Questions About Signing In and Account Security

Do we have to use multi-factor authentication?

It is optional until an administrator requires it, either for one person from Edit User or for everyone with Require MFA for All Users. It is strongly recommended: a password on its own is one guessed or reused credential away from exposing patient records.

Which is better, the app or text messages?

The Authenticator App. Its codes are generated on the device and never sent anywhere, so there is nothing to intercept, and it works with no phone signal. SMS Text Message is a reasonable second choice where an app is not practical.

What happens the first time MFA is required?

The user signs in as usual and is then asked to finish setting up a method before going any further. Nothing is lost and no data is affected - but turn the requirement on when people are at work with their phones to hand, not at the end of a Friday.

I have a new phone. How do I get back in?

An administrator clears the old enrolment: Edit User, then Reset TOTP beside Authenticator App:. You then set the app up again from your own Account page. You cannot clear your own second factor, and that is deliberate.

My code keeps being rejected and I have not changed phones.

The phone clock has drifted. The codes are based on the time, so a phone a minute out produces codes that are refused. Set the phone to get date and time automatically.

How many wrong passwords lock an account?

Five. The account then locks for 15 minutes. Waiting clears it, or an administrator can release it immediately with Unlock Account from the Users list or from Edit User.

Can I unlock my own account?

No - an administrator has to, or you wait the 15 minutes. If nobody else in the practice is an administrator, that is worth fixing before you need it.

Someone has left. What should we do with their account?

Remove their access the same day. Do not simply change the password and leave the account in place, and do not hand it to their replacement - the record of who did what depends on each person having their own login.

Why can one user not see Reports or the patient list?

Those are separate permissions on the user record, not part of signing in. Open Edit User and check the access boxes. Access that was never explicitly granted counts as not granted, so a brand-new account can sign in perfectly and still see very little until its permissions are set.

We are all locked out and we use IP authentication.

Your internet address has most likely changed. Nobody inside the practice can correct it, because the Admin page sits behind the same check. Contact NaturaeSoft support.

Is a shared login ever acceptable?

No. It removes any meaningful audit trail, and when one person changes the password everybody else is locked out at once.