computer from a shared account: staff may use the same workstation, but each person should authenticate as themselves.
A practical setup combines individual accounts, a fast and reliable way to switch users, and authentication requirements that match the risk of the access. Before choosing badges, single sign-on, or another method, map how clinical teams actually move through the practice and what happens when a session is interrupted.
Keep the workstation shared, not the identity
A shared clinical workstation is a physical device used by multiple people. A shared account is a common username used by those people. These are not the same thing. If everyone uses one account, it becomes harder to tell whose access or actions are associated with a session, and removing access for one staff member can become more complicated.
Give each staff member an individual account and assign access according to their role. Connect the EHR and other clinical applications to those identities where the systems allow it. Single sign-on (SSO) can reduce repeated application logins, but it should not blur who is using the workstation. When one person leaves and another takes over, the next person needs to establish their own session.
For practical guidance on organizing connected clinical applications, see our article on clinical system integration. The authentication design should preserve identity across the applications staff use, rather than treating the workstation as a permanent, shared user.
Choose an authentication pattern that fits the workflow
There is no single sign-in method that suits every clinical setting. Consider how often staff move between rooms, whether workstations are attended, what the EHR supports, and whether the practice can centrally manage accounts and authenticators.
- Individual sign-in with SSO: A staff member authenticates to a personal session, then accesses connected applications without a separate full login to each one. This can reduce repetition while retaining individual identity. Configure session switching so the next user does not inherit the previous person’s active session.
- Badge-based fast switching: A managed badge workflow may let an enrolled staff member quickly start or resume a personal session. Confirm how identity is verified, how sessions are ended or locked, and what happens if a badge is lost. A badge tap by itself is not automatically MFA. The implementation must use distinct authentication factors when MFA is required.
- Stronger authentication for higher-risk access: Remote EHR access and administrator accounts deserve particular attention. Use an MFA method appropriate to the risk and system capabilities, and consider phishing-resistant options where supported. The NIST MFA guidance explains the role of distinct authentication factors and different MFA approaches.
Badge workflows vary. A badge can demonstrate possession, but whether the whole process qualifies as MFA depends on what else the person uses to authenticate and how the system implements it. Ask the identity or EHR administrator to verify the factors in the actual sign-in flow, rather than assuming that a fast tap is enough.
For healthcare-specific security considerations, the HHS cybersecurity practices guide can help teams think through safeguards alongside their technology setup. Authentication choices should be reviewed with the people responsible for the practice’s security and systems.
Prevent the next person from inheriting an open session
Fast access only helps if handoffs are safe. Set shared workstations to lock after an inactivity interval chosen for the clinical environment, and make it easy for a staff member to lock or switch sessions when stepping away. The interval should balance exposure risk with the realities of care delivery, then be tested with the people who use the workstation.
Make the expected handoff clear: the outgoing user locks or ends their session, and the incoming user authenticates as themselves. Do not rely on a colleague remembering to close applications while leaving the original identity active. Check what happens to EHR sessions, connected applications, and locally saved work when a workstation locks or changes users.
The SAFER System Management Guide offers a healthcare-focused reference for reviewing system management practices. Include session behavior and user access in that review, not just the initial MFA prompt.
Plan for recovery and urgent access
Authentication can fail at an inconvenient moment. Staff may lose a badge or phone, replace a device, or be unable to complete a sign-in while a system is experiencing an outage. Decide in advance how to verify identity, restore access, and revoke an unavailable authenticator.
- Enroll each staff member through a controlled process that links the person to their own account and approved authentication methods.
- Set up an approved backup method when the chosen platform supports one, and explain how staff should report a lost or compromised device or badge.
- Define who can disable a lost authenticator, restore access, and review relevant activity. Avoid informal workarounds such as borrowing another person’s credentials.
- Document an emergency-access process for situations when normal sign-in is unavailable. Limit its use, make activity reviewable, and test it with the people responsible for care and IT.
Authentication is one part of continuity planning. Practices should also know how staff will work if the EHR or network is unavailable. Our guide to a medical practice EHR downtime plan covers planning for that separate but related situation.
Roll out MFA without guessing at the impact
Start with a pilot in the areas and workflows that represent day-to-day use. Include clinical staff, administrative users, and the people who support the systems. Test room changes, breaks, shift handoffs, device loss, account recovery, and the process for locking an unattended workstation.
Ask pilot users where sign-in adds friction and where the workflow makes it unclear who is signed in. Review whether people can switch accounts reliably, whether the EHR session behaves as expected, and whether support staff can resolve common access problems. Adjust the workflow before expanding it across the practice.
Keep an eye on both security and usability. If staff respond to slow sign-ins by leaving sessions open or finding informal shortcuts, revisit the design rather than treating workarounds as normal. Review access when roles change and remove accounts or authenticators when they are no longer appropriate.
Frequently asked questions
Can staff share a workstation account if they use individual EHR logins?
It is generally better to give each person an individual workstation identity as well as individual EHR access. A shared workstation account can make access and activity harder to attribute outside the EHR, and the EHR login does not automatically manage every other application or session on the device.
Does tapping a building badge count as MFA?
Not by itself in every setup. A badge tap may establish possession of the badge, but the complete workflow must use distinct factors to qualify as MFA. Confirm how the badge system is configured and what additional factor, if any, is part of sign-in.
What should the practice do if a staff member loses a badge or phone?
Use a documented identity-verification and recovery process. Disable the lost authenticator when appropriate, provide an approved way to restore access, and review account activity if there is a reason for concern. Staff should know whom to notify.
How should MFA work for remote EHR access and administrator accounts?
Use MFA for these higher-risk access paths, with a method suited to the systems and risks involved. Where supported, evaluate phishing-resistant authentication, and make sure administrator access is individually assigned and reviewed.
Make identity clear and access practical
MFA for shared clinical workstations works best when each staff member has a distinct identity, switching is straightforward, and the practice has tested its lock, recovery, and emergency workflows. Pilot the setup with clinical users before expanding it. If you would like help reviewing healthcare IT security and support needs, contact Zevonix at (904) 658-0777.