Password defaults
The Password defaults allow practices to set a higher level of system security for tighter information control or to meet regulatory compliance requirements. With the enhanced password security settings, you can add a new level of security to your Cornerstone practice management system by managing password strength and duration requirements.
Before you start
- Security
- Defaults – Practice
- Change Passwords
Important!
- Do NOT change passwords to meet enhanced password criteria until AFTER you have selected Use Enhanced Passwords.
- Once Enhanced Passwords is turned on, users should log in with their password, ensuring they use ALL capital letters for the password. They will be prompted to change their password to meet the criteria set for enhanced passwords.
- See Additional information for more details on enhanced passwords.
Set up password defaults
Navigate to Controls > Defaults > Practice and Workstation > Password.
- Select Use Enhanced Passwords to set password strength and duration requirements. When this option is selected, each password must contain a combination of three of the following:
- Uppercase letter
- Lowercase letter
- Number
- Special character (e.g., !@#$% or space)
- Specify the enhanced password requirements within your practice using the following settings:
- Minimum password length: Password must be at or more than the specified minimum character length to be valid. Passwords of less than 3 characters or more than 30 characters are not permitted.
- Password history: Password cannot be the same as the last __ passwords used.
- Minimum password age: Password must be __ days old before it can be changed.
- Maximum password age: Password must be changed every __ of days.
- Click Apply to save your changes and continue setting defaults or click OK to save your changes and close the window.
Additional information
General
- If enhanced passwords are not turned on, Cornerstone passwords are not case-sensitive, but they are stored in Cornerstone in uppercase.
- Change passwords security is for only the logged in user to change their own password.
- Password rules are based on the use of enhanced passwords.
- Users will receive applicable notice when entering/changing a password that does not meet the specified criteria set in the defaults.
Example: Maximum password age reached, password reused within designated history, etc.
