← All updates
Two-factor authentication for staff and patients
The problem it solves
Practices with a two-factor requirement for every staff login couldn't move to Navigate. Clinics also wanted the same protection for patients, including those who log in with a phone number. And it was too easy to add a staff user with an outside email address to the wrong clinic.
What's included
- Staff 2FA by text or call. Required at login for practices that turn it on, with a setup flow for users without a phone on file.
- Patient MFA at the portal level. Require a second factor for every patient login, including phone-number logins.
- Location-aware admin access. Admin permissions respect location boundaries without stripping the admin role.
- Email domain check. Adding a staff user whose email doesn't match the clinic's approved domains shows a warning first.