Password Management Policy Checklist for Whole-Body MRI Screening Companies

A password policy can help protect imaging systems, patient portals, scheduling tools, and other accounts that may provide access to patient information. Start by identifying whether your company is a HIPAA covered entity or business associate; the service you provide alone does not determine HIPAA status. If the HIPAA Security Rule applies, its safeguards cover electronic protected health information (ePHI). HHS also states that the current Security Rule remains in effect while proposed changes are considered. HHS’s HIPAA Security Rule summary explains the rule’s scope and requirements.

Use this checklist to build a policy around your organization’s risks and systems. HIPAA requires procedures for creating, changing, and safeguarding passwords as an addressable implementation specification: assess whether the measure is reasonable and appropriate, and document your decision and any appropriate alternative. 45 CFR § 164.308 and HHS’s guidance on addressable specifications explain this distinction.

Which systems and account holders are covered by the password policy?

Define the policy’s scope by tracing where staff, contractors, vendors, and service accounts can sign in—not just by listing systems that contain MRI scans. Include every account that could access ePHI, administer a system that stores it, or affect the availability or security of those systems.

• Imaging and clinical systems: MRI scanner consoles and workstations, PACS or image-viewing platforms, radiology reporting tools, electronic health records, and image archives.
• Patient and business applications: patient intake and results portals, scheduling, billing, customer support, email, file storage, and document-signing platforms.
• Access infrastructure: identity providers, single sign-on, remote access, VPNs, network administration, backups, and cloud management consoles.
• People and nonhuman identities: employees, radiologists, temporary staff, contractors, IT administrators, vendor technicians, service accounts, API keys, and other system credentials.

Include personal devices or shared workstations when they are authorized to reach these systems. Set rules for any break-glass account used during an emergency, too: restrict who can use it, protect its credentials, and review each use.

List systems that do not handle ePHI separately, but include them in the policy if they can provide a route into systems that do. A documented inventory helps your team apply the right safeguards and reassess risks when systems or workflows change. HHS’s risk analysis guidance notes that an assessment may include an inventory of systems and applications used to access or house ePHI.

Who is responsible for password management?

Assign responsibility rather than leaving password security to individual users. The HIPAA Security Rule requires a regulated entity to identify the security official responsible for developing and implementing its security policies and procedures. 45 CFR § 164.308 sets out this requirement.

• Security official: owns the policy, coordinates risk reviews, approves exceptions, and tracks corrective actions.
• IT or identity administrators: configure authentication controls, manage access, monitor alerts, and disable accounts when authorized.
• System owners: identify account types, approve role-based access, and confirm that application settings support the policy.
• Managers and HR: promptly notify IT about new hires, job changes, leave, and separations so access can be adjusted or removed.
• Workforce members and contractors: keep credentials private, use approved tools, and report suspected exposure promptly.
• Vendor and service owners: coordinate credential controls with third parties and ensure vendor access is approved, limited, and removed when no longer needed.

Train staff on the organization’s actual procedures, including how to use the approved credential vault and report a compromised account. A training completion certificate is not evidence by itself that the organization is HIPAA compliant; policy, safeguards, risk assessment, and follow-through matter as well.

What password creation rules should MRI screening companies require?

Set clear rules that staff can follow across supported systems. A practical benchmark is current NIST digital identity guidance, but it is not a password-length mandate imposed by HIPAA. NIST specifies a 15-character minimum for passwords used as a single factor, and permits a lower minimum of eight characters when the password is used only as part of multifactor authentication. It also advises against arbitrary composition rules and recommends checking new passwords against a blocklist of common or compromised choices. NIST SP 800-63B-4 provides the guidance.

• Require a unique password for each work account; do not reuse a personal password or the same password across systems.
• Encourage long passphrases or randomly generated passwords, and allow long passwords and spaces where systems support them.
• Block common, predictable, and known-compromised passwords. Do not rely only on rules requiring a mix of uppercase letters, numbers, and symbols.
• Prohibit passwords based on easily guessed details, such as a staff member’s name, the company name, or the MRI system being accessed.
• Require individual accounts rather than shared staff logins wherever the system supports them.
• Document how to handle legacy equipment or vendor systems that cannot support the policy; assess the risk and apply reasonable compensating safeguards instead of silently exempting them.

HIPAA requires unique user identification for systems that maintain ePHI, supporting accountability for user activity. 45 CFR § 164.312 describes the technical safeguards, including unique user identification.

How should credentials be stored and shared securely?

Use an organization-approved credential vault to store and retrieve work passwords. Choose a solution that your security team has assessed and that supports appropriate access controls, encryption, and activity records. Do not store passwords in plain-text documents, spreadsheets, chat messages, email, or patient records. Avoid writing them on notes near MRI consoles or workstations.

• Protect the vault itself with multifactor authentication and restrict access to authorized users.
• Use individual vault accounts and groups that reflect job duties; review access when roles change.
• Never share an individual’s password. For a necessary shared service credential, store it in a controlled vault, limit who can retrieve it, and keep a record of access.
• For service accounts and API credentials, assign an owner, document their purpose, restrict permissions, and use the organization’s approved secure storage and renewal process.
• Share emergency access through a controlled process that preserves accountability and prompts review after use.
• Do not put secrets in scripts, configuration files, or vendor tickets unless the method has been approved and suitably protected.

