Why Timeouts Exist
Session timeouts exist because organizations need some way to close the gap between a login and whatever happens after it, and a timer is the simplest tool available. Ten minutes of inactivity, and the session closes. It's a reasonable default, and it's also built on an assumption that doesn't hold up to how quickly access can actually change hands: that risk accumulates gradually, on a schedule a timer can reasonably predict.
Thirty Seconds Is All It Takes
It doesn't. A clinician can step away from an authenticated workstation and have someone else sitting in front of it within thirty seconds, well inside any timeout an organization would set without grinding clinical workflow to a halt. A ten-minute timeout doesn't fail in that scenario because ten minutes was too generous. It fails because it was answering the wrong question from the start: how long has this session been idle, instead of who is actually using it right now.
Idle Time and Identity Are Not the Same Risk
That distinction matters because idle time and identity are two different things measuring two different risks. A session can sit untouched for nine minutes with the authorized user two feet away, phone in hand, and a timeout treats that as low risk. The same session can change hands in the time it takes to answer a page, and a timeout has no way to notice, because nothing about elapsed time changed. Every scenario this series has walked through, the nurse called away mid-shift, the colleague at the shared terminal, the security guards whose sessions never technically failed, shares this same property: the clock kept running normally while the actual risk changed instantly.
What a Timer Can't Catch
This is the piece a purely time-based control can't close, and it's the piece Continuous Authentication is built for. Instead of asking how long a session has been idle, it continuously evaluates whether the behavior inside the session still matches the identity that authenticated it, which means a change in who's actually there gets detected on the scale it actually happens: seconds, not the ten-minute intervals a timeout was ever designed to catch.
The Question This Series Has Been Building Toward
Authentication tells you who authenticated. Continuous Authentication tells you who's using the session. That's the distinction this entire series has been building toward, and it's the one piece most continuous identity strategies still leave unanswered. Healthcare identity programs need to close it before the next abandoned session, not the next audit, finds it first.