A Login Happens Once
A login happens once. It's a single, verifiable event: a person presents credentials, the system checks them, and a decision gets made in a matter of seconds. Everything about how MFA, SSO, and passwordless authentication are built and measured reflects that. They're optimized for the moment.
Identity Doesn't Work on the Same Timescale
A person authenticates at 8:02 a.m. At 8:30, the session is still open. At 9:15, that same person has moved to a different workstation two floors away, and the original session is still sitting there. By 10:00, the access that made sense at 8:02 may not make sense anymore, a shift changed, a patient assignment changed, a device left someone's hands. None of that shows up as an authentication event, because none of it is one.
The Pattern Underneath the Last Three Weeks
The three blogs before this one walked through what that gap looks like in practice: a session left open, a colleague sitting down at someone else's terminal, an identity system that can answer who logged in but not who's using the session now. The pattern underneath all three is the same. Authentication produces a point-in-time judgment: at this moment, there was sufficient evidence that this person was who they claimed to be. Security teams then have to assume that judgment holds for the rest of the session, because nothing in most identity architectures checks it again.
An Assumption That Gets Harder to Defend
That assumption gets harder to defend the longer a session runs and the more the environment around it changes, and the hospital environment changes constantly. People move. Workstations get shared. Shifts overlap. A security model built entirely around the login treats all of that motion as invisible, because it was never designed to see it.
From a Moment to a Process
Treating identity as a process rather than a single decision means the question doesn't close the moment authentication succeeds. It means the organization keeps asking, quietly and without interrupting anyone's work, whether the person operating the session still matches the identity that opened it. This is the operating model the security industry has started calling continuous identity: trust evaluated for the life of a session instead of settled once at the door. It's a different kind of control than a stronger login, and it's the shift this series spends the next several weeks building out: first what it looks like across health systems' full workforce, then how the signal at the center of it, Continuous Authentication, actually works.