{
"slug": "attribution-drift-shared-workstations",
"topic_id": "TOPIC-112",
"cluster": "Hospital & Health System Clinical Identity",
"tier": "Tier A",
"title": "The EHR is not closed on user switch: measuring attribution drift on shared clinical workstations",
"summary": "Fast clinical login is documented to keep the EHR open across user switches. That is a deliberate design choice with a measurable cost: a window in which consequential orders are attributed to the wrong clinician. Here is how to measure yours.",
"lede": "The configuration is in the vendor documentation, stated plainly: on a shared clinical workstation, the EHR is not closed when the user switches. It is not a defect and it is not a secret. It is a trade of attribution for seconds, made deliberately, at the bedside, thousands of times a day — and almost nobody has measured what it costs.",
"date": "2026-01-11",
"category": "Vertical",
"author_id": "margot-reyes",
"tags": [
"clinical workstation",
"tap and go",
"EHR attribution",
"access management",
"patient safety",
"audit controls"
],
"image": "https://cdn.twc.sh/images/igcache/Attribution%20Drift/1200_630/blog.jpg",
"schema": "Article",
"key_takeaways": [
"Attribution drift is the interval between a physical user change at a workstation and the application's identity context catching up. Actions in that interval are attributed to the previous user.",
"The interval is a product of three measurable variables: switch latency, application session TTL, and consequential-action density on that workstation.",
"There is no published national figure and this article does not invent one. It gives you the harness to produce your own."
],
"body": [
{
"type": "h2",
"text": "The trade, stated precisely"
},
{
"type": "diagram",
"kind": "flow",
"alt": "The drift window, and what falls into it",
"caption": "The design choice is defensible. The cost is rarely measured.",
"nodes": [
{
"label": "Clinician A works, session open",
"note": "tap to unlock"
},
{
"label": "Clinician A steps away",
"note": "session persists",
"bad": true
},
{
"label": "Clinician B uses the workstation",
"note": "same session",
"bad": true
},
{
"label": "Order attributed to A",
"note": "drift",
"bad": true
}
]
},
{
"type": "p",
"html": "Clinical single sign-on exists because the alternative is worse. Before badge-tap access, clinicians shared passwords, propped workstations open, and wrote credentials on tape under keyboards. Fast access did not create the shortcut culture; it replaced a worse one."
},
{
"type": "p",
"html": "The mechanism is straightforward. The desktop session and the clinical application session are decoupled. A badge tap switches the desktop context quickly. The application — which may hold several charts open, a partially composed order, and a running dictation — does not tear down and rebuild, because tearing down and rebuilding costs seconds per interaction, and a nurse on a med-surg floor performs dozens of interactions an hour."
},
{
"type": "p",
"html": "So there is an interval. Call it t. During t, the human at the keyboard is one person and the application's notion of the principal is another."
},
{
"type": "h2",
"text": "Why this is an evidence problem, not a security problem"
},
{
"type": "p",
"html": "Security people reach for the wrong frame here. Nobody is exploiting this. The overwhelming majority of actions in that interval are performed by clinicians doing exactly what they should, and the wrong attribution is invisible because nothing goes wrong."
},
{
"type": "p",
"html": "It becomes visible in exactly one circumstance: when a specific action is disputed. A medication administration that harmed a patient. An order that should not have been signed. A chart access that a family questions. At that point the audit log — the sole evidence — names a clinician, and the question is whether it names the right one."
},
{
"type": "p",
"html": "Two clinicians, one keyboard, one record. Neither can prove which of them acted. That is the entire failure mode, and it has nothing to do with malice."
},
{
"type": "h2",
"text": "The Attribution Drift Model"
},
{
"type": "p",
"html": "Three inputs, one output. Each input is measurable on your own estate, and none requires vendor cooperation."
},
{
"type": "table",
"caption": "Inputs to the model. Measure each on a representative sample of workstations rather than taking a vendor figure.",
"head": [
"Variable",
"Definition",
"How to measure it"
],
"rows": [
[
"t_switch",
"Median seconds from badge tap to the application reflecting the new principal",
"Instrument with a test account and a stopwatch, twenty trials per workstation class"
],
[
"ttl_app",
"Application session lifetime before it re-resolves identity",
"Read from access-management configuration; verify empirically"
],
[
"λ_action",
"Consequential actions per minute on this workstation class",
"Export from the EHR: order signings, administrations, note attestations per hour, divided by 60"
]
]
},
{
"type": "p",
"html": "The expected number of mis-attributed consequential actions per switch is approximately λ_action × t_switch / 60. Multiply by switches per day per workstation, then by workstation count, and you have a site-level annual figure. It will be smaller than you fear and larger than zero, which is the useful range."
},
{
"type": "callout",
"title": "Denominator discipline.",
"html": "Report this as actions per 10,000 switches, not as a raw count. A raw count is unfalsifiable and invites arguments about whether the number is big. A rate invites the correct argument, which is whether the rate is acceptable for the action class."
},
{
"type": "h2",
"text": "Run the harness"
},
{
"type": "p",
"html": "You need a test clinician account, a second test account, and one hour on a representative ward at a representative time. Do not do this at 3am on a quiet unit; the whole point is to measure the condition that actually produces the drift."
},
{
"type": "ol",
"items": [
"Pick three workstation classes: nursing station shared, medication room, and physician workroom. They behave differently and averaging them hides the signal.",
"For each, tap in as account A, open a chart, then tap in as account B and immediately query the application for the current principal. Record elapsed milliseconds. Twenty trials.",
"Take the median, not the mean. The distribution has a long tail and the tail is where the disputed events live.",
"Pull consequential-action counts per workstation for the preceding 30 days from your EHR reporting.",
"Compute the rate. Compare across the three classes; the medication room will usually be the outlier."
]
},
{
"type": "h2",
"text": "What the number is for"
},
{
"type": "p",
"html": "Not for panic, and not for a policy memo telling staff to tap out. Staff already know they should tap out; they also know that a patient deteriorating in front of them outranks a session. Behavioural controls have been tried against this for fifteen years and the tail persists."
},
{
"type": "p",
"html": "The number is for scoping. Once you know which action classes sit inside the drift window at what rate, you can decide which of them deserve a per-action signature — an identity check bound to the action rather than inherited from the session."
},
{
"type": "p",
"html": "For most sites that list is short: high-alert medication administration, controlled substance actions, order signing on restricted charts, and note attestation. Everything else can keep inheriting, because the consequence does not justify the second."
},
{
"type": "h2",
"text": "Per-action attribution, concretely"
},
{
"type": "p",
"html": "A per-action signature does not authenticate the session. It produces a fresh assertion from a credential under the clinician's sole control, bound to a canonical statement of the action — this medication, this dose, this patient, this time. The assertion is worthless to anyone who did not perform the gesture, and it is indifferent to what the session believes."
},
{
"type": "p",
"html": "The important property is that it is stateless with respect to everything upstream. It does not matter who tapped in, whether the previous chart is still open, or how long the session has been alive. The question who did this stops depending on the question who was logged in."
},
{
"type": "h2",
"text": "What this does not fix"
},
{
"type": "p",
"html": "It does not reduce switch latency, which is a workflow property you may want to improve separately. It does not stop a clinician from performing an action they should not perform — attribution is not authorisation. And it does not help if the two clinicians sharing the keyboard are genuinely collaborating on the same task, which happens constantly and is good care."
},
{
"type": "p",
"html": "What it gives you is a record that survives the question. For the four or five action classes where that question is career-defining, that is worth one second."
},
{
"type": "h2",
"text": "How to measure your own drift"
},
{
"type": "table",
"caption": "Four measurements, all from existing data",
"head": [
"Measurement",
"Method"
],
"rows": [
[
"Median session duration",
"From EHR session logs"
],
[
"Actions after the last badge event",
"Count and classify"
],
[
"Consequential actions in that window",
"Orders, med admin, note signing"
],
[
"Attribution drift rate",
"Consequential actions per session after a switch"
]
]
},
{
"type": "p",
"html": "Most organisations have never computed the fourth. It requires correlating badge events with EHR actions, which is a day of analysis and produces a number that changes the conversation from anecdote to measurement."
},
{
"type": "h2",
"text": "Objections and honest limits"
},
{
"type": "p",
"html": "“Fast login is a patient safety feature.” It is, genuinely — seconds at the bedside matter. The argument is not to remove it but to gate the consequential subset so the drift window contains fewer things that matter."
},
{
"type": "p",
"html": "“Clinicians should lock their sessions.” In a setting where a workstation is shared among many people under time pressure, designing around that expectation is how the drift became normal."
}
],
"faq": [
{
"q": "Is keeping the EHR open across user switch a misconfiguration?",
"a": "No. It is a documented, supported configuration chosen because closing the application on every switch imposes a real cost on bedside workflow. The point of measuring drift is to decide which actions warrant an exception, not to reverse the configuration."
},
{
"q": "Can we not just shorten the session timeout?",
"a": "Shorter timeouts increase interruption, and interruption produces workarounds — mouse jigglers, propped badges, delayed tap-outs. The drift window is a function of switch latency more than of idle timeout, so shortening timeouts addresses a different variable."
},
{
"q": "What rate should we consider acceptable?",
"a": "That is a clinical governance decision, not a technical one, and it will differ by action class. The contribution here is a defensible number to put in front of the committee that makes it."
},
{
"q": "Does per-action signing require changing the EHR?",
"a": "No. It gates the action at the point of confirmation through an API call and emits a receipt alongside the EHR's own record. The clinical system remains the system of record."
},
{
"q": "Is fast login a bad design?",
"a": "No. Seconds at the bedside matter and it is a deliberate safety trade. The point is to measure its cost and gate the consequential subset."
},
{
"q": "How do you measure drift?",
"a": "Correlate badge events with EHR actions and count consequential actions occurring after a user switch within one session."
},
{
"q": "What should be gated?",
"a": "Orders, medication administration and note signing — not navigation or record viewing."
}
],
"sources": [
{
"t": "ONC / ASTP health IT certification and safety resources",
"u": "https://www.healthit.gov/topic/safety/health-it-safety"
},
{
"t": "45 CFR §164.312 — HIPAA Security Rule technical safeguards",
"u": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312"
},
{
"t": "LangGraph — human-in-the-loop documentation",
"u": "https://langchain-ai.github.io/langgraph/concepts/human_in_the_loop/"
},
{
"t": "CISA — known exploited vulnerabilities and incident reporting",
"u": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}
],
"related": [
{
"slug": "break-glass-evidence-gap",
"title": "Break the glass, break the evidence",
"category": "Definitional"
},
{
"slug": "independent-double-check-proof",
"title": "The independent double-check that isn't",
"category": "Developer"
},
{
"slug": "clinical-action-gate-infostealers",
"title": "Three in four infected devices hold EHR credentials",
"category": "Comparison"
}
],
"wordcount": 1379,
"url": "/blog/attribution-drift-shared-workstations.html",
"reading_time": "6 min read",
"image_title": "Attribution Drift",
"seo_title": "Attribution drift on shared clinical workstations",
"meta_description": "Fast clinical login keeps the EHR open across user switches. That is a deliberate design choice with a measurable attribution cost.",
"hub": {
"slug": "topics/clinical-identity",
"title": "Hospital and clinical identity"
},
"answer": "Long enough to matter, by design. Fast clinical login is documented to keep sessions open across user switches, which is a deliberate choice that saves seconds per interaction. The cost is a window in which consequential orders are attributed to the wrong clinician, and it is measurable.",
"answer_q": "How long does the EHR stay open after a user switches?",
"glossary": [
{
"term": "Fast clinical login",
"def": "Badge-tap authentication that keeps a session open across user switches to save time."
},
{
"term": "Attribution drift",
"def": "Actions recorded against a clinician who was not the one performing them."
},
{
"term": "Consequential action",
"def": "An order, administration or signature — as distinct from navigation or viewing."
}
],
"checklist": {
"title": "Measuring and bounding drift",
"id": "drift",
"desc": "Four steps.",
"steps": [
{
"name": "Correlate badge events with EHR actions.",
"text": "A day of analysis with data you already have."
},
{
"name": "Compute consequential actions per post-switch session.",
"text": "That is your drift rate."
},
{
"name": "Gate the consequential subset.",
"text": "Orders, administration, note signing — not navigation."
},
{
"name": "Re-measure quarterly.",
"text": "Drift follows staffing and workflow changes."
}
]
},
"cta": {
"title": "Where this fits in Manav",
"html": "Manav binds the clinician to the exact order, note or access being authorised, with a gesture short enough for the bedside and a record an investigator can verify without the EHR.",
"href": "../docs.html",
"label": "See clinical attestation"
}
}