Turn on two-step verification

Two-step verification asks for a 6-digit code from an app on your phone each time you sign in. Someone who learns your password still can't get into your health record without it.

Steps

1. Open the menu, choose the gear icon (Settings), then next to Security choose Manage. You can also go straight to