Walk the halls of almost any care facility and you may find a password somewhere it should not be: a sticky note on a monitor, a list taped inside a cabinet or a shared login everyone knows. Staff are not careless. They are busy, they switch between many systems and they need to get to a resident's record quickly. A policy that ignores that reality will be ignored in return.
This article offers a password approach that fits real care environments, and explains where a password manager belongs.
Stolen or guessed credentials remain one of the most common ways attackers get into healthcare systems. Once someone has a valid login, they can look like an ordinary user. HIPAA's Security Rule expects procedures for creating, changing and safeguarding passwords, and for tracking who accesses electronic protected health information. Shared logins make that tracking impossible, because the audit log cannot say who did what.
Older advice demanded complex passwords changed every 60 or 90 days. That led people to write them down or make small predictable changes. Current guidance from NIST in its digital identity guidelines favors a different approach:
Longer is better. A passphrase of several unrelated words is easier to remember and harder to crack than a short complex string.
Do not force frequent changes. Change a password when there is a reason, such as suspected compromise, rather than on a fixed calendar.
Check against known bad passwords. Block commonly used and previously breached passwords.
Use multi-factor authentication wherever possible, so a password alone is not enough.
These principles reduce the pressure that drives sticky notes in the first place.
A password manager is a secure vault that stores unique passwords for each system and fills them in for the user. The user remembers one strong passphrase, plus a second factor. Benefits for a care organization include:
Each system gets a long, unique password, so one breach does not unlock everything.
Staff stop reusing the same password across work and personal accounts.
Administrators can share access to a department system without sharing the actual password in email or on paper.
Departing employees lose access in one step.
Business-grade managers allow central administration, sharing groups and activity logs. Personal consumer versions generally do not give an organization that control, so choose accordingly.
On the nursing floor, staff often log in dozens of times a shift on shared computers. Typing a long passphrase each time is not realistic. Better options include:
Proximity badge or card tap to sign in, paired with a short PIN
Single sign-on, so one login opens several applications
Automatic session locking after a short idle time, with fast reconnect
Fast user switching so a session is not left open for the next person
If your EHR or workstation environment supports badge tap, it usually removes more risk than any written policy.
A generic login such as nurse station one may feel convenient, but it removes accountability. If a resident's record is viewed inappropriately, you cannot tell who did it. Shared accounts also make it impossible to disable one person's access when they leave. Aim for individual logins everywhere. Where equipment truly requires a shared account, document it, limit what it can do and know who is responsible.
A good password policy can fit on one page. Cover these points:
Use a passphrase of at least a stated minimum length.
Never share a password, including with supervisors or IT.
Never store passwords on paper at workstations or in unprotected files.
Use the approved password manager for work credentials.
Report a suspected compromise immediately, without blame.
Multi-factor authentication is required for email, remote access and administrator accounts.
If you find passwords on sticky notes, treat it as a signal that the system is hard to use, not that staff are at fault. Ask what slows them down. Often a badge reader, an approved vault or a simpler sign-in process fixes it for good.
Begin with a quick walk-through of your facility to see where passwords are written down, and ask staff what makes sign-in painful. Then pick one or two fixes, such as a business password manager for the office and badge tap for shared floor computers.
UnityCare IT helps care organizations choose and deploy password tools, multi-factor authentication and sign-in methods that fit real workflows. If your staff are working around your password rules, we can help you build rules they can follow.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172