"Two-step verification: setting it up, and what happens if you lose your phone"

Two-step verification means signing in needs your password and a six-digit code from an app on your phone. Your clinic holds your patients' medical records. Anyone who gets hold of your password can get into them; with two-step verification they would need your phone as well.

What you need

Your phone and a free authenticator app. Google Authenticator, Microsoft Authenticator, 1Password and Authy all work. If you already use one for your bank or your email, use that.

Setting it up (about two minutes)

1. Select your name at the bottom of the menu, then My account. You can name the device if you like, then press Set up two-step verification.
2. Open your authenticator app, add a new account and scan the code on the screen. The app shows a six-digit code that changes every 30 seconds. Type in the current one.
3. Save your ten recovery codes. Download them and keep them somewhere that is not your phone, like a password manager or printed in the office. You will not see them again, and setup does not finish until you have said you have saved them.

If you are an owner setting up a new clinic, you will also see a Protect your account card during setup. Set it up now does the same thing without leaving setup, and Do this later hides it.

Signing in from now on

Your password as normal, then the six-digit code from your app. If you sign in with an email link instead, that still works; it will just ask for your code as well.

If you lose your phone

Sign in with your password, choose Use a recovery code and type in one of your ten codes. Each code works once. It takes the old phone off your account so you can set up the new one, and signs you out everywhere else to be safe.

Running low? My account shows how many codes you have left, and Make new recovery codes gives you a fresh set. The old ones stop working straight away.

If you have lost your phone and your recovery codes

Get in touch using Contact support in the menu. We will check it is you, then reset it so you can set it up again.

Getting a new phone

Easiest while you still have the old one. Go to My account, under Turn off two-step verification enter a code from the old phone and press Turn off, then set it up again on the new one.

Your team

Anyone at your clinic can switch it on for their own account, and it is worth suggesting to everyone who can see patient records. Owners need it to change who can see the clinical record: turning the Clinical record switch on or off for a team member asks for your code, and takes you to set it up first if you have not.

Your patients

Nothing changes for them.

"My code is not working"

Check your phone's clock is set automatically. The codes depend on the time, and a phone that is a few minutes out gets them wrong.