Your practice’s email account can be a gateway to password resets, shared files, and business conversations. Protecting it deserves the same planning you give the systems inside your office. Multifactor authentication, or MFA, adds another identity check when someone signs in.
CISA recommends requiring MFA wherever possible and choosing phishing-resistant methods. For an optometry practice, the practical challenge is introducing that protection without leaving staff confused or unable to work. Start with a planned rollout rather than a last-minute instruction to “turn everything on.”
Start with your highest-impact accounts
Ask your IT provider to inventory administrator accounts, business email, remote access, cloud storage, and the applications holding sensitive information. Record which MFA methods each vendor supports. Prioritize accounts whose misuse would have the widest effect on the practice.
A shared password should not become the workaround for an awkward sign-in process. Where a system supports it, use named accounts so access can be granted, reviewed, and removed for each person.
Choose a method your systems support
Phishing-resistant options can include appropriately implemented passkeys or security keys. Availability depends on the application and account configuration. Your provider should confirm compatibility, enrollment steps, and recovery options before changing sign-in requirements.
If a clinical application has limited authentication features, discuss the supported safeguards with its vendor. Avoid making untested changes to a live workstation or device that your team depends on during patient appointments.
Make the first rollout small
Choose a small pilot group and schedule enrollment when help is available. Explain what a normal sign-in looks like, how staff should report an unexpected prompt, and whom to contact if a device is lost. Ask the pilot group where instructions are unclear, then improve them before expanding.
Plan for recovery before it is needed
Document how an authorized person regains access after losing an authenticator or replacing a phone. Protect recovery information and make sure administrative recovery does not depend on a single person being available. Test the procedure with your provider without exposing actual credentials.
Keep access reviews on the calendar
Revisit accounts when staff join, change responsibilities, or leave. Check that the agreed MFA requirement still applies and that old recovery methods have been removed appropriately. Keep the process simple enough for the practice manager to understand.
MFA is one part of a broader security plan. For a focused discussion of account access and your practice’s priorities, request a free 20-minute discovery call with ClearPHI. You can also explore our optometry cybersecurity and IT services.
Reference: CISA: Require Multifactor Authentication.
This article provides general educational information. It is not legal, medical, or individualized compliance advice. Security measures reduce risk but cannot eliminate it; changes to clinical systems should be coordinated with your IT and software providers.