Health care information is an attractive target for cybercriminals. Nowadays, with the significant diffusion of Internet of Things (IoT) and Bring Your Own Device (BYOD), patients and medical staff use smart devices to generate and access medical data in hospitals and healthcare practice, so protecting them is a critical security domain. Continuous Authentication (CA) is an access control mechanism that monitors user activity to determine if access is legitimate. This paper presents a case study of CA in eHealth that was implemented as part of the ProTego Project. We present the initial results of implementing a keystroke mobile agent with machine learning classifiers to build user models.