Sign in / sign out
Identity on a workstation twelve people share, in a corridor, mid-shift, with gloves on. Every attributed action in the system — every acknowledgement, every override — depends on this being both correct and fast.
Overview
Clinical authentication has an unusual property: the security control and the safety control point in opposite directions. Security wants short sessions and frequent re-authentication. Safety wants a clinician never to be locked out of a patient's data during a resuscitation.
This pattern resolves that by separating reading from attributing. Access to view is protected but generous; the ability to write something into a patient's record with your name on it is protected strictly. Nothing here ever stands between a clinician and information they need to act.
Fast
Sign-in on a shared workstation is measured in seconds and works with gloves. Anything slower gets defeated by shared logins, which destroys attribution entirely.
Unambiguous
Who is signed in is visible at all times, not buried in a menu. A clinician acting under a colleague's session is an attribution failure with clinical consequences.
Never obstructive
No authentication state ever hides clinical information already on screen or blocks an emergency pathway. Locking degrades to read-only, never to blank.
Sign in
- Badge or proximity first. Typed credentials are the fallback, not the primary path — a shared workstation that requires typing gets one shared account.
- The workstation identifies itself. "ED workstation 4" tells a clinician which physical machine they are about to act from.
- Caps Lock is surfaced. Small, but it is the single most common cause of repeated failed sign-ins on a gloved keyboard.
- Never mask the username. Only the secret is obscured.
- Failures state what to do, never how many attempts remain in a way that helps an attacker or panics a clinician.
Emergency access
Every clinical system needs a path for the case where authentication is broken, the directory is unreachable, or the clinician in front of the patient is not the one with an account. The design question is never whether to have it, but how to make it fully available and fully visible.
- Never denied, never delayed. Access is granted on the first action; the reason is captured alongside, not as a gate.
- Full access, not degraded. A break-glass session that hides data is a break-glass session that gets worked around.
- Permanently visible while active. A persistent Urgent banner, so nobody forgets they are in an audited session.
- Time-boxed and notified — expiry on screen, clinical lead informed at the time, not in a monthly report.
Locking, not logging out
Idle timeout is where most clinical systems get this wrong. Blanking the screen during a resuscitation is a safety failure; leaving a writable session open in a corridor is a security one. The system does neither.
| While locked | Behaviour |
|---|---|
| Clinical data on screen | Stays visible. Never blanked, never blurred. |
| Alarms | Fully visible and audible. Locking never suppresses a signal. |
| Navigation and viewing | Permitted — reading is not an attributed action. |
| Any attributed write | Blocked until identity is re-established. |
| Resume | Badge tap or credentials. Same user returns to the same context. |
| Switch user | New identity, and the patient context is re-confirmed. |
A blanked screen during an arrest costs seconds that matter, and reliably produces the workaround that defeats the whole control: a shared account nobody logs out of. Read-only locking protects attribution — which is the actual clinical risk — without ever putting a login prompt between a clinician and the information in front of them.
Switching user
The highest-risk transition in this pattern, because the person changes while the patient context does not.
- The new user re-confirms the patient before any write — the same control described in Patient header.
- Unsaved work is never silently carried across identities. A draft assessment started by one clinician is either explicitly claimed by the new one, or discarded with notice — never quietly attributed to whoever happens to be signed in.
- Switching is one action from the locked state. Making a colleague wait through a full sign-out cycle is how shared sessions start.
- The audit records both: the session that ended and the one that began, with the overlap.
The draft cannot cross an identity boundary without a decision.
Someone else's draft, silently re-attributed. The audit trail now says Bergström wrote something Whitfield wrote.
Showing who is signed in
- Name and role in the masthead at all times — "S. Whitfield · Registrar". Not an avatar alone; an initial in a circle is not an identity.
- Role matters as much as name. It sets what the person can attribute, and a colleague reading the screen needs it.
- The workstation is named too, so a clinician knows which physical machine their actions are coming from.
- Never rely on a hover or a menu to reveal identity.
