Many EMR password policies were written around 2005 and never revisited: eight characters, a mix of upper, lower, number, and symbol, and a forced change every 90 days. The federal guidance that shaped those rules has since reversed most of them, and the current version of NIST Special Publication 800-63B says so plainly. This article explains what the guidance recommends, why it changed, and how an EMR administrator can apply it without violating HIPAA or provoking a revolt from clinical staff.
The old rules and why they changed
Complexity rules and periodic rotation were meant to make passwords harder to guess. In practice they produced predictable patterns. Users met the symbol requirement with an exclamation point at the end, met the rotation requirement by incrementing a number, and wrote the result on a sticky note. Meanwhile, the real threats moved on: credential stuffing with passwords leaked from other sites, phishing, and malware that captures whatever is typed. A rotated, complex password does nothing against any of those. NIST's 2017 revision of SP 800-63B dropped mandatory complexity and periodic rotation, and the 2024 revision made the language firmer, stating that verifiers shall not impose composition rules or require periodic changes.
What NIST recommends today
| Topic | Current guidance |
|---|---|
| Minimum length | At least 8 characters; 15 or more when the password is the only factor |
| Maximum length | Allow at least 64 characters; allow spaces and all printable characters |
| Composition rules | Do not require mixes of character types |
| Periodic change | Do not require it; change only on evidence of compromise |
| Screening | Check new passwords against lists of breached, common, and context-specific words and reject matches |
| Hints and knowledge questions | Do not use them |
| Rate limiting | Limit failed attempts to slow online guessing |
| Storage | Salted, iterated hashing with an approved algorithm |
| Paste and password managers | Allow both |
The logic is consistent: length beats complexity, screening beats rotation, and anything that pushes users toward reuse or sticky notes is counterproductive. Multi-factor authentication, discussed below, is the control that changes the math.
Reconciling this with HIPAA
The HIPAA Security Rule in force today does not prescribe password length, complexity, or rotation. It requires procedures for creating, changing, and safeguarding passwords as an addressable specification under the security awareness and training standard, and it requires unique user identification and access controls. A practice is free to adopt NIST-aligned settings as long as its risk analysis and policies document the decision. The proposed update to the Security Rule published by HHS in early 2025 would add more specific technical requirements, including multi-factor authentication; that proposal has not been finalized, and the current rule remains the one in effect. Aligning with NIST now positions a practice well under either.
Auditors and rotation: Some payer security questionnaires and cyber insurance applications still ask for 90-day rotation. Answer accurately, cite NIST SP 800-63B, and describe the compensating controls: MFA, breached-password screening, and lockout. Most reviewers accept that answer; a few will require rotation as a contract condition, in which case the decision is commercial rather than technical.
Applying it in EMR settings
EMR administrators control some settings directly and depend on the vendor for others. Check what your system supports:
- Length: Set the minimum to 12 or more if MFA is enforced, 15 or more if it is not. Raise the maximum as high as the system allows.
- Complexity: Turn off composition requirements if the setting exists. If the vendor hard-codes them, note it as a vendor limitation in the risk analysis.
- Expiration: Set to never, or to the longest interval the system allows if never is not an option, and document why.
- Lockout: Enable temporary lockout or progressive delay after a modest number of failed attempts.
- Screening: Enable breached-password checking if the EMR or the identity provider supports it. If sign-on is federated through a directory such as Active Directory or a cloud identity service, apply the policy there and let the EMR inherit it.
- Automatic logoff: Keep session timeouts; they address a different risk than passwords do.
Rolling out a change without chaos
Update the written password policy first, since staff and auditors will ask for it. Announce the change with the reasoning: longer, memorable passphrases that never expire unless something goes wrong. Give examples of good passphrases and explain that spaces are allowed. Enable the new settings on a date, force a one-time change so every account meets the new minimum length, and enroll everyone in MFA in the same window so the two changes are experienced as one upgrade rather than two disruptions. Keep the help desk staffed for the first week; most calls will be from people who chose a passphrase they cannot remember.
Beyond passwords
NIST's guidance treats a password alone as the weakest acceptable authenticator. Multi-factor authentication, ideally with phishing-resistant methods such as hardware security keys or platform passkeys for administrators, is the control that most reduces account takeover risk. Single sign-on reduces the number of passwords a clinician must remember, which reduces reuse. Proximity badges and biometric unlock on shared clinical workstations keep the convenience of fast switching while preserving individual accountability. A modern password policy is the foundation; these are the walls.
Common questions
Does HIPAA require passwords to be changed every 90 days?
No. The Security Rule requires procedures for creating, changing, and safeguarding passwords but sets no interval. Current NIST guidance recommends against periodic forced changes, and a practice that documents its reasoning in its risk analysis can adopt that position.
What minimum password length should an EMR enforce?
NIST recommends at least 8 characters overall and at least 15 when the password is the only authentication factor. Many organizations choose 12 or more with MFA enforced, and 15 or more without it.
Are password managers allowed for EMR credentials?
NIST recommends that systems permit password managers and pasting. An organization-managed password manager is preferable to browser-saved passwords on shared workstations, and its use should be addressed in the workstation policy.
Is MFA required for EMR access under HIPAA?
The current Security Rule does not name MFA explicitly, though it is widely treated as a reasonable and appropriate safeguard. A proposed update to the rule would require it, but that proposal is not final. Many practices adopt MFA now because it addresses the most common cause of account compromise.