We all use keycards to access buildings and secure rooms. Keycards should be (and have been) used to secure computer systems in lieu of passwords. Now with U2F

We all use keycards to access buildings and secure rooms. Keycards should be (and have been) used to secure computer systems in lieu of passwords. Now with U2F and biometrics that's the best practice. If passwords have to be used, they should not be chosen by a user, but generated by the system and given to the user once. This is how 'app passwords' work with modern secure web services that otherwise require multi-factor authorization. For memory's sake this can be a set of words. The absence of a secured NFC or bluetooth connection can be used to automatically de-authenticate and lock sessions. I created a perl script to lock my screen-saver this way 15 years ago! It should be dead simple to modify systems access. A set of keycards should grant admin access to different parts of the system, and those given out to different levels of staff, so each level of staff can admin the group they work with, and higher levels can provide additional override. This provides redundancy and scales workload better. For problems with the EHR system, this stems from poor design. Monolithic systems cannot be easily worked around, but loosely-coupled systems can be. A set of filing cabinets are loosely-coupled from what they can hold, can be keyed the same or differently, can be repurposed. Information system design needs to work more like independent furniture in an office, rather than a single set of furniture that only works in one way. Systems should be decoupled from each other so that a user can manually shuffle data around between them. Data should be decoupled from systems and made portable. Data fields should allow comments the way a piece of paper allows you to write in the margins.