Every week, I speak with home health administrators who have experienced credential theft and cannot understand how it happened. Their staff did not click obvious phishing emails. Their email security filtered most malicious messages. Their IT setup seemed reasonable. What they did not know — and what the post-incident forensic analysis revealed every time — was that staff were reusing the same passwords across work accounts and personal accounts on consumer websites. When one of those consumer websites was breached and the credentials appeared for sale on the dark web, the attacker tried them against the home health EHR. They worked.
Password reuse is not a failure of security awareness training. People understand they should not reuse passwords. They reuse them anyway because the human brain is not capable of generating and remembering dozens of unique, complex passwords. The solution is not more training — it is better tooling. The path from where most home health agencies are today to where they need to be runs through three stages: enforced password policy, password managers, and passkeys.
Stage 1: Enforced Password Policy — The Minimum
Before any of the more sophisticated solutions, every home health agency must enforce a basic password policy. The current guidance from NIST Special Publication 800-63B — which is the framework referenced in HIPAA compliance guidance — has shifted away from complexity requirements (mandatory special characters, mixed case, numbers) toward length requirements. Long passwords are more secure than complex short ones, and length requirements are easier for humans to satisfy with memorable phrases than complexity requirements. The current recommended minimum: 12 characters, with longer being better. No mandatory special characters. No mandatory rotation on a fixed schedule (which causes users to create predictable patterns like Password1!, Password2!, Password3!). Mandatory rotation only when a credential is known or suspected to be compromised.
Enforce this policy at the identity platform level — not just in a written policy document. Microsoft Entra ID and Google Workspace both allow administrators to set minimum password length and prohibit commonly used passwords. A policy that exists in a document but is not technically enforced is not a password policy. It is an aspiration.
Stage 2: Password Managers — The Practical Solution
A password manager is the single most effective tool for eliminating password reuse across both work and personal accounts. It generates unique, cryptographically strong passwords for every account, stores them in an encrypted vault, and fills them automatically at login so the user never needs to remember them. The user remembers one master password — which opens the vault — and the password manager handles everything else.
For home health agencies, the recommended password manager deployment model uses a business password manager — 1Password Business, Bitwarden for Business, or Dashlane Business — that provides centralised administration, allows the organisation to manage shared credentials (for shared systems where individual accounts are not possible), and provides visibility into staff password hygiene without revealing the actual passwords. Administrators can see whether each staff member has enabled the password manager for their work accounts, whether any stored passwords are reused or weak, and whether any stored credentials appear in known breach databases.