The solutions you propose are pretty much the norm already. PC logins are typically LDAP or AD however. ymmv whether your eme login is on the same domain as y

The solutions you propose are pretty much the norm already. PC logins are typically LDAP or AD however. ymmv whether your eme login is on the same domain as your pc login. For example, on Cerner emr they are typically separate but this has more to do with the hosting infra more than anything else. All the emr security in the world wont help you if a random piece of critical equipment that is compromised locks you out.