What other authentication technology could prohibit the sharing of log in IDs (from the initial point of log in) as completely as biometrics?
Biometrics may do a good job and for many institutions it will be a reasonable and cost effective solution for specific environments. I have a problem with it being presented as a global; one size fits all, solution. In many places biometrics is overkill and has some user acceptance and usability issues. Remember, the key to HIPAA Security compliance is not providing absolute, bulletproof, protection, but taking reasonable and diligent precautions appropriate to the entity, taking business and cost into consideration Forced automated logoff combined with simple id and password (and strong password enforcement) will suffice in most areas. There are alternatives to biometrics that provide reasonable authentication and work better in some environments – including proximity sensors and tokens.
