Password Management Policy Checklist for Epidermolysis Bullosa Centers

A password management policy helps an epidermolysis bullosa center protect patient information while giving staff, clinicians, and administrators clear steps for using accounts safely. Use this checklist as a starting point, then adapt it to your systems, workflows, and risk assessment.

HIPAA’s Security Rule applies to covered entities and business associates that handle electronic protected health information (ePHI). It requires appropriate safeguards, but does not prescribe one universal password policy for every organization. The center should determine which requirements apply to it and choose reasonable safeguards for its circumstances. See the HHS overview of the HIPAA Security Rule and its summary of Security Rule safeguards.

How should staff protect password confidentiality and uniqueness?

Require staff to use a different password for every work account, including email, the electronic health record (EHR), scheduling, billing, remote access, and the password manager itself. Reusing a password lets someone who obtains it from one compromised service try it on other accounts. NIST recommends distinct passwords for each service to reduce this risk.

Staff should never share passwords with colleagues, supervisors, patients, or vendors; include them in email, chat, or tickets; or leave them visible on paper or at a workstation. If a coworker needs access, an administrator should grant that person an individual account with appropriate permissions rather than disclose another employee’s credentials.

Keep authentication factors private, too. Staff should not approve unexpected multifactor authentication (MFA) prompts or share one-time codes. They should report suspicious prompts and suspected credential exposure promptly using the center’s designated security-reporting channel.

Which password manager and storage practices should the center require?

Choose an organization-approved password manager that has been reviewed for security, supports individual user accounts and MFA, and provides administrative controls appropriate to the center’s needs. Prefer a managed business service over personal password-manager accounts, spreadsheets, browser notes, or shared documents. NIST advises organizations to evaluate password managers before recommending or requiring them.

Require staff to use the approved manager to generate and store unique passwords. Protect its vault with a strong, unique master passphrase and MFA where available. Limit vault sharing to documented business needs, assign access individually, and remove access when a staff member’s role changes or employment ends.

Staff should access work systems over approved connections and avoid entering credentials into unexpected links or untrusted devices. Systems that handle ePHI should use appropriate safeguards for information transmitted over networks; the HIPAA Security Rule addresses transmission security in its technical safeguards.

For systems that verify passwords, require the system owner or vendor to confirm that passwords are protected in storage using salted password hashing, not stored as readable text, and that password entry uses an authenticated, protected channel. NIST describes these protections in its Digital Identity Guidelines. If a vendor creates, receives, maintains, or transmits ePHI on the center’s behalf, assess applicable business associate obligations and agreements as well.

What standards should passwords and passphrases meet?

Set a minimum length that accounts for how each password is used. NIST SP 800-63B-4 specifies a minimum of 15 characters for passwords used as a single authentication factor; passwords used only as part of MFA may be shorter under that guidance, but not less than eight characters. A center can adopt a stricter standard based on its risk assessment and system capabilities.

Encourage long, memorable passphrases or manager-generated random passwords. Avoid relying on predictable substitutions, personal details, or phrases connected to the center or the user. Where the system supports it, screen new passwords against commonly used, expected, or known-compromised passwords.

Do not require routine password changes on a fixed schedule without a risk-based reason. Instead, require a change when there is evidence of compromise, when a password was exposed, or when a system or security process requires it. NIST’s guidance also advises against arbitrary periodic changes and composition rules such as requiring a specific mix of character types.

How should access be assigned by role and administrative responsibility?

Use role-based access control (RBAC) to assign permissions according to each person’s job duties. Provide only the access needed for those duties, and use separate individual accounts so system activity can be associated with the person who performed it. HHS describes role-appropriate access and technical access controls in its HIPAA Security Rule summary.

Separate routine work from administration. Staff who manage user accounts, systems, or security settings should use a dedicated privileged account for those tasks and a standard account for ordinary work. Apply privileged account management controls, such as limiting the number of administrators, protecting administrator accounts with MFA, and reviewing privileged activity.

Document who approves access to clinical, administrative, and vendor systems. Review permissions when someone changes jobs and at intervals set by the center’s risk-management process. For urgent patient-care needs, define any emergency access process in advance, limit its scope, and review its use afterward.