Who holds each rule
Sign-in is almost entirely behaviour, and almost none of it is a component. What the package can hold is what the screen says while it happens.
| Rule | Held by | Where |
|---|---|---|
| Name and role, never initials, whenever the masthead is given them | Masthead | user takes a name and a role and renders both. It cannot know whether the session they belong to is still the one at the keyboard.Asserted: Masthead: the product and the signed-in identity are both named |
| …at all times | The implementer | user is optional, so a masthead rendered without it shows no one. This row used to hold “at all times” for the component. Passing the signed-in identity on every screen is yours. |
| Never mask the username | Text field | A text field is a text field; only the password control masks. Using one for the identifier is a choice the type makes easy. Asserted: TextField: the label is bound to the input by id |
| The audit records both the outgoing and incoming identity | Event log | Two entries, two actors, both attributed. The record cannot hold an unattributed switch. Asserted: EventLog: every entry names an actor, and says whether it was software |
| The new user re-confirms the patient | Dialog | A confirmation with a way out as well as a way on; the question it asks is yours. Asserted: Dialog: cancel precedes confirm in reading order |
| Badge or proximity first | The implementer | Hardware integration. |
| The workstation identifies itself | The implementer | The masthead can render a workstation name if you pass one. Knowing which workstation this is comes from your deployment. |
| Caps Lock is surfaced | The implementer | A keyboard-state listener you write. The text field does not watch the modifier keys. |
| Failures state what to do | The implementer | The error string is yours; Text field only guarantees it is added to the hint rather than replacing it. |
| Never denied, never delayed; full access, not degraded | The implementer | Authorisation policy. A break-glass path is a feature of your identity provider. |
| Time-boxed and notified | The implementer | A timer and a notification. The package has neither for a session. |
| Unsaved work is never silently carried across identities | The implementer | The textarea holds no draft state at all — see its table — so the draft that must not cross a user switch is one you are holding somewhere else. |
| Switching is one action from the locked state | The implementer | Screen flow. |
A pattern page has no component underneath it, so a rule stated here is held by whoever builds against it unless a component already holds it. Of these 12 rules, 4 are held by a component this package ships, and 8 are the implementer’s. Four held, eight not. The rule with the largest consequence — that a draft never crosses an identity boundary — is one the package cannot see, because it holds no drafts.
Do's and don'ts
Locking degrades to read-only. Nothing is hidden; only attributed writes are suspended.
A blanked screen during an arrest. This is what produces the shared account nobody logs out of.
Signed in as S. Whitfield. Draft note for HARLAND, A. found from the previous session.
Claim it Discard it
The draft is named, its previous owner is implied, and the new user decides. Nothing is adopted silently.
Signed in as S. Whitfield.
Clinical note: “Patient reports chest pain since …” (unsaved)
The previous user’s half-written note is now in this user’s session, and will be committed under their name.
Accessibility
- Real form controls with associated
<label>elements and correctautocompletetokens, so password managers and assistive technology both work. - Never block paste in a password field — it defeats password managers and produces weaker credentials.
- Errors are announced and associated with the field via
aria-describedby, not only shown in colour. - Caps Lock warning is a live region, not a decorative icon.
- Lock state is announced on entry, so a screen-reader user knows writes are suspended before attempting one.
- Session-expiry warnings are never the only notice and never dismiss themselves before a slower user can respond.
Outcomes of use
What this contributes to, in the terms of Usability & context of use. These are attributes believed to contribute to an outcome; the outcome itself is settled by observing real use in a specified context, not by this page.
- Effectiveness — Every recorded action is attributed to the person who actually took it. Shared accounts are the failure mode that makes this measure meaningless.
- Efficiency — Seconds to sign in on a shared workstation — the binding constraint. Anything slow enough to be annoying is defeated, and attribution goes with it.
- Satisfaction — Never feeling shut out of a patient's data. Read-only locking exists so that perceived security is bought without perceived obstruction.
Clinical safety notes
Trace these in your risk file (ISO 14971) and usability engineering file (IEC 62366-1). Each bullet says what checks it: a component that holds the rule, a test in your verification file, deployment configuration, post-market surveillance, or a design review where no test can see it. A control checked by nothing is a sentence.
- Locking degrades to read-only, never to blank. (a test in your verification file) Mitigates: information withheld during a time-critical event; shared-account workarounds.
- Alarms unaffected by lock state. (a test in your verification file) Mitigates: a signal suppressed by an unrelated security control.
- Emergency access always granted, never delayed, always declared. (a test in your verification file) Mitigates: authentication failure blocking care; and undetected misuse.
- Identity and role permanently visible. (held by Masthead) Mitigates: actions attributed to the wrong clinician.
- Patient context re-confirmed on user switch. (held by Dialog) Mitigates: wrong-patient action after a handover at the keyboard.
- Drafts never cross an identity boundary silently. (a test in your verification file) Mitigates: a misattributed clinical assessment in the permanent record.
- Badge-first sign-in. (deployment configuration) Mitigates: shared logins, which destroy attribution for every other control in this system.
Related
- Patient header — the idle re-confirmation this depends on.
- Clinician override — what attribution is for.
- Acknowledge & escalate — who an alarm is attributed to.
- Dialog — the switch-user confirmation.