A hospital wants to strengthen login security for its clinical workstations. The IT team decides to require staff to place their finger on a scanner in addition to entering their existing username and password. Which authentication factor category does the newly added finger scan represent?