I believe that the system you described would allow all users on the hospital system to log in since the system can't check who exactly is requesting the cookie

I believe that the system you described would allow all users on the hospital system to log in since the system can't check who exactly is requesting the cookie. Plus, once the cookie is distributed it is only associated with the current login attempt so the system cannot know exactly which user it is.