Sessions and two-step sign-in

Choose an available protection method for your login and review active devices. A clinic’s policy is separate from your personal MFA setting.

Sign-in method

In Security, configure an authenticator app, verified email or SMS to a verified phone when available. For an app, scan the QR, confirm its current code and save recovery codes. Choosing a primary method does not combine protection across linked accounts.

Devices and sensitive actions

Revoke an unfamiliar session or all other sessions. Important changes require recent identity confirmation. Never send a password, sign-in code or recovery code to support.

Organization policy

An authorized owner manages MFA requirements for administrators or all members. A stricter policy requires affected members to be ready. Access and role review cannot remove the last owner.