Healthcare CISOs and their teams often contemplate the benefits of going passwordless in their organizations but face pushback from clinicians concerned that the new tech will slow down their access to critical patient care systems or disrupt their workflow.
CISOs should begin their passwordless endeavor with a clear and solid assessment of where authentication friction and risk already exist, said Dr. Sean Kelly, a practicing emergency room physician and chief medical officer at security firm Imprivata.
“Sometimes doing a password audit can be really enlightening – understanding the amount of effort and work that’s going into simply logging on and off of systems, or authentication events within systems,” he said.
A recent Imprivata study of 206 healthcare IT leaders found that 85% considered passwordless access as important, but only 7% said their organizations have fully adopted passwordless authentication for clinical and other staff.
“We’ve all had technology foisted upon us in the past that’s difficult to use or slows us down, and passwords are one of those things,” Kelly said of his frontline experience in emergency patient care.
“So anytime new technology is brought up, there’s a little bit of resistance on the part of providers and other clinicians,” he said.
In the interview (see audio link below photo), Kelly also discussed:
- The use of cameras, biometrics and other technology for going passwordless healthcare environments;
- How passwordless access can work alongside existing authentication and identity access management tools;
- Top use cases for passwordless access in healthcare environments.
Kelly is chief medical officer and senior vice president of customer strategy for healthcare at Imprivata, where he leads the company’s clinical workflow team and advises on the clinical practice of healthcare IT security. In addition, Kelly practices emergency medicine at Beth Israel Lahey Health in Boston and is part-time assistant professor of emergency medicine at Harvard Medical School.