Multi-factor authentication

Mira EMR supports confirming a user's identity with more than one element, using industry-recognized standards (45 CFR 170.315(d)(13)). Multi-factor authentication is used in the two staff cases below. Patient portal sign-in is described separately at the end; it is not multi-factor authentication.

Staff signing in to Mira EMR

Clinical and administrative staff sign in with their email address and password. When the practice's two-factor policy applies to them, they then confirm one of these:

• a six-digit code from an authenticator app (time-based one-time password, RFC 6238)
• a six-digit code sent to their mobile phone by text message
• a six-digit code sent to their email address

Each practice's administrator sets the policy:

• Who is asked: everyone; only sign-ins from outside the practice's own networks; or only staff with administration, billing or records-exchange administration access.
• Which methods are allowed: any of the three above, at least one.
• How often: at every sign-in, or again after a set number of hours (at most 30 days).
• Remembered devices: how long a device that has confirmed a code may skip the code, from not at all up to 90 days.

Two-factor sign-in is off until the practice's administrator turns it on.

Confirming again before security changes

Before a staff member adds an authenticator app or a text-message number, removes a sign-in method, or forgets a remembered device, and before an administrator turns two-factor sign-in off for the practice, Mira asks for a code confirmed during the same sign-in within the previous ten minutes.

Patient portal sign-in (not multi-factor authentication)

Patients and their representatives sign in to the patient portal with a one-time sign-in link and identity matching. This is not multi-factor authentication: the link is the only authentication element, and the details typed after it are a check that the person matches the patient's record.

1. The person asks for a sign-in link, which Mira sends to the email address or mobile number the practice has registered for their portal access. Each link works once.
2. After opening the link, and before any chart opens, the person types the patient's date of birth, and for a link that arrived by text message, the patient's last name as well. Five wrong answers end that link, and repeated failures add a wait of up to an hour.
3. At that step the person may ask Mira to remember the device. For 30 days, a new sign-in link opened on that device skips the date-of-birth step.

Questions

Write to support@mirahealth.care.