Password Management Policy Checklist for Qualified Clinical Data Registry Vendors

Use this checklist to assess password controls for a Qualified Clinical Data Registry (QCDR) vendor system. The settings below reflect CMS’s published password guidance; they are not automatically universal password rules for every QCDR. Confirm which controls apply to your system through its current CMS security baseline, contract, and security plan. CMS’s policy applies to entities conducting business for CMS, collecting or maintaining information for CMS, or operating systems on CMS’s behalf when the requirements are incorporated as applicable. See the CMS Information Systems Security & Privacy Policy and current CMS Acceptable Risk Safeguards.

What password length should regular and privileged users use?

CMS’s published configuration guidance specifies a minimum of 8 characters for regular users and 15 characters for administrators or privileged users across high-, moderate-, and low-impact systems. Apply the 15-character minimum to privileged account password controls, and check the applicable system baseline for any stricter requirement. See CMS Password Requirements.

These CMS settings should not be mistaken for a universal rule for all systems. Current NIST Digital Identity Guidelines specify at least 15 characters for a password used as a single authentication factor, while allowing a minimum of 8 characters when it is used only as part of multifactor authentication. Determine which requirement applies to your QCDR vendor system before adopting a minimum.

Which complexity rules apply to high-risk systems?

CMS’s published page says high-risk systems should use at least 3 of the 3 character categories it lists: uppercase letters (A–Z), lowercase letters (a–z), and digits (0–9). The page’s list does not include special characters, so verify the required categories against the current baseline and contract for your system rather than assuming symbols are required. See CMS Password Requirements.

CMS also says passwords must not contain dictionary names or words. This is a CMS configuration rule, not a universal QCDR-specific federal law. NIST’s current guidance instead calls for checking a new password against a blocklist of commonly used, expected, or compromised passwords, which may include dictionary words.

How many previous passwords should systems prevent users from reusing?

Set password history enforcement to prevent reuse of the previous 12 passwords on high-impact systems. For moderate- or low-impact systems, CMS specifies a history of 6 passwords. These are the counts in CMS’s published password configuration guidance; confirm the applicable impact category and any stricter system-specific setting. See CMS Password Requirements.

How should passwords be stored and transmitted?

Protect passwords both in storage and in transit. CMS’s published guidance says systems must store and transmit only encrypted versions of passwords. For encrypted password storage, use a non-reversible, salted password hash rather than reversibly encrypting passwords; use an authenticated protected channel when transmitting them. See CMS Password Requirements and NIST’s password verifier requirements.

Limit access to password-verifier data and protect related systems against unauthorized access. A stored hash is not the plaintext password, but a stolen password database can still be attacked offline; secure storage and transmission should therefore be documented and tested as separate controls.

How should temporary passwords and first-time logins be managed?

Allow a temporary password for a first-time login, but require the user to change it immediately to a permanent password. Apply temporary credential rotation after account recovery as well when required by the system’s policy. CMS’s published page specifies the immediate change for first-time logins, and its security safeguards describe an immediate change after account recovery. See CMS Password Requirements and the CMS Medicare Administrative Contractor Acceptable Risk Safeguards.

Issue temporary credentials securely, restrict their use to the intended account and purpose, and ensure they cannot remain valid after the required change. Document the process in your account-provisioning and recovery procedures.

What character-change controls should apply when passwords are changed?

Where the operating environment supports a minimum password character-change setting, CMS’s published guidance specifies 12 changed characters for high-risk systems and 6 for moderate- or low-risk systems. The setting concerns how many character positions differ from the previous password. Confirm the required value against your current system baseline before implementation. See CMS Password Requirements.

Do not confuse a character-change threshold with password history enforcement: the threshold limits how similar a new password can be to the previous one, while history prevents reuse of older passwords. NIST’s current guidance does not require routine periodic password changes; it does require a change when there is evidence of compromise. See NIST Digital Identity Guidelines.

Which additional password restrictions apply to moderate- or low-impact systems?

CMS’s published guidance says passwords on moderate- or low-impact systems must not contain dictionary names or words. It specifies the same minimum lengths as for high-impact systems—8 characters for regular users and 15 for administrators or privileged users—and a six-password history. See CMS Password Requirements.

For these systems, using more than one of the listed character categories is optional under the CMS page. Where the operating environment supports a changed-character setting, the page specifies 6 changed characters. Document the system’s impact category and its approved settings so your password policy matches the requirements that actually apply.

In short, document the applicable CMS baseline, enforce the required lengths and password history, protect stored and transmitted credentials, and require immediate changes to temporary passwords. Recheck system-specific requirements before treating any setting as universal across QCDR vendor environments.

FAQs

What is the minimum password length for privileged users?

CMS’s published configuration guidance specifies at least 15 characters for administrators or privileged users. Check the applicable system baseline for any stricter requirement.

How many previous passwords should a high-risk system block?

CMS’s published guidance specifies a password history of 12 for high-impact systems, preventing reuse until 12 new passwords have been used.

Should temporary passwords require an immediate change?

Yes. CMS’s published guidance says a temporary password for a first-time login should be changed immediately to a permanent password. Account-recovery controls may also require an immediate change.

Are dictionary words prohibited on moderate- or low-impact systems?

Yes, under CMS’s published password configuration guidance, passwords on moderate- or low-impact systems must not contain dictionary names or words. Confirm that this CMS setting applies to your system and contract.