A passkey belongs to one person. A ward computer belongs to everyone.
NHS England's multi-factor authentication policy, last edited on 10 September 2026, counts FIDO2 credentials, including synced passkeys, among the strong factors it expects. Good news for the laptop in the office. It says nothing about the computer at the nurses' station, which twenty people will use before the shift ends. Passkeys were designed for a person with their own phone or laptop, and most of what goes wrong in hospitals comes from forgetting that.
Three shapes of passkey
A passkey is a FIDO2 credential, and it lives in one of three places. A platform authenticator is, in the FIDO Alliance's words, "simply an authenticator implemented in a computing device": Windows Hello, Touch ID, the Android screen lock. A synced passkey is a platform credential copied through a cloud account, so it follows the account rather than the device. A roaming authenticator is "software implemented in a device that can be separated from the client device": a security key or smartcard with its own PIN or fingerprint check. The FIDO Alliance's enterprise guidance is blunt about which fits where: platform authenticators for employees with dedicated corporate machines; for staff who "use shared devices", "roaming authenticators with UV protection are recommended". Its examples are bank branches and call centres; a ward is the same problem with worse interruptions.
What breaks on a shared Windows PC
Windows Hello for Business is a per-person, per-device credential. Microsoft's FAQ says the PIN "can't be used anywhere except on that specific device", that biometric data "does not leave the device or roam with the user", and that "the maximum number of supported enrollments on a single device is 10"; above that, or for people who sign in to many devices, "it's recommended the use of FIDO2 security keys". A ward PC with two shifts, locums and students is over the limit by design. Windows' own Shared PC mode sets "Use Windows Hello for Business" and "Allow users to log on using biometrics" to Disabled. By contrast, FIDO2 security key sign-in to Windows "isn't dependent on configuring Windows Hello for Business". On a shared PC, the roaming authenticator is the path Microsoft leaves open.
What breaks with synced passkeys
A synced passkey belongs to an account. Apple's passkey security page says passkeys "sync across a user's devices using iCloud Keychain"; Google's Chrome help says they are "securely backed up and synced to your Google Account". NHS England's CIS2 passkey guidance puts it plainly: a synced passkey is "linked to an account, not the devices". CIS2 lists these passkeys at AAL2 and reserves AAL3 for device-bound authenticators.
If the ward PC runs under one shared Windows account, a passkey created in Windows Hello attaches to that operating-system account, which is whoever sits down next, and one saved in a signed-in Chrome profile attaches to whatever Google Account the profile holds. If a clinician enrols a passkey into a personal iCloud or Google account, it leaves with them when they leave, and the identity provider must revoke it, because nobody will delete it from the phone. Apple's answer is the Managed Apple Account: with a passkey attestation configuration deployed, "when no Managed Apple Account is present, the passkey can't be created", and the service can verify that the passkey was created on a managed device.
Shared tablets are a different animal
A shared Android device is often not signed into by a person at all; a Shared iPad is, but with a Managed Apple Account and a passcode rather than a fingerprint. Microsoft's frontline worker guidance says users of shared Android devices "manually sign in to apps; they don't sign in to the device", and Entra's shared device mode lets a worker "sign in with a single gesture, making the device 'theirs' during their shift", but only in apps built for it. On Shared iPad the Apple Business Manager guide lists the Touch ID & Passcode settings section as removed entirely. On a shared tablet the clinical identity has to come from the apps and the identity provider, not the device's biometrics.
The pattern that holds up
NHS England's CIS2 authenticator guidance, updated 9 October 2026, says it in one line: "Staff on shared devices, desktops or kiosks can use smartcards or security keys." The security key page adds that "users can share desktops/laptops and authenticate with their own individual security key", that keys need FIDO Alliance authenticator certification at Level 2, and that each is registered to the person's Care Identity profile through a Registration Authority, as a smartcard is. Two details follow. Capacity: a key holds a finite number of discoverable credentials, and Yubico's firmware 5.7 raised its limit from 25 to 100, so count tenants and applications before buying. Provenance: Entra's passkey policy can verify "the authenticator's make and model against trusted metadata"; without enforced attestation, an allow-list of models is "a policy guide rather than a strict security control".
What the passkey does not solve
Walking away. The CIS2 session rules cap a session at 12 hours, require termination after 15 minutes idle at AAL3 or 30 at AAL2, end the smartcard session when "the smartcard is removed from the reader", and warn that silent reuse of a session through a long max_age "should be avoided in scenarios where the OS session is shared between users". No equivalent is documented for pulling out a security key, so the lock has to come from the workstation. Note also that the NHS MFA policy allows a user, after first access, to reach "the same system from the same device without MFA". On a ward computer, same device is not same person.
Five questions to settle before a passkey rollout touches a ward: how many people share each device, whose account a synced passkey would land in, whether the device's own biometrics are even enabled in shared mode, how a roaming authenticator is issued and revoked, and what locks the screen when the person walks off.
