Password managers and MFA
Shared passwords on a sticky note under the reception monitor are still the most common finding in a small-practice security review. The fix takes about an afternoon.
Shared logins on a sticky note under the reception monitor remain the most common finding in a small-practice security review. Fixing it takes about an afternoon, and the staff resistance you are expecting mostly does not materialise if you do it in the right order.
Why shared passwords are the real problem
It is not only that they are guessable. It is that they destroy accountability — with one shared login, your audit trail cannot tell you who viewed a record, which is a direct HIPAA problem. And when someone leaves, you either change it everywhere at once or leave a live credential in the hands of a former employee. In practice, most places do neither.
Current password guidance
The advice changed, and much of what practices still enforce is now considered counterproductive:
| Length over complexity | A long passphrase beats a short string of symbols. correct-horse-battery-staple is far stronger than P@ssw0rd! and vastly easier to type. |
|---|---|
| Stop forcing rotation | Scheduled expiry drives people to Spring2026! then Summer2026!. Change passwords when there is a reason to — a suspected compromise, or a departure. |
| Drop the composition rules | Mandatory symbol-and-digit rules push everyone to the same predictable patterns. |
| Screen against breaches | Check new passwords against known-breached lists. Reuse from a breach elsewhere is a leading cause of compromise. |
| Never reuse | Especially not between a personal account and anything clinical. |
Rolling out a password manager
Pick a business plan, not individual accounts
You need shared vaults and the ability to revoke a departing employee’s access centrally. Confirm the vendor will sign a BAA if any credential grants access to PHI.
Start with the shared logins
Put the accounts everyone currently shares into a shared vault first. This is the immediate, visible win — nobody has to remember them any more.
Move personal work accounts next
Each person’s own logins into their private vault. The browser extension does the typing, which is the moment most staff stop resisting.
Then change the weak ones
Now that nobody has to memorise anything, regenerate long random passwords for anything important. Not before — doing this first is what makes rollouts fail.
Turn on MFA for the manager itself
It now holds everything. Protect it accordingly, and make sure at least two trusted people can recover access.
Multi-factor authentication
MFA is the highest-value control available to a small practice. Not all factors are equal:
- Passkeys / hardware keys — strongest. Phishing-resistant by design: the credential is bound to the real site, so a fake login page cannot use it.
- Authenticator app codes — good, and the sensible default for most practices.
- Push approvals — convenient, but vulnerable to fatigue attacks where users approve a repeated prompt to make it stop. Enable number matching if offered.
- SMS codes — weakest, because of SIM-swap attacks. Still far better than nothing; use it where nothing else is supported.
Turn it on for email first — email is the reset path for everything else, so it is the account that protects all the others. Then VPN and remote access, then the EHR, then anything with administrative rights.
Shared clinical workstations
The usual objection is that a shared front-desk machine makes individual logins impractical. The workable answer is individual accounts with fast switching — badge or PIN unlock on a short screen-lock timeout — rather than one account everyone stays signed into all day. It preserves the audit trail without adding friction to a busy desk.
FAQ
Is a password manager safe? It is all our passwords in one place.
Reputable managers encrypt your vault so that the vendor cannot read it. The realistic alternative — reused passwords, sticky notes, a shared spreadsheet — is far more dangerous. Protect the manager with MFA and it is a substantial net gain.
Our EHR does not support MFA.
Ask the vendor for their roadmap — and treat it as a factor at renewal. Meanwhile compensate: MFA on the VPN or network path that reaches it, strong unique passwords, tight session timeouts, and regular review of the access log.
What about the practice owner? They hate this.
Owners and physicians are targeted specifically because they have the broadest access and the most authority to be impersonated. Exemptions for senior staff are exactly where these attacks succeed. Make the rollout genuinely easy, then apply it to everyone.