Keeping your portal account secure
How sign-in links protect your account, and how to see and sign out the devices that use your portal.
Overview
The patient portal has no password. You sign in with a single-use link that we email to the address on your clinic record. Only a person who can open your email can use it. There is no two-step code or authenticator app to set up. To keep your portal safe, protect your email account, sign out on shared devices, and check your active sessions.
Prerequisites
- You are signed in to the portal.
Steps
Keep your email secure. Sign-in links go to your email, so anyone who can read your email can sign in. Use a strong password for your email account.
Never share a sign-in link. Each link works one time only and expires after 15 minutes. If you get a sign-in email you did not ask for, you can ignore it. No one can sign in without the link.
Open the Security tab. Click Profile in the menu, then click the Security tab. Sign-in Method explains how you sign in.
Check Active Sessions. This list shows each device that is signed in to your portal, with its IP address and when it was last active.
Revoke a device you do not know. Click Revoke next to it. That device is signed out.
Sign out on shared devices. Click Sign out at the top of the page. On a phone, open the menu first. A device that you do not sign out stays signed in for up to 30 days.
Expected outcome
- Only the devices you trust stay signed in to your portal.
Troubleshooting
| Problem | Likely cause | What to do |
|---|---|---|
| You cannot find a "Set up 2FA" or "Change password" option | The portal does not use passwords or two-step codes | No action is needed. Your sign-in link is the security step |
| You see a device you do not know | Someone else may have opened a sign-in link | Click Revoke, secure your email account, and tell your clinic |
| Your email account was hacked | Sign-in links go to that email | Contact your clinic so they can change the email on your record |
| You got a sign-in email you did not ask for | Someone entered your details | Ignore it. The link expires after 15 minutes |