What steps should staff take after suspected password compromise?

Staff should promptly report suspected compromise to the designated security or IT contact. This includes a disclosed or reused password, an unexpected login alert, an unfamiliar MFA request, or a lost device that may provide access to work accounts. They should not wait for proof of unauthorized access before reporting a credible concern.

The response team should follow the center’s incident procedures. Depending on the circumstances, it may disable or reset credentials, revoke active sessions and tokens, review sign-in and access logs, check whether other accounts used the same password, and reset those credentials too. If the password-manager master password or vault may be affected, follow the manager’s incident and recovery process.

Preserve relevant information and document the response. The center should assess whether ePHI may have been accessed or affected and follow its applicable incident and breach-response procedures. HHS states that regulated entities must address suspected or known security incidents, mitigate harmful effects where possible, and document incidents and outcomes.

How should the center manage account creation, resets, access changes, and termination?

Before creating an account, verify the person’s identity, work relationship, job duties, and required permissions. Have an authorized supervisor or system owner approve access, use an individual account, and record the systems and roles granted. Give temporary workers and vendors access only for an approved purpose and period.

For password resets, require identity verification for password resets using a reliable, documented process—such as a verified staff contact method and confirmation through an approved support channel. Do not rely on easily discovered personal facts or security-question answers. Send a reset link or temporary credential only through an approved method, make it time-limited where supported, and require a new password at the next sign-in when appropriate.

When duties change, promptly adjust access to match the new role. When a staff member leaves, carry out account deprovisioning in coordination with the manager and IT: disable the organization account and linked system access, revoke active sessions and recovery factors, remove password-manager access, and recover or secure organization devices. The center’s written procedures should set responsibilities and timing based on its risk and operational needs.

HIPAA’s administrative safeguards include workforce security and information access management. The regulation also addresses termination procedures in 45 CFR § 164.308. Treat account closure as part of a coordinated offboarding process, not as a password change alone.

What safeguards, staff training, and policy reviews are needed?

Pair passwords with MFA for accounts that can access sensitive information or perform administrative tasks, where supported and appropriate to the center’s risk assessment. Use unique accounts, access controls, and audit logs alongside MFA; no single safeguard replaces the need to assess risk and apply appropriate protections. The Security Rule requires authentication and access controls, but centers should not mistake a recommended MFA practice for a universal, explicitly stated HIPAA MFA mandate.

Train staff on the center’s own rules for password managers, MFA prompts, phishing, reporting suspected compromise, and handling work devices. Cover responsibilities during onboarding and reinforce them periodically based on the center’s needs, policy, and changes in risk. HIPAA requires training on security policies and procedures for workforce members of regulated entities; it does not make a training completion certificate proof that an organization is HIPAA-compliant.

Assign responsibility for maintaining the policy, documenting approvals and incidents, and reviewing access and controls. Revisit the policy when systems, workflows, staffing, or risks change, and evaluate whether safeguards remain appropriate. HHS explains that regulated entities must review and update security measures and documentation as needed.

In practice, an effective password management policy combines unique credentials, an approved password manager, risk-appropriate MFA, role-based access, prompt reporting, secure resets, and reliable account deprovisioning. Review these controls as part of the center’s broader security and workforce procedures.

FAQs

Should staff use a different password for each work account?

Yes. Require a unique password for every work account. A password manager can generate and store distinct passwords so staff do not need to memorize each one.

Where should center staff store work passwords?

Use the center-approved password manager. Do not store work passwords in personal apps, spreadsheets, shared documents, email, or visible notes unless the center has specifically approved a secure procedure for that situation.

When should a password be changed after suspected compromise?

Change it promptly after suspected or confirmed exposure, following the center’s incident-response process. Also change any other account password that reused the exposed password. Do not wait for a routine scheduled change.

How should access be removed when a staff member leaves the center?

Coordinate offboarding with the staff member’s manager and IT. Disable the organization account and linked system access, revoke sessions and recovery factors, remove password-manager access, and recover or secure organization devices according to the center’s procedures.