Secure Sign-ins Without Slowing Care

Healthcare organisations are complex and need to balance many competing priorities.  Take for example the need to protect sensitive information while allowing rapid access to technology based systems - all without creating unnecessary barriers for the people providing care.

Staff are always on the move between consultation rooms, shared workstations, or even multiple locations in the never ending response to urgent situations. Sign-in controls need to reflect those realities while still making unauthorised access more difficult.

While Multi-factor authentication (MFA) is an important part of that protection process, enabling MFA is only the beginning. The method used and the policies around it determine how well it works in practice.

Fitting MFA into healthcare workflows

Most healthcare organisations will have a mix of:

• Shared clinical workstations.
• Dedicated desktops and laptops.
• Mobile devices used during visits.
• Remote access for clinicians and support staff.
• Multiple practice or facility locations.
• Clinical, administrative and financial systems.
• Staff working across different shifts.

A shared clinical workstation, a dedicated laptop and a personal mobile device don't need to have the same access treatment as their usage pattern (and risk profile!) are quite different.

A dedicated, managed device (like an allocated laptop) can support a longer session. A shared workstation will need stronger session controls so the next user does not inherit access from the person before them. And an unmanaged device should be subject to additional checks before it can access any sensitive systems or data irrespective of the device location.

The goal is never to create more prompts. It is to apply the right level of verification based on the user, device, location, and information being accessed.

The aim is simple: secure access that supports care rather than slowing it down.

Making unexpected prompts easy to handle

Receiving an unexpected MFA request does happen. The causes are many and not all are malicious, but they must be treated with suspicion and approached with caution.

The response should be clear and consistent:

1. Do not approve the request - Deny It
2. Report it to the nominated support or security contact.
3. Ask for the account to be reviewed if prompts continue.

Deny --> Report --> Review

Number matching can provide an additional safeguard for organisations using Microsoft Authenticator. Instead of approving a generic notification, the user confirms a number shown during the sign-in process. It can reduce accidental approvals, although phishing-resistant MFA remains the stronger long-term direction.

Staff should never be expected to diagnose a technical incident while managing a busy shift. They only need to know whether they started the sign-in.

A simple rule works well:

If you did not start the sign-in, do not approve it. Deny the request and report it.

High-risk accounts = PRIORITY Response

Not every account represents the same level of risk.

Administrators, finance staff and users with broad access to patient information need to receive stronger protection than accounts with limited permissions. Healthcare organisations should prioritise phishing-resistant MFA for these users, as well as for remote access and high-value applications.

Passkeys and security keys use stronger verification methods than a standard approval notification or one-time code. The Australian Cyber Security Centre (ACSC) recommends phishing-resistant MFA across online services, systems and data repositories.

Organisations do not need to change every account at once. A practical rollout can begin with:

• Privileged accounts
• Remote access
• Microsoft 365 administration
• High-value clinical and business application

Shared Devices + Access policies

Shared devices are common in healthcare and provide both a high value employee interface but also a high-value target for attackers. As such, they need careful configuration. Each user must have an individual sign-in, and device sessions should end cleanly when work is complete - yes, this can cause workflow impacts as sessions timeout and a balance between security and workflow is needed.

Organisations should confirm that shared workstations:

• Do not retain another user's active session
• Remove cached credentials and sensitive information
• Apply suitable ide-session timeouts
• Receive security updates and central management
• Give each user and appropriately controlled session

Conditional Access can help apply different requirements based on the person, device, location and application involved. A compliant device at a known practice location may require a different access decision from an unmanaged device connecting from an unfamiliar location.

These policies should be tested with staff before they are widely deployed. A technically sound policy can still create operational problems if it does not reflect how people work.

Keep accounts individual and access appropriate

Shared accounts may seem convenient, but they make accountability incredibly difficult to manage and audits almost impossible. If several people use one login, it will be nigh on impossible to determine who accessed what information or changed a record.

Unique accounts make it easier to:

• Apply role-based access
• Review activity
• Remove access when someone leaves
• Investigate unusual behaviour
• Support privacy and governance requirements

The Royal Australian College of General Practitioners (RACGP) recommends limiting practice team members to the information required for their work and using access controls that support accountability.

Healthcare leaders should also review emergency access arrangements. Emergency accounts should be limited, strongly protected, monitored and used only under documented conditions.

A Practical Healthcare Review

A focused review does not require an organisation to change everything at once. Start by asking:

• Is MFA enabled for all relevant users?
• Is number matching available?
• Which accounts need phishing-resistant MFA?
• Are legacy authentication methods still active?
• Are shared devices configured for clean sessions?
• Can staff report unexpected prompts quickly?
• Are access logs reviewed by someone responsible?

The answers will help identify the most valuable next step.

Secure access should support care

Healthcare security works best when it respects the environment in which people work.

MFA, Conditional Access, managed devices and audit logging should work together to protect patient and practice information without forcing staff to work around technology. The strongest approach combines better authentication with sensible access policies, clear reporting guidance and regular review.

Microsolve helps healthcare organisations configure Microsoft 365, Entra ID, Intune, MFA and Conditional Access around real operational requirements.