In an ultimately secure configuration, all logins would require hardware tokens, timeouts would be under a minute, and no remote access would be available.
Such restrictions would be very secure, but so hard to use that patient care may suffer.