If a credential tool or cloud service handles ePHI on your organization’s behalf, assess the provider’s role and applicable safeguards. HHS explains that cloud service providers that create, receive, maintain, or transmit ePHI may be business associates even when they do not hold the encryption key or routinely view the data. HHS guidance on HIPAA and cloud computing describes these considerations.

When should passwords be changed or retired?

Set a clear process for changing passwords when there is evidence or a reasonable suspicion that a credential has been compromised. Also retire or replace credentials when an account is no longer needed, a worker leaves or changes roles, a vendor relationship ends, or a system or integration is decommissioned.

HIPAA requires password management procedures but does not set one universal password-change interval. Current NIST guidance advises against requiring arbitrary periodic changes and says to force a change when there is evidence of compromise. Use your risk assessment and system capabilities to decide whether any additional schedule is justified; do not present annual or 90-day changes as a universal HIPAA requirement. NIST SP 800-63B-4 discusses password changes.

• When a password may be exposed, reset it promptly and revoke active sessions, tokens, or related credentials as appropriate.
• When a staff member separates, disable access promptly and check linked accounts, remote access, vault permissions, and assigned devices.
• When roles change, remove unneeded permissions and credentials rather than simply adding new access.
• When retiring a service account, confirm that applications no longer depend on it and remove the credential from its storage locations.
• Document system limitations or risk-based exceptions, name an owner, and set a date to review them.

How can companies protect accounts from unauthorized access?

Use layers of safeguards so a stolen or guessed password does not automatically expose patient information. Multifactor authentication (MFA) is a strong risk-reduction measure, especially for remote access, email, cloud platforms, administrator accounts, and systems that contain ePHI. The current HIPAA Security Rule requires authentication procedures but does not prescribe one specific authentication method or universally name MFA as a requirement. HHS’s October 2026 cybersecurity newsletter discusses authentication under the current rule.

• Prioritize MFA for privileged users and remote access, and use phishing-resistant options where available and feasible.
• Use role-based access control so staff can reach only the systems and information required for their job.
• Configure an account lockout threshold or other rate-limiting controls based on risk. Balance protection against guessing with the risk of locking out legitimate users; alert on unusual patterns.
• Monitor failed and successful logins, unusual access, and changes to authentication settings. Define who reviews alerts and how to escalate them.
• Limit administrator rights, use separate administrative accounts where appropriate, and review vendor access regularly.
• Train workers to recognize phishing and to report unexpected MFA prompts or login notifications rather than approving them automatically.

Review these controls against the systems and risks identified in your security risk analysis. HIPAA’s Security Rule requires access controls and audit controls for systems that contain or use ePHI; it also requires procedures to regularly review information-system activity. 45 CFR § 164.312 and 45 CFR § 164.308 describe those safeguards.

How should access reviews and credential-management events be documented?

Keep a record of who has access, who approved it, what role or business need supports it, and when the access was last reviewed. Record changes to user accounts and credentials, including account creation, permission changes, resets after suspected compromise, vendor access, exceptions, and account retirement.

Use audit logs and access reports to support reviews of system activity. Record who reviewed the relevant reports, when the review occurred, what issues were identified, and how the company addressed them. Protect these records from unauthorized alteration and limit access to people responsible for security or compliance.

HIPAA requires covered entities and business associates to retain documentation required by the Security Rule for six years from its creation or the date it was last in effect, whichever is later. This applies to required documentation, such as policies and documented actions or assessments; do not assume that this provision automatically sets a six-year retention period for every raw system log. Set an appropriate audit log retention schedule based on risk, operational needs, and other applicable requirements. 45 CFR § 164.316 covers Security Rule documentation and retention.

Review the policy and evidence when your systems, vendors, staffing, or risks change. A useful password management program combines clear ownership, unique accounts, secure storage, risk-based MFA, prompt credential retirement, and documented reviews.

FAQs

Should whole-body MRI screening companies use a password manager?

Yes. An organization-approved password manager or credential vault can help staff use distinct, stronger passwords without memorizing each one. Select a tool that your security team has assessed, restrict access according to job duties, protect it with MFA, and establish rules for any shared service credentials.

How often should staff passwords be changed?

HIPAA does not set a universal password-change interval. NIST advises against arbitrary periodic changes and recommends changing a password when there is evidence of compromise. Your organization should document a risk-based policy and account for system-specific limitations or risks.

What should employees do if they suspect a password has been compromised?

Report it immediately through your organization’s security or IT channel. Follow the incident-response process to change the password, revoke active sessions or related credentials if directed, and avoid reusing the exposed password. Do not investigate alone or delay reporting while waiting to confirm misuse.

Which accounts should require multifactor authentication?

Prioritize accounts with access to ePHI, remote access, administrator privileges, email, cloud services, identity systems, and credential vaults. Use your risk analysis to set the organization’s requirements and address systems that cannot support MFA with documented alternative safeguards.