INTRODUCTION

Over the last 15 years, the electronic health record (EHR) has been widely adopted by healthcare delivery systems and physician offices in the United States, Europe, and other nations, often with substantial governmental financial support.¹ The great value conveyed by this technology extends well beyond the elimination of paper records and handwriting from healthcare delivery workflows. The order sets within EHRs are standardized and derived from peer reviewed and published evidence of best practices with proven clinical value, and the widespread distribution of EHRs has achieved an unprecedented adoption of evidence-based medicine.^2–18 Computerized patient order entry, or CPOE, has been one of the best means so far of systematically embedding scientific evidence and care standardization into clinical care delivery, and thereby improve the quality of care by reducing patient risk and preventable morbidity/mortality from patient harm caused by errors.^2–18

Despite these achievements, physician dissatisfaction with EHRs and their perceived inefficiencies remain a concern for hospitals.^19,20 Many clinicians regard EHRs as time-consuming interruptions to busy workflows, disruptive to patient care, and a source of stress, fatigue, and burnout.^19,20 Further, the imperative to maintain the security of protected health information (PHI), including password protection of EHR access, and the need to maintain up to 20 passwords for a variety of clinical applications impedes clinical workflows.^19–25 Managing passwords uses clinician time better spent on patient care.^19–25

Implementation of single sign-on and access management (SSO/AM) can ease and expedite clinician use of the EHR and clinical applications, accelerating clinical workflows while enhancing cybersecurity best practices and privacy compliance.^10–31 SSO/AM requires two factor identification upon first login of shift, typically a complex password (or Personal Identification Number [PIN]) and a badge tap. Then a configurable grace period is enabled (from four to 13 hours), during which users no longer need to manually type in a password, instead utilizing a proximity card to access the desktop or SSO/AM for application login if no proximity card reader is present. Workflows are automated in the background, with sessions staying connected to streamline login and enable rapid access to clinical applications. The technology also autofills passwords at the application level, further expediting logins. Thus, SSO/AM improves overall enterprise health information security, reducing the risk of unintentional and malicious security breaches, and facilitates more effective enterprise identity management as it improves clinician workflows in the use of the EHR and other applications.

SSO/AM provides support for terminal, client server, and cloud-based applications. New applications can be profiled and deployed rapidly. Password administration automates password change, reducing another clinician burden. By automatically launching needed applications, time is freed from typing on a keyboard to instead focus on delivering patient care. SSO/AM automatically locks the workstation when clinicians leave and re-authenticates upon return to exactly where they left off. The need to manually lock sessions or to deploy application inactivity time outs is eliminated, as is risk of lost EHR work when clinicians multitask.

SSO/AM improves clinician user efficiency and satisfaction by substantially expediting login.^19–31 The impact of SSO/AM has been quantified in the US, where the largest study in a 49-hospital system found a recurrent financial value of clinician time freed from keyboard login of $8.5 million annually.²⁷ Other valuable operational, clinical, and epidemiological utilities of SSO/AM have been described, such as during the COVID-19 pandemic.^32–42 The present study is the first non-US and largest multinational analysis to evaluate the clinical workflow impact and financial value of SSO/AM implementation in the United Kingdom and Republic of Ireland employing direct sampling and quantification of actual login times pre- and post-implementation.

METHODS

Study Settings

Eight health systems that implemented SSO/AM in the United Kingdom (England, Scotland, and Wales) and Ireland participated, including 55 hospitals, granted permission for pre- and post-SSO/AM implementation measurement of login duration. All UK hospitals were in the public sector; two in Ireland had private funding/management. All were urban; six were general facilities with the usual range of specialty services and two were specialty hospitals.

Study Period

Data was collected between 2018 and 2024. Sampling of login duration occurred six to nine months pre-SSO/AM implementation, and three to six months post-implementation. Exceptions were National Health Service (NHS) Greater Glasgow and Clyde, which had previously deployed SSO/AM. Clinical workstations without SSO/AM deployed were used as proxies to measure baseline pre-SSO/AM login speed and performance at those sites. All post-SSO/AM measurements were conducted after most clinicians were routinely logging in through SSO/AM.

SSO/AM Technology Platform and Deployed Configurations

The SSO/AM technology platform implemented was Imprivata OneSign® versions 7.2, 7.9 and 7.10 (© Imprivata, Inc; Waltham, MA). Hospitals deployed one or more SSO/AM technology configurations based upon existing IT infrastructure and operational needs. The NHS England Spine allows secure information sharing between the Electronic Prescription Service, Summary Care Record, and e-Referral Service using NHS-issued smartcards and two-factor authentication. SSO/AM deployment in England can include a Spine integration with mandated two-factor authentication to comply with information governance and security standards.

