Stolen passwords are one of the most common ways attackers get into healthcare systems, and a pathology system full of diagnoses and identifiers is a valuable target. Multi-factor authentication is one of the most effective controls a lab can add, yet clinical staff often resist it because it seems to slow them down. This guide is for lab managers, hospital IT teams and pathologists who want to roll out multi-factor authentication for clinical systems in a way people will actually accept.
Why passwords alone are not enough
Passwords fail in predictable ways. People reuse them across sites, so a breach of an unrelated service exposes their hospital login. Phishing emails trick users into typing credentials into convincing fake pages. Weak passwords are guessed, and passwords written on notes beside shared workstations are simply read.
Multi-factor authentication (MFA) requires a second, different kind of proof in addition to the password. The usual categories are something you know (a password or PIN), something you have (a phone, token or security key) and something you are (a fingerprint or face). An attacker who steals a password still cannot sign in without the second factor.
Comparing MFA methods
Not all second factors offer the same protection. A rough ordering, from weakest to strongest:
- SMS or email codes: better than nothing and easy to deploy, but codes can be intercepted or redirected, for example through SIM-swap fraud, and users can be tricked into reading them out.
- Authenticator app codes: time-based codes generated on a phone. More robust than SMS, but a convincing phishing page can still capture and replay a code in real time.
- Push notifications: convenient approve or deny prompts. Vulnerable to fatigue attacks, where an attacker sends repeated prompts until a tired user taps approve. Number matching, where the user types a number shown on screen, reduces this risk.
- Security keys and passkeys: based on FIDO2 and WebAuthn standards, these are bound to the genuine site and resist phishing. They are the strongest common option, but require hardware or compatible devices and more planning.
For most labs, a sensible approach is authenticator apps or push with number matching for general staff, and phishing-resistant methods for administrators and anyone with broad access.
Clinical realities that shape the design
MFA policies written for office workers often fail in a lab. Plan around how work is actually done:
Shared workstations
Grossing benches, embedding stations and microscope desks are shared by several people per shift. Each person still needs to sign in individually, so authentication must be quick. Options include badge tap combined with a PIN, and shorter sessions that lock rather than log out, so returning users can resume with a PIN or badge tap.
Gloves and contamination
Staff at the grossing bench or in histology often cannot handle a phone without breaking clean practice. Avoid designs that demand a phone prompt every time someone steps up to a bench computer.
Personal phones
Not every staff member wants work apps on a personal phone, and some cannot use one in certain areas. Have an alternative, such as a hardware token, ready before rollout rather than handling objections one by one.
Remote work and telepathology
Remote sign-out and on-call review from home are exactly where MFA matters most, because the network is outside your control. Our article on telepathology and remote sign-out covers the wider safety picture.
Making MFA work without slowing the lab
The goal is strong protection at the moments of highest risk, with as little friction as possible elsewhere. Common techniques include:
- Single sign-on: one strong MFA sign-in at the start of a session gives access to several systems, instead of separate prompts for each.
- Risk-based prompts: require MFA for new devices, new locations and remote access, and less often on known devices inside the hospital network.
- Step-up authentication: ask for a second factor again for sensitive actions, such as exporting data, changing user permissions or accessing records outside the user's normal scope.
- Sensible session timeouts: too short and staff look for workarounds; too long and unattended screens become the weak point. Screen locks that reopen with a quick PIN or badge tap are often the best compromise.
MFA works alongside role-based access control: MFA proves the person is who they claim to be, while roles limit what that person can do once signed in.
Rolling it out
A phased rollout reduces disruption and builds confidence:
- Start with administrators and remote access. These accounts carry the most risk and the fewest users.
- Pilot with one team. Choose a group willing to give honest feedback, and adjust before expanding.
- Explain the why. Staff accept extra steps more readily when they understand the threat and see that the design respects their workflow.
- Prepare the helpdesk. Expect lost phones, new devices and forgotten enrollments in the first weeks.
- Enforce, then monitor. Once enrolled, make MFA mandatory rather than optional, and track sign-in failures and unusual prompts.
Account recovery: the weak link
Attackers know that the easiest way around MFA is often the helpdesk. If anyone who calls and sounds convincing can have their second factor reset, MFA adds little. Define a recovery process that verifies identity properly, for example in person or through a manager, and log every reset. Give users backup methods at enrollment so a lost phone does not lock them out of urgent clinical work.
Make sure MFA events, resets and failed attempts appear in your audit trails, so suspicious patterns can be spotted and investigated.
Common mistakes
- Exempting senior staff or administrators because they complain the loudest
- Relying only on SMS for high-privilege accounts
- Forcing frequent phone prompts at gloved workstations, which drives shared logins
- Leaving service and test accounts without MFA or other protection
- Having no recovery process, so staff are locked out during night shifts
Key takeaways
- MFA blocks most attacks that rely on stolen or guessed passwords.
- Prefer authenticator apps or number-matched push for staff, and phishing-resistant keys or passkeys for administrators.
- Design around shared workstations, gloves and remote sign-out.
- Use single sign-on, risk-based prompts and step-up authentication to limit friction.
- Secure the account recovery process as carefully as the sign-in itself.
Strong authentication should protect patient data without getting between staff and their work. PATHOLOGY+ supports multi-factor authentication together with role-based access control and audit logging, and you can book a demo to see how sign-in works in practice.