A Frustration With a Number Attached
Every conversation about authentication friction in health systems tends to start with an individual complaint: clinicians are frustrated by how often they have to log in. That framing is accurate but it understates the problem, because the cost isn't really about frustration, it's about labor, and labor at this scale has a number attached to it.
The Hours Add Up Fast
Clinicians spend somewhere between 45 minutes and an hour per shift logging into the applications and EHR systems their work requires. Across roughly 155 shifts a year, that works out to approximately 116 hours per clinician annually spent on authentication alone, time that isn't spent on documentation, patient interaction, or anything else the role exists to do. Scale that to a health system with 2,000 clinical staff, a mid-size academic medical center, not an outlier, and the system loses more than 230,000 hours a year to authentication friction before counting a single help-desk ticket, password reset, or device-related delay.
A Floor, Not a Ceiling
That number is a floor, not a ceiling. It doesn't include the non-clinical staff covered earlier in this series, who authenticate into their own set of applications on their own schedules. It doesn't include the operational cost of the friction itself, the help-desk tickets, the account lockouts, the workarounds staff adopt when logging in repeatedly becomes an obstacle to getting through a shift. As one chief medical officer at a Midwest health system put it, "Anytime we add a keystroke to a login, we're taking time out of people's day. If I can give people back an hour of the day to treat patients, that's huge."
The Question Worth Asking Instead
None of this argues that authentication should get weaker. It argues that the cost of getting it wrong isn't abstract, and that the industry's default response to identity risk, add another prompt, shorten another timeout, has a labor cost that rarely gets weighed against the security benefit it's supposed to buy. A health system asking whether it can afford stronger identity assurance is usually asking the wrong question. The more useful one is whether it can afford to keep paying the current authentication model's labor bill indefinitely.