SSO/AM was implemented as multi-user desktop (MUD) or kiosk configurations to optimize workflows. A kiosk agent uses an underlying generic system account but still allows users to log in to applications using their individual credentials, providing quick, secure, and auditable access. A MUD agent enables multiple users to log in to a workstation while keeping each desktop session persistent, so clinicians can maintain personal preferences. Operating like Microsoft Windows (© Microsoft Corp.; Redmond, WA) switch-user functionality, it allows easy identification of current user sessions and automates closing of inactive sessions to free up workstations. Table 1 differentiates MUD versus kiosk configurations.

Study Design

A time/motion study was conducted by a nurse informaticist and an engineer using a stopwatch to directly measure the time clinicians required to log into workstations, computer desktops, and applications. Clinician login duration was measured by direct observation of pre- and post-SSO/AM implementation workflows. Reductions in time to login and access key applications were then used to estimate financial value based on conservative national estimates of hourly wages for nurses and physicians. Hours, 12-hour shift equivalents, and annual estimates of time saved by clinicians in reduced login and reconnect duration were calculated. SSO/AM software enabled quantification of active workstations and logins/reconnects by clinicians, from which mean login frequencies were derived, including number of clinical users and access frequency by application per shift. No protected/confidential or bedside data was collected. The study was a reasonable benefits analysis of an approved technology implementation, and thus, formal individual consent of clinician participants was unnecessary and waived.

Clinical Departments Sampled

At most hospitals, measurements were completed on workstations in general medicine wards, medical assessment units, pediatric emergency departments (ED), neonatal intensive care units (NICU), and subspecialty clinics (in East Cheshire NHS Trust only in the ED). Unit selection was determined by facility leadership based on need, high patient volume/throughput, and frequency of clinician logins.

Login Frequency and Duration Measurement

Frequency and duration of clinician login workflow were measured for workstation, desktop, and core clinical applications. Login duration was measured by observing 3-5 clinicians per unit, with 2-3 logins observed per user. The total number of logins per clinician was similar during pre- and post-SSO/AM measurements. Login duration was measured during periods of high login activity (7am to 6pm Monday-Friday).

Login duration was measured with a stopwatch. Login frequency, user-switching events, number of unit staff, accumulation of documentation tasks, and workflow configurations were recorded, as were access workarounds used by clinicians. Login frequency and duration were also available in the post-SSO/AM enterprise software, while pre-SSO/AM measurement was manual. Pre-SSO/AM clinician login times were lengthy and workarounds common (eg, sharing login credentials and reluctance to log off or switch users). Clinicians estimated their number of logins per shift as if they accessed properly (without workarounds), informing estimates of total baseline pre-SSO login time per shift per clinician. Total login time per shift per clinician was categorized by user-switching, workstation-level, and EHR/core application-level access times.

Estimating Financial Value of Clinician Time Freed from Keyboard

Financial value of clinician time freed from keyboard login was estimated based on the total number of enabled clinical users in each hospital. Endpoint usage was determined using workstation login activity for each configuration deployed (MUD and kiosk). Where NHS Spine access was mandatory (England), the percentage of total users with Spine access was identified.

Calculations were completed using these data points and multiplied by the mean of measured/observed login durations in each unit, resulting in cumulative time spent per clinician per shift to access EHR/applications. Where workstations were configured for single users pre-SSO/AM, time to log off an existing user before another could log in was recorded.

Analyses of financial value were based on conservative salary estimates of the geometric mean of fully loaded physician or nurse cost per hour, averaged from multiple publicly reported sources, including the UK Royal College of Nurses, the British Medical Journal careers section, and the NHS. Average annual salary estimates based on 2022-23 data were £65,000 for physicians and £35,000 for nurses and allied health professionals.^41–45 The staffing ratio of nurses to physicians was designated arbitrarily as 66% nurses and 34% physicians.

Determination of the number of facilities eligible or suitable for SSO/AM implementation in the remaining 307 hospitals in the UK and Ireland considered hospital information technology (IT) maturity, volume of nurses and physicians, patient throughput, and existence of clinical workflows that involve substantial roving or clinician movement across service lines/units and workstations. Estimation of the total number of SSO/AM licensable clinicians across the four nations who would be potential SSO/AM clinical users was based on publicly available data from each country’s national health service. The total potential value of clinician time across 307 eligible UK and Ireland hospitals was determined by dividing all 55 facilities annual financial value by the total number of clinician hours freed per year, producing an hourly estimate of Great British pound (GBP) 16.17 or US $20.54 (1 GBP = 1.27 US dollars). This was then multiplied by the number of potential hours to be freed from keyboard login across eligible hospitals. A second estimate derived a financial value for the remaining 307 hospitals by extrapolating proportionally from the ratio of clinicians to financial value of the 55 facilities reported in this analysis.

