Sign in / sign out

Identity on a workstation twelve people share, in a corridor, mid-shift, with gloves on. Every attributed action in the system — every acknowledgement, every override — depends on this being both correct and fast.

Overview

Clinical authentication has an unusual property: the security control and the safety control point in opposite directions. Security wants short sessions and frequent re-authentication. Safety wants a clinician never to be locked out of a patient's data during a resuscitation.

This pattern resolves that by separating reading from attributing. Access to view is protected but generous; the ability to write something into a patient's record with your name on it is protected strictly. Nothing here ever stands between a clinician and information they need to act.

Sign in

• Badge or proximity first. Typed credentials are the fallback, not the primary path — a shared workstation that requires typing gets one shared account.
• The workstation identifies itself. "ED workstation 4" tells a clinician which physical machine they are about to act from.
• Caps Lock is surfaced. Small, but it is the single most common cause of repeated failed sign-ins on a gloved keyboard.
• Never mask the username. Only the secret is obscured.
• Failures state what to do, never how many attempts remain in a way that helps an attacker or panics a clinician.

Emergency access

• Never denied, never delayed. Access is granted on the first action; the reason is captured alongside, not as a gate.
• Full access, not degraded. A break-glass session that hides data is a break-glass session that gets worked around.
• Permanently visible while active. A persistent Urgent banner, so nobody forgets they are in an audited session.
• Time-boxed and notified — expiry on screen, clinical lead informed at the time, not in a monthly report.

Locking, not logging out

Idle timeout is where most clinical systems get this wrong. Blanking the screen during a resuscitation is a safety failure; leaving a writable session open in a corridor is a security one. The system does neither.

Switching user

The highest-risk transition in this pattern, because the person changes while the patient context does not.

• The new user re-confirms the patient before any write — the same control described in Patient header.
• Unsaved work is never silently carried across identities. A draft assessment started by one clinician is either explicitly claimed by the new one, or discarded with notice — never quietly attributed to whoever happens to be signed in.
• Switching is one action from the locked state. Making a colleague wait through a full sign-out cycle is how shared sessions start.
• The audit records both: the session that ended and the one that began, with the overlap.

Showing who is signed in

• Name and role in the masthead at all times — "S. Whitfield · Registrar". Not an avatar alone; an initial in a circle is not an identity.
• Role matters as much as name. It sets what the person can attribute, and a colleague reading the screen needs it.
• The workstation is named too, so a clinician knows which physical machine their actions are coming from.
• Never rely on a hover or a menu to reveal identity.

Do's and don'ts

Accessibility

• Real form controls with associated <label> elements and correct autocomplete tokens, so password managers and assistive technology both work.
• Never block paste in a password field — it defeats password managers and produces weaker credentials.
• Errors are announced and associated with the field via aria-describedby, not only shown in colour.
• Caps Lock warning is a live region, not a decorative icon.
• Lock state is announced on entry, so a screen-reader user knows writes are suspended before attempting one.
• Session-expiry warnings are never the only notice and never dismiss themselves before a slower user can respond.

Outcomes of use

What this contributes to, in the terms of Usability & context of use. These are attributes believed to contribute to an outcome; the outcome itself is settled by observing real use in a specified context, not by this page.

• Effectiveness — Every recorded action is attributed to the person who actually took it. Shared accounts are the failure mode that makes this measure meaningless.
• Efficiency — Seconds to sign in on a shared workstation — the binding constraint. Anything slow enough to be annoying is defeated, and attribution goes with it.
• Satisfaction — Never feeling shut out of a patient's data. Read-only locking exists so that perceived security is bought without perceived obstruction.

Clinical safety notes

• Locking degrades to read-only, never to blank. Mitigates: information withheld during a time-critical event; shared-account workarounds.
• Alarms unaffected by lock state. Mitigates: a signal suppressed by an unrelated security control.
• Emergency access always granted, never delayed, always declared. Mitigates: authentication failure blocking care; and undetected misuse.
• Identity and role permanently visible. Mitigates: actions attributed to the wrong clinician.
• Patient context re-confirmed on user switch. Mitigates: wrong-patient action after a handover at the keyboard.
• Drafts never cross an identity boundary silently. Mitigates: a misattributed clinical assessment in the permanent record.
• Badge-first sign-in. Mitigates: shared logins, which destroy attribution for every other control in this system.

Related

• Patient header — the idle re-confirmation this depends on.
• Clinician override — what attribution is for.
• Acknowledge & escalate — who an alarm is attributed to.
• Dialog — the switch-user confirmation.