Passwords, multifactor sign-in and access control

Purpose. Each person has their own account, and nobody uses anyone else's. This is how the practice knows who looked at what.

Passwords. Passwords are at least 14 characters. Use a passphrase. Never write it down where others can see it and never share it, including with IT.

Multifactor sign-in. Signing in to the practice management system, email or any system from outside the office now requires a second step from the authenticator app. Text message codes are no longer accepted.

Leaving the practice. Managers notify IT on or before a person's last day, and access is removed that day.

Access reviews. Managers confirm the access of everyone in their department every quarter.