Results

The total number of SSO/AM-enabled applications varied considerably by individual facility, ranging from 17 to 152, and included EHR, electronic prescribing and medicines administration (EPMA), picture archiving and communication system (PACS) and other clinical applications, human resource (HR) systems, and business applications. Accordingly, the overall range of reductions achieved in the duration of login varied by facility, ranging from a low of 11.6% to a maximum of 91.6%, with a mean reduction of 60.5% for desktop login and 51.2% for applications. Supplemental Tables 1-5 present the reductions in login duration pre- and post-SSO/AM implementation by facility for the Republic of Ireland, where a 31.8-82.3% time reduction occurred; Scotland, where a 85.0%-91.6% reduction occurred; Wales, where a 46.3% reduction occurred; and England, where an 11.6-90.5% reduction occurred. Mean time savings across all desktop configurations, total clinician hours freed from keyboard per year, and the percentage reduction of pre-SSO/AM login duration all assume that no workarounds were used by clinicians in the pre-SSO/AM state, per best practice standard. While all four nations achieved meaningful reductions in login times, the magnitude of the decrease for Scotland was much greater than other nations, a reflection of that nation’s widespread adoption of SSO/AM and large numbers of users and locations deployed.

Table 2 conveys login time reductions and financial value across 42 participating health systems in the Republic of Ireland, Scotland, and Wales. The annual financial value of clinician time freed from keyboard login is 28.4 million GBP per year (USD $36.0 million; 33.5 million euros), or 659,356 GBP per hospital per year (USD $837,382; 778,040 euros), resulting from 1.75 million hours of clinician time (or 145,976 12-hour clinician shifts) saved annually, recurrent in perpetuity.

Table 3 summarizes login time reduction and its annual financial value for English health systems. Across 13 health systems in England, the annual financial value of clinician time not spent typing login credentials is 25.7 million GBP (USD $32.7 million), or over 1.6 million clinician hours (132,544 12-hour shifts) freed to focus on care delivery rather than login. This equals 2.0 million GBP (USD $2.5 million) value in clinician time per hospital per year, recurrent.

Table 4 summarizes SSO/AM impact and financial value across the four nations and all 55 hospitals of 54.1 million GBP per year recurrent (USD $68.7 million; 63.8 million euros), or per facility a value of 965,465 GBP (USD $1.2 million; 1.1 million euros) per year, resulting from 3.3 million hours (or 278,520 12-hour clinician shifts) freed from keyboard. Table 4 also projects the potential annual value of SSO/AM implementation in 307 other eligible hospitals across the UK and Ireland. Hospitals are deemed eligible to derive substantial value from SSO/AM if they are acute care facilities with 100+ beds with an EHR deployed. This yields 71.5 million hours of clinician time, or 5.9 million 12-hour shifts of clinician time, valued at 1.16 billion GBP (USD $1.47 billion; 1.37 billion euros) per year freed from keyboard logins to focus on care delivery. If the distribution of technology configurations, login workflows, and workarounds deployed in the reported 55 hospitals (54,066,029 GBP) are representative of the other eligible 307 facilities, an annual financial value of freed clinician time of 1,156,412,422 GBP (USD $1,468,643,775; 1,364,566,658 euros) could be realized when all eligible hospitals in the UK and Ireland implement SSO/AM.

DISCUSSION

Hospitals deploying SSO/AM across nations achieved substantial reductions in login duration, improved patient privacy protection and organizational cybersecurity, despite facility variation in complexity of clinical workflows and technology configurations. Differences in deployment, software version, and workflows contributed to wide variations in observed pre-SSO/AM baseline login duration. In the pre-SSO/AM baseline state, if facilities were compliant with best practice login procedures that protect patient privacy and cybersecurity, clinicians would spend inordinate time logging into and accessing digital information systems. Instead, workarounds enable clinicians to maintain clinical productivity. Notably, the financial value of SSO/AM is not returned to and will not reduce hospital budgetary expenditures. Yet this is valuable time which, while not enabling workforce or budget reductions, is time that can be dedicated to patient care delivery, potentially improving clinical/facility throughput, patient safety, and clinician satisfaction. This analysis assumes hospitals seek to comply with current standards/best practices to maximize cybersecurity and confidentiality of patient information/data, and the financial value described is another metric of the time clinicians gain to care for patients if they complied with these standards and did not employ workarounds which undermine information security.

The magnitude of value derived by Scottish hospitals was striking. In 2011, a national procurement of SSO/AM technology was completed by NHS Scotland, enabling all 14 regional NHS Health Boards to provide each clinician with an SSO/AM license to expedite access to health IT systems. As a result, the total SSO/AM clinician licenses enabled by Scotland, and the substantial mean number of hours saved per clinician per year yielded a high annual financial value of clinician time freed from keyboard login to focus on patient care (GBP 23.9 million; USD $30.3 million). England’s East Cheshire NHS Trust was next highest with over 11 million GBP (USD $14.0 million) per year. Even early phase, partial implementation in Ireland’s Tallaght University Hospital demonstrated potential SSO/AM benefits; with full implementation, its login timesaving will increase along with information privacy and cybersecurity.

