Reducing Clinician Burnout and Improving Patient Care With Continuous Authentication

1. Introduction

Overview

One of the largest healthcare systems in the United States, serving over 83,000 clinical, administrative, and partner users, faced a growing operational challenge: its authentication systems were contributing to clinical burnout and were forcing clinicians to divide their time and attention between patient care and security. 

Across 170+ applications and thousands of shared workstations, clinicians were stuck in workflows that prioritized security over user experience. Long, complex passwords, repeated badge taps, and frequent step-up authentications were creating a burden for clinicians, and every extra login, failed session, or help desk call was a drain on patient care delivery. Meanwhile, most market solutions for eliminating passwords introduced new risks: they relied heavily on mobile phones—often restricted in clinical settings—or encouraged shortcuts like storing credentials in clear-text vaults, creating additional security liabilities.

The hospital partnered with Twosense to implement its Continuous Authentication and Continuous Access Evaluation platform across 17,000 users. The solution enabled truly passwordless access without relying on mobile phones, badges, or other hardware, and strengthened security across shared workstations. By automating authentication invisibly in the background, Twosense helped eliminate the friction clinicians faced during login. The result was faster access, fewer interruptions, and measurable gains in clinical efficiency and care delivery.

The impact hasn’t just been technical; it’s been felt directly by the clinicians using it every day. Clinicians have said they look for the Twosense logo because when they see it, they know their day is going to be easier. Fewer logins, less hassle, and no interruptions. It just works in the background, and that makes all the difference.

2. Problem

Identity That Interferes with Patient Care

In 2020, the hospital implemented a 16-character password policy for all users, including both clinical and non-clinical staff. The change, though necessary from a security standpoint, triggered widespread revolt amongst the hospital's workforce. Staff struggled to remember and accurately input long passwords, resulting in frequent login errors, growing dissatisfaction, and helpdesk tickets. The organization recognized it couldn’t lower security standards but needed to reduce friction that was leading to clinical burnout. Passwordless solutions were emerging at the time, but none were fully viable across such a diverse and dynamic healthcare workforce. Traditional approaches were still dependent upon device trust or a mobile push, which broke down in clinical and hybrid environments.

To move forward, the hospital established key requirements for any future solution: eliminate the use of long, complex passwords, support flexible authentication paths for different user groups, and provide instant, reliable identity verification. Additionally, they wanted to prioritize preserving the familiar login experiences — staff shouldn't be forced to change how they work just to accommodate a new authentication process.

The hospital faced complex but common challenges shared by many healthcare organizations. These included widespread use of shared workstations and limited ability to rely on mobile phones. Some clinical areas, such as clean rooms, had strict mobile phone restrictions, while others required PPE like gloves and face shields that made mobile use impractical. The organization also operated in a federated identity environment spanning multiple partner institutions, including affiliated teaching hospitals. and a federated identity environment spanning multiple partner institutions, such as affiliated teaching hospitals. Clinicians needed the ability to move quickly and securely across machines without delays or disruptions.  The organization did not want to, and in many cases could not, roll out new hardware or upgrade thousands of clinical workstations. For a workforce already experiencing burnout, identity friction had become a growing risk to both patient safety and clinician retention.  

3. Solution

Automating Authentication with Twosense

In December of 2024, the hospital deployed Twosense’s Continuous Authentication and Continuous Access Evaluation (CAE) platform across shared workstations. It is a behavior-based, software-only solution that delivers invisible, persistent identity verification and authentication without relying on other hardware or devices (e.g., a phone, card badge, or disruptive user prompts or interactions).

The solution works by generating continuous user trust across the endpoint session from session start to finish. The Twosense agent activates in the background and passively analyzes each user's unique behavioral biometrics, such as subtle patterns in their keystroke cadence, typing rhythm, and mouse movements. These behavioral characteristics are used to create a passive biometric authenticator for the user. This authenticator is unique to each user and runs invisibly in the background at all times. Because it is based on individual biometrics, it cannot be shared, stolen, or passed off to another user, making it inherently resistant to phishing and credential theft..
This behavioral "trust score" is then used as a powerful, live authentication factor, tied into authentication policy as a “something-you-are” factor for seamless multi-factor authentication (MFA). Throughout an employee's session, their real-time behavior is constantly authenticated against their established biometric profile. This guarantees the legitimate user remains present, thereby satisfying authentication requirements for accessing sensitive data or applications without interrupting the user with an MFA prompt. 

Twosense automates over 91% of manual user authentications, requiring no user training and operating invisibly in the background. This enables clinicians to focus on patient care rather than security challenges. This enables clinicians to focus on patient care instead of security challenges. Twosense includes a service-level agreement SLA to detect unauthorized use on an open session within 8.5 minutes of account or session takeover, providing strong protection while maintaining workflow continuity.

4. Key Statistics and Figures

Results: Real Impact on Care Delivery

After just six and a half months in production, the hospital observed clinical and operational improvements that directly supported better patient care:

• 979,000+ passwordless logins were completed successfully
• 91% of authentications automated without user prompts 
• Failed login attempts dropped by 89%, reducing delays, especially during handoffs and shift changes
• 173 applications secured, including time-sensitive tools like the employee time clock
• Login-related help desk calls decreased sharply, freeing both IT and clinical teams to focus on higher-priority work
• User satisfaction soared—many clinicians requested to be enrolled after seeing colleagues benefit

Every percentage point in login success mattered. Every automated and invisible authentication meant a clinician could focus on patient care, rather than losing time to security friction. Every reduced help desk call meant one less interruption in a high-stakes environment.

By automating authentication and enabling seamless transitions between workstations, Twosense gave clinicians something they don’t have enough of: time.

What’s Next

With success across administrative users and growing clinician adoption, the hospital is scaling its deployment:

• Expanding to high-priority clinical units where login friction has historically slowed response times.
• Integrating with the badge access modernization initiative, allowing session persistence across shared workstations.
• Piloting roaming clinician use cases, where staff move across facilities or access systems from non-managed endpoints.
• Reframing IAM as a clinical infrastructure, not just security enforcement.

These next phases aim to improve not just the user experience, but the delivery of care itself.

5. Conclusion

Securing Care Without Slowing It Down

This hospital didn’t just take on the challenge to revolutionize authentication; it is redefining it as essential clinical infrastructure. By deploying Continuous Authentication and CAE, the organization eliminated login delays, reduced password burdens, and regained time for clinicians without compromising security or compliance. 

What began as an effort to reduce clinician burnout became a catalyst for broader operational efficiency, paving the way for higher-quality patient care. With over 979,000 logins, an 89% drop in failed login attempts, and 91% of authentications automated invisibly, the results speak for themselves: security does not have to stand in the way of patient care.

Twosense enabled the hospital to replace friction with trust, automate the user experience, and meet the realities of shared workstations and mobile restrictions head-on. The impact is measurable, and as the hospital continues to scale its deployment, it is proving that identity security does not have to be an obstacle, but a silent, secure enabler of better patient care.