Multi-Factor Authentication & Passkeys
Protects provider, staff, and client accounts with multi-factor authentication via SMS or authenticator app, plus passwordless passkey sign-in using Face ID, Touch ID, or a device PIN. Users manage their own methods, recovery codes, and active login sessions from a single Password & Security page.
Built by Core Engineering
The problem it solves
A compromised password is enough to expose a full chart of protected health information, and healthcare accounts are a frequent target for credential stuffing. Password-only login leaves practices dependent on every user choosing strong, unique credentials, with no fallback when one is leaked.
What's included
- MFA via SMS one-time code or authenticator app (Google Authenticator, Authy, 1Password, and similar), with multiple methods active at once
- Passkey sign-in using Face ID, Touch ID, or device PIN as a phishing-resistant alternative to passwords
- Recovery codes issued at setup and trusted-device memory for 14 days
- Self-service Password & Security page covering password changes, passkeys, MFA methods, and active login sessions with remote logout
- Admin reset of a provider's MFA, and provider reset of a client's MFA with the "Can set client passwords" permission
How it works
Users open Settings, then Account, and click Password & Security to reach the security portal. From there they add an MFA method by following the on-screen prompts, scanning a QR code for an authenticator app or verifying a phone number for SMS. A recovery code is generated during setup and should be stored securely. Users can register passkeys, view and delete existing ones, change their password, and review active sessions by device, location, IP, and last activity, logging any session out remotely. On sign-in, users enter their email and password or authenticate with a passkey, then complete the MFA challenge if MFA is active. A trusted device can skip the challenge for 14 days. When MFA is enabled or changed, the user receives an email confirmation. Admins reset a provider's MFA from the provider profile using Reset MFA. Providers reset a client's MFA from the client profile under Actions, then Personal Information, with the "Can set client passwords" permission. In authenticator apps the account is labeled Healthie, or the organization's brand name for white-label accounts.
Multi-Factor Authentication & Passkeys adds a second verification step to Healthie sign-in and lets users replace passwords with device-bound passkeys. It is available to every account type, including providers, support staff, and clients, so an organization can protect access to health data on both sides of the portal. Users enable and manage their methods from Account Settings, choose multiple methods for redundancy, and receive a recovery code at setup. Admins can reset MFA for a provider, and providers with the right permission can reset MFA for a client who has lost access.