Notable in Table 3 is the close estimation of total clinician time savings per year and that time’s financial value between Milton Keynes Hospital and Leeds Teaching Hospitals. The former had one-fourth the number of licenses/clinicians using SSO/AM, but because the mean time savings per clinician per year was four times greater at Milton Keynes, overall outcomes are of similar magnitude. At Milton Keynes Hospital, clinicians must also log in repeatedly to the NHS Spine for EHR access. Outcomes across these four nations demonstrate large variability because of where systems commenced the process of improving access management. Hospitals with the largest reductions in login duration approximated those with less time reduction but higher volume of clinicians or login frequency. Nature and complexity of pre-SSO/AM configuration and variability in digital architecture contribute to pronounced differences observed in time savings and financial value among hospitals and nations.

Across the 55 facilities, reductions of post-SSO/AM login duration and financial value of freed clinician time were six times greater than those reported in the next largest study quantifying SSO/AM impact within US hospitals. There, annual value was USD $8.5 million recurrent in 49 facilities.²⁷ This large difference is due to differences in deployed technology configurations and measurement of pre-implementation baseline login duration. Differences also exist in national health informatics technology maturity, with greater baseline login complexity and duration in the UK and Ireland. The pre- and post-SSO/AM baseline state in the US study (virtual desktop environment using a single technology configuration) is faster than exists in the UK and Ireland. Baseline reconnect time in the US study pre-SSO/AM was a relatively brief 29.3 seconds, decreasing after implementation by 20.4 seconds (or 69.6%) to 8.9 seconds.²⁷ American clinicians benefit from an easier, less complex, and expedited baseline login workflow than UK and Ireland counterparts.

While variability of pre-SSO/AM baseline login duration and therefore SSO/AM reductions achieved across these four nations is substantial, estimates are based on the assumption that facilities seek to deploy login and access management best practices and standards that clinicians should be complying with to optimize cybersecurity and PHI protection. If UK and Ireland facilities had the US baseline pre-SSO/AM login duration and post-implementation reduction, the annual recurrent value of clinician time freed from keyboard in these four nations would be only 10.2 million GBP (USD $13.0 million). If facilities in the UK and Ireland experienced login performance of only one minute reduction from baseline reconnect duration, the annual value of clinician time freed would be 30.6 million GBP (USD $38.9 million). With a three to five minute reconnect reduction, annual recurrent value would be 91.8-153.0 million GBP. Thus, even conservative estimates yield financial value that are a fraction of SSO/AM implementation costs.

Study limitations include positive sample bias because high volume care units were selected by facility leaders to measure pre- and post-SSO/AM login times, where the greatest benefit would be achieved. Also, observed login and access behaviors and workarounds, such as holding/reserving a workstation (versus freeing it up for fast user switching by multiple users), may occur more frequently when not observed. This workaround occurs when users think it takes too long to log back into a workstation (absent SSO/AM). SSO/AM eliminates this and restarts sessions where last left off, re-loading user preferences and saving time. Clinicians may also avoid logging off and leave workstations open while stepping away from endpoints, decreasing the total number of logins per shift. This would lower pre-SSO/AM implementation time spent logging in and underestimate time savings post-SSO implementation. Due to privacy and security risks of exposed PHI, timeouts are increasingly enforced on endpoints. Most facilities enforce a two-, five-, or 10-minute timeout policy, minimizing the impact of this workaround. Given increasing cybersecurity and patient privacy concerns, such workarounds will be less tolerated in coming years, with security settings more strictly enforced.

CONCLUSIONS

SSO/AM reduced login duration and regained time for clinicians to engage more patient-centric work, and enhanced cybersecurity compliance with patient PHI privacy best practices. SSO/AM delivered substantial time savings and financial value in reduced duration of clinician login in 55 facilities across four nations: over 54.1 million GBP (USD $68.7 million) of value over 3.3 million hours (278,520 12-hour shifts) of clinician time freed from keyboard to instead deliver patient care. However, this national value could increase greatly when the other 307 eligible facilities in these nations implement SSO/AM to 5.9 million 12-hour clinician shifts annually, valued conservatively at GBP 0.86-1.16 billion (USD $1.09-$1.47 billion), in perpetuity. Importantly, time savings and financial value are merely additive to a mission critical improvement SSO/AM conveys to health systems of increasing the security of confidential patient PHI/data.

Disclosures

George A. Gellert is an external medical advisor to Imprivata. Daniel Johnston, Andrew P. Wilcox and Sean P. Kelly are employees of Imprivata. Each hospital and health system co-author is employed by their respective health system and/or hospital, and none declared competing interests.

Funding

The authors received no funding for this research.