Healthcare Workers Lose Thousands of Hours to Authentication Errors, Imprivata Report Finds
Frontline staff face frequent access delays, leading to risky workarounds and significant annual productivity losses across healthcare organizations.
Key points
- Frontline healthcare workers lose an average of 2.5 hours per month to authentication issues.
- Ninety-five percent of organizations report staff using risky workarounds like credential sharing.
- Fifty-seven percent of organizations suspect AI-assisted impersonation attempts in the past year.
Frontline healthcare workers are losing significant time and introducing security risks due to persistent authentication failures, according to a new report from Imprivata. The study highlights how technical barriers to accessing patient data are creating operational delays and encouraging dangerous security bypasses among medical staff.
The data reveals that 37% of frontline workers experience an authentication issue in a typical month. Each affected individual is interrupted approximately 11 times, resulting in an average loss of 2.5 hours of working time per month. For an average surveyed organization with roughly 2,800 frontline employees, this inefficiency accumulates to 32,400 lost working hours annually, impacting both productivity and patient care continuity.
Operational Workarounds and Security Risks
To circumvent these delays, nearly all organizations (95%) have observed frontline workers employing risky workarounds. According to Imprivata, 40% of staff stay logged in to avoid re-authentication, while 36% attempt to bypass multi-factor authentication or other security controls. Additionally, 33% share credentials with colleagues. These practices create a significant accountability gap, as only 40% of decision-makers are very confident that frontline access can be accurately attributed to the correct individual.
This erosion of access control coincides with a rise in sophisticated attacks. Fifty-seven percent of organizations report confirmed or suspected AI-assisted or deepfake employee impersonation in the past 12 months, with 23% confirming an actual incident. Furthermore, 62% report unauthorized account-recovery or password-reset attempts, and 60% report social-engineering attacks targeting the service desk. Frontline concern reflects this threat landscape, with 48% expressing high anxiety about AI-enabled impersonation, matching their concern for conventional social engineering.
Impact on Healthcare Organizations
The findings underscore a critical tension between security protocols and clinical efficiency in healthcare settings. The high rate of credential sharing and bypass attempts suggests that current authentication mechanisms are often perceived as obstacles rather than safeguards. This behavior exposes organizations to internal threats and weakens the audit trails necessary for compliance and incident response. The widespread use of workarounds indicates that security policies may not be aligned with the practical demands of frontline medical workflows.
What should you do?
Organizations should review authentication logs to identify high-friction access points that drive workaround behaviors. Security teams should monitor for unusual access patterns, such as multiple users logging in from the same device or simultaneous logins, which may indicate credential sharing. Leadership should assess whether multi-factor authentication methods are optimized for speed and usability to reduce the incentive for bypassing controls.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: Imprivata
- Audit authentication logs to identify recurring failure points that cause staff frustration and potential workarounds.
- Implement behavioral monitoring to detect anomalies like shared sessions or rapid credential changes that suggest bypass attempts.
- Evaluate the usability of multi-factor authentication methods to ensure they do not significantly delay critical clinical tasks.
- Train service desk staff to recognize and verify identity during account recovery requests to mitigate social engineering risks.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How much time do healthcare workers lose to authentication issues?
Frontline workers lose an average of 2.5 hours per month, with 37% experiencing at least one issue monthly.
What are common workarounds for authentication difficulties?
Staff often stay logged in to avoid re-authentication, attempt to bypass multi-factor controls, or share credentials with colleagues.
How prevalent is AI-assisted impersonation in healthcare?
Fifty-seven percent of organizations report confirmed or suspected AI-assisted or deepfake employee impersonation in the past year.
