Study of Password Management Practices Among Healthcare Workers in University of Benin Teaching Hospital

Healthcare information systems store highly sensitive patient data, and the password management practices of healthcare workers represent a critical first line of defence against unauthorised access to electronic health records. This study assessed the password management practices of clinical and administrative staff at the University of Benin Teaching Hospital, Benin City, Edo State, South South Nigeria. A cross-sectional survey was conducted among 200 healthcare workers using stratified random sampling across clinical, nursing, and administrative departments. The instrument assessed password creation strength, frequency of changes, sharing behaviour, reuse across systems, and use of password managers. Results showed that 61.0 percent of respondents used passwords of fewer than eight characters. Password sharing with colleagues was reported by 42.5 percent, primarily citing convenience. Password reuse across hospital and personal accounts was practised by 68.5 percent. Only 11.5 percent used a dedicated password manager. One hundred percent of respondents acknowledged that patient data confidentiality was important, yet behaviour did not align with this awareness. Clinical staff showed significantly lower password strength practice than administrative staff (p < 0.05). The study concludes that password management practices at UBTH are generally inadequate and create exploitable vulnerabilities in health data security. Recommendations include a mandatory health information security training programme, role-based access controls, identity management system implementation, and a hospital information security policy specifically addressing password standards and sharing prohibitions. Keywords: password management, healthcare workers, health data security, UBTH, access control