Examination room computers accessed by tons of users: what's the answer? Biometrics?

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View

This is a medical practice currently running W2K3 over a single
domain; every examination room has a computer for entering EHR data
and viewing X-rays.  Every workstation is accessed using a common
login that does not have access to patient information.

From within the NT login session, the end user logs into the EHR using
their own unique username and password.

The EHR has its own locking mechanism...so, when a user leaves the
exam room, they secure the EHR so that the next user must
authenticate.  The locking mechanism is user-friendly enough and
allows the next user to pick up right where the previous user left
off, which is quite helpful for us.

Unfortunately this lock only secures the application session, but the
NT logon session is still wide open, so then the person leaving the
room must remember to lock the workstation too (the EHR could easily
handle this step; why they haven't yet, I don't know).


It takes a considerable amount of time to log into the computer from
scratch, then to open up the EHR and find the correct patient and get
into the appropriate area of their chart in order to begin entering

From the get-go, logging completely out of the computer was ruled out
of the question.  There's just too much hand-off, too many folks going
on in the exam rooms with different medical staff establishing contact
with the patient for different purposes.


Doesn't work on a domain (XP, anyway) and once such a feature was
implemented, we'd end up using gobs and gobs of memory as this EHR is
quite resource-intensive and would be running in multiple instances
(closing the EHR and logging back into it regularly is pretty much out
of the question too).

The EHR is not designed with the expectation that multiple
simultaneous users will be entering information into the same
patient's record, so if we were using fast-user switching we would not
be able to benefit from the EHR's own application-level fast-user
switching (which consists of pressing a magic button to lock the
workstation, at which point another user can log right in and pick up
where the previous user left off) and would require major changes to
be made to the application.


What is the real solution?  You tell me; I'm dying for suggestions.
My first suggestion is to give tablet PCs to most personnel and eschew
most use of the exam-room workstation (originally put in place so the
doctor could display X-rays to the patient).

The main arguments against are cost, "the doctors will drop them" and
the fact that it wouldn't totally solve the problem:

Some folks genuinely need to type long, exhaustive notes from within
the exam rooms using a real keyboard, so there will always be certain
folks who need to zip in and out of the fixed workstation.

A flawless implementation of HL7 CCOW against all of our clinical
applications would help, but I don't see it as a total solution.


We are looking at putting touchscreen computers into our hallways that
will allow folks to view the current patient flow and determine where
the doctor is at a given moment, which patients are getting X-rays
done, etc.  This would be an electronic replacement to the classic
check-off-sheet that gets posted to a hallway, where individuals mark
off patients as they go through each stage of their appointment.  We
would love it if this touch-screen computer could be easily locked and
unlocked at a whim, rather than leaving it wide-open.

I have proposed distributing tablets to eliminate that possible need
too, but am met with opposition, and in order to be taken seriously, I
need to attack from all angles and need to understand the current
feasibility of using technologies like biometrics to our advantage.


With the scenarios above explained, does anyone envision a biometric
solution for our domain environment?

I believe I sufficiently understand how biometric thumbprint
authentication with single-sign-on is supposed to work:

Assume that I am Andrew, I have a network account, and a series of
applications accounts.

My first fingerprint scan at initial logon triggers some GINA.DLL
hackery that allows me to log into the workstation.  This needs to be
handled at a domain level so it's not necessary to populate all
workstations with my fingerprint and password.

From then on there's an assumption and establishment of trust that I
have already been identified as Andrew, and any subsequent application
passwords that are needed can be found within a respository
somewhere.  This is quite easy because I'm already authenticated on
the domain at this point, and I'd imagine most SSO applications can
access whatever information they need (specific to my own SSO
accounts) simply based on my NT user context.

Unfortunately, our requirements are a little different:

1.The NT account is shared and not associated with a unique user.  In
our scenario, the most tedious-step-to-automate is the unlocking of
the workstation (NT session and application session), which happens
hundreds of times a day.

So let's say I walk up to a computer that is locked by SHARED or
whatever.  The biometric system reads my fingerprint, but instead of
attempting to log ME in using my own credentials, it realizes that
this is an examination room, and unlocks the computer using SHARED's

2.The *application* accounts (EHR, for starters) *are* unique but are
not associated with the NT account.  So after unlocking the
workstation in step 1 above, I now need to unlock the EHR.  At this
point, the single-sign application needs to recognize that Andrew just
scanned his fingerprint, and the EHR appears to be in the foreground,
so it should be unlocked with Andrew's password.

You can see how this would be extremely difficult if all of the SSO
information is associated with a given unique NT account!

Furthermore, the EHR user needs to have control over their EHR
password; we would probably not implement biometrics everywhere in the
organization and there are remote access needs, so we would not want
an SSO solution that only works under the assumption that you never
actually know the application password (or if you want to know, it's
this easy: "5tik3$}#$[5]245r@wek34/ 45345zdmf234 525243545[]{}:.")

I'd appreciate any advice you have to offer!

Re: Examination room computers accessed by tons of users: what's the answer? Biometrics?

In article <540e5d37-a841-4c67-a0a9-6fa23ddfbbf1
@e39g2000hsf.googlegroups.com>, aydeejones@gmail.com says...
Quoted text here. Click to load it

Replace the workstations with thin-client systems, no disk, no OS, just
a remote desktop connection to a small terminal server.

Using group policy or other, auto-start the application and set it to
log out the user if they close the application.

So, thin-client system (about $250), small terminal server - cost is up
to you, restriction to only run your app and force logout of they close
the app.

We do this in medical treatment rooms all the time.

- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
  drug dealer an "unlicensed pharmacist"
spam999free@rrohio.com (remove 999 for proper email address)

Site Timeline