Since most work environments require employees to wear some kind of identification badge, it is natural to expect that this badge might be useful for user authentication in a medical information system. When combined with either something the user knows or a biometric identification method, this can be an extremely effective method of user identification. Tokens can take a variety of forms, including cards of various sizes and other devices. Cards can also incorporate a variety of technologies, including pictures, magnetic strips containing secret or biometric information, or even a microprocessor and memory in a very small package. Because of the opportunities to use this processing power for other applications (particuarly data authentication), I will delay discussion of tokens until section 3.3.