Does your practice website need multi-factor authentication?

What could go wrong without it

Your website is often the first place patients look for your phone number, your opening hours and what to do when you’re closed. Your practice is responsible for what it says. With one stolen or guessed password, someone could:

• change your phone number to a premium-rate or scam number;
• post a false closure notice, sending patients elsewhere;
• add a link asking patients to “pay for prescriptions” or “update your NHS details” on a fake page;
• remove urgent help information, or change what your pages say about medicines or services.

Passwords leak in ordinary ways: reused on another site that gets breached, typed into a convincing phishing email, written on a note by the reception computer, or still known by someone who has left. The National Cyber Security Centre recommends MFA on any online service that matters to your organisation, because it stops most of these.

What MFA is

MFA means proving it’s you in two ways: something you know (your password) and something you have (your phone). After the password, the website asks for a six-digit code from an authenticator app, which changes every 30 seconds. Someone with only your password can’t get in.

NHSmail has required MFA for all users since 2025, and many practice staff use the Microsoft Authenticator app for it. The same app works for any website that offers app-based MFA, so your team won’t need anything new.

What to ask your supplier

1. Does signing in to our website need a code as well as a password? If not, when will it?
2. Is it required for everyone, or optional? Optional MFA tends to mean the one account without it is the one that gets used.
3. Does it work with an authenticator app? Apps are safer than text message codes.
4. What happens if someone loses their phone? Look for a reset that checks with the practice first, so an attacker can’t just ask for one.
5. Can we see who signed in and what they changed? An audit log lets you spot and undo anything odd.

If your supplier doesn’t offer it

Ask for a date, in writing. Until then, reduce the risk:

• Give each person their own login. Never share one.
• Use long, unique passwords, ideally from a password manager.
• Remove logins the day someone leaves, and check the list of users every few months.
• Keep the number of people who can change opening times and phone numbers small.
• Check your homepage, contact page and opening times every week.

If your supplier has no plans to add it, include that when you next review your contract. Our guide to choosing a GP website supplier has the other questions to ask.

How ours works

• Every practice admin sets up an authenticator app the first time they sign in. It isn’t optional.
• Any authenticator app works: Microsoft Authenticator, Google Authenticator, 1Password and others.
• Setting up takes a minute: scan a QR code, or tap a link if you’re on your phone, then enter the code.
• If someone loses or changes their phone, we reset their authenticator only after the practice manager has confirmed it’s them. The reset signs them out everywhere and is recorded in the practice’s audit log.