Wirral University Teaching Hospital (NHS) Secures Clinical Passwords at Scale

Protecting Patients Starts with Protecting Passwords

In healthcare, there’s no such thing as downtime. For the IT team at Wirral University Teaching Hospital NHS Foundation Trust, that reality makes cybersecurity both critical and complex. With clinical staff relying on shared terminals on wards, a rotating pool of external trust workers, and hundreds of employees accessing systems remotely, password security had to be both robust and completely frictionless.

Microsoft’s native password tools weren’t up to the task. The IT team needed more granular control that would let them enforce longer, stronger passwords without triggering a wave of helpdesk calls mid-shift. In an environment where a compromised credential could have serious consequences, continuous monitoring for breached passwords was a must.

They also needed customizable policies that reflected their local context. Harry Brown, Technical Services Manager, told us: “Staff were routinely using predictable passwords referencing Liverpool FC, Everton, and even the Beatles. Blocking those kinds of culturally familiar terms required a custom dictionary capability Microsoft simply didn’t offer.”

A Proven Solution, Trusted Across the NHS

Specops Password Policy was already in use at other NHS trusts, which gave the team confidence that it could be deployed quickly and reliably in a healthcare environment. The must-have criteria were clear, the solution had to work without interrupting clinical duties and had to be rolled out fast. Several features stood out during evaluation:

• Granular Policy Controls: The ability to configure policies by user group, enforce length-based password ageing, and block locally relevant dictionary terms gave the team the precise control they needed. Under the new framework, a 14-character password earns end users a 3-month expiry window; 16 characters buys 6 months; and 18 characters grants a full year. This approach nudges users towards longer, more secure credentials without making complexity the barrier.
• NHSMail and Imprivata Integration: For nurses logging into shared ward terminals via Imprivata, seamless integration was essential. Specops delivered on both fronts, making it practical for clinical staff without adding friction to fast-paced ward environments. The trust also needed to align with NHSMail requirements.
• Breached Password Protection: Continuous scanning runs in the background, and the team receives a daily report showing whether any credentials have been compromised. It’s the kind of quiet reassurance that matters in a high-stakes environment.
• Dynamic End-User Feedback: Rather than leaving staff guessing why their password was rejected and reaching for the phone, Specops provides real-time feedback with clear, visual guidance on what’s required. The impact on helpdesk call volumes was immediate and significant.

Thousands of Tickets Reclaimed

The results have been substantial. A recent service review put the numbers in sharp focus: 5,531 self-service password resets, 784 password changes, and 164 account unlocks — totaling more than 6,500 interactions that would previously have landed with the helpdesk.

For Harry and his team, the value goes beyond the numbers: “When a consultant is locked out of a system, every minute matters, both for them and for the patients waiting. Reducing that friction has direct operational impact. And with first-line staff freed from the constant burden of password queries, they can focus on fixes that actually need human attention.”

The trust also works closely with a network of external NHS trusts, sharing resources across hospitals. Specops has helped make onboarding new joiners more secure from the outset, replacing a makeshift process with one that prompts users to create a strong password from day one.

A Fast Rollout, One-to-One Support

From the first contact, the Specops sales team moved quickly, connecting the trust with an engineer who guided them through demos and stayed on the line throughout the proof of concept. Harry described the support as “They came across as genuinely expert: not scripted, not outsourced, but knowledgeable and responsive.”

The rollout itself was completed in approximately eight weeks. At peak, the team was onboarding 400 to 500 users a day without incident. Staff working night shifts, admin teams working from home, and clinical staff across the wards all came through the transition smoothly. Remote password resets (previously a logistical headache) became straightforward.

What’s Next?

The team is exploring Specops Secure Service Desk as their next step, with an eye on future integration with Service Now. With a strong foundation in place, Wirral University Teaching Hospital NHS Foundation Trust is well-positioned to extend its security posture further, without ever losing sight of the clinical environment it’s there to protect. According to Harry: “I’d definitely recommend Specops to other NHS trusts, it’s been a massive help.”