Multi-factor authentication verifies identity at login, then stops. On a shared hospital workstation, a second employee can sit down at an already authenticated session without ever completing MFA themselves. MFA proves who logged in. It doesn't confirm who's still there ten minutes later, and hospitals need both.
Shared workstations are essential to how many hospitals operate. Nurses, physicians, technicians, registration staff, pharmacists, and other hospital employees may use the same computer throughout a shift, and in some environments a single workstation can be used by dozens of people each day.
Most authentication methods, MFA included, establish a user's identity once, at login. After that point, the system generally assumes the authenticated user remains the person using the session. On a dedicated device, that assumption mostly holds. On a shared one, it breaks constantly: a hospital employee correctly authenticates at 8:00 a.m. and begins working, then at 8:15 leaves the workstation to see a patient, respond to an alert, or move to another area of the hospital. If the session remains active, another person can use it, and that second person may not have authenticated at all. From the application's perspective, the session still appears to belong to the original user.
That gap creates several security concerns:
MFA improves security by requiring additional evidence of identity during authentication, and it helps protect against stolen passwords and other credential-based attacks. But it remains a point-in-time control. Once a user successfully authenticates, MFA does not necessarily continue verifying who is sitting behind the keyboard.
Consider a simple example. A physician authenticates to a workstation using MFA and opens the applications needed for patient care, then walks away. A different employee sits down and continues using the already authenticated session. The second person did not defeat MFA. They inherited a session that had already passed it.
MFA answers one question: did this user successfully authenticate? It does not answer a second, equally important one: is the person using this authenticated session still the person who authenticated? Hospitals need to consider both.
Continuous Authentication addresses this by evaluating identity for the length of a session rather than only at its start, using behavioral signals like typing rhythm and mouse movement to confirm the person at the keyboard still matches the person who logged in. It's the layer MFA was never designed to provide.
MFA strengthens the initial authentication event but does not verify identity once the session begins. If a second person takes over an already authenticated session, they inherit access that has already passed MFA.
Yes. MFA remains an important defense against stolen or guessed credentials at the point of login. It just isn't built to answer what happens for the rest of the session, which is a separate problem that needs a separate control.