Can staff share an EHR login?

Not under HIPAA’s Security Rule as written. Unique user identification in 45 CFR 164.312(a)(2)(i) is a required specification: each user gets a unique name or number “for identifying and tracking user identity”. A login used by several people identifies none of them. Shared logins still turn up at practices for practical reasons, and each has either a way to split it or a way to record who used it. For the general idea, see What is a shared account?

What the Security Rule says about shared logins

The rule never says “do not share”. It gets there through its definitions. Section 164.304 defines a user as “a person or entity with authorized access”, and 164.312(a)(2)(i) gives every user a unique identifier. When three nurses use one login, there are three users and one identifier, so the requirement isn’t met for any of them.

Authentication runs into the same problem. Section 164.312(d) asks you to verify that the person signing in “is the one claimed”. With a shared login, the system can only confirm that someone knew the password, not which person typed it.

Password management, in 164.308(a)(5)(ii)(D), is addressable. It asks for procedures to create, change and protect passwords. A password passed around by text message or written on the workstation is hard to protect under any procedure.

What a certified EHR is built to record

Federal certification criteria for health IT, in 45 CFR 170.315(d), tie access and the audit record to each user’s identifier. Under (d)(1), certified technology must authenticate each user against a unique identifier, such as a username. It then sets what that user may see and do. Under (d)(2), it records actions by default, can’t itself change, overwrite or delete those entries, and can detect whether the log was altered. Under (d)(3), you can pull an audit report for a time period you choose. Under (d)(5), it signs out an idle user automatically and asks them to authenticate again.

So a certified EHR keeps a tamper-resistant record for each login. With a shared login, every entry names the same account, and the record can’t tell you which person acted.

Where shared logins come from

The patterns below follow from how practices staff shifts and bill. Pick the ones that match your practice.

Per-diem and locum clinicians sometimes start before their account is ready, and someone lends them an existing login so the shift can go ahead. HIPAA counts people whose work is under your direct control as workforce, paid or not (45 CFR 160.103). Like any employee, they are users, and each user needs a unique login.

Staff covering another department have their own login but not the permissions they need there. They borrow a colleague’s login instead.

A shared workstation stays signed in at the nurses’ station or front desk. The next person carries on under the first person’s login. Each person has an account, but the record shows only one of them.

Billing company staff may all use one login the practice gave the company. The company’s staff change, and the practice doesn’t hear about it.

Interface and device accounts connect lab equipment or other software to the EHR. No person uses them, so they can’t be split per person. The access control standard in 164.312(a)(1) covers “persons or software programs”, so they still need rules.

What a shared login costs you

The first cost is the audit trail. Information system activity review, in 164.308(a)(1)(ii)(D), is required: you must regularly review records of system activity. When the log shows one name for several people, a suspicious entry leads to a schedule check instead of a person. You compare shift rosters to see who was on at the time.

The second cost is removing access. Termination procedures in 164.308(a)(3)(ii)(C) ask you to end access when someone’s job or contract ends. With a shared login, you can’t remove one person without changing the password and resending it to everyone who stays. The limits of changing shared passwords every time someone leaves covers why that breaks down.

How to end the sharing

Split what can be split, and decide how to record who used the rest.

• Per-diem and locum clinicians: create their login before the first shift and disable it when the engagement ends. Tie both steps to your onboarding and scheduling, so neither depends on someone remembering.
• Staff covering another department: add temporary permissions to the person’s own login, with an end date. Information access management in 164.308(a)(4) expects you to set up, review and change access by policy.
• Shared workstations: make signing out at handoff the rule, and turn on the EHR’s automatic sign-out after inactivity. Automatic logoff is addressable, so if you skip it, document why and what you do instead.
• Billing company staff: ask the company for a list of the people who need access, give each one their own login, and agree on how they’ll tell you about staff changes.
• Interface and device accounts: give each interface its own account, list them, limit which machines use them, and keep the password known to as few people as possible.

Some systems can’t give each person a login at all. When shared accounts can’t be split into personal ones sorts those cases, and Comparing ways for several people to use one shared account compares the ways to run them. The full list of access requirements is in HIPAA Security Rule access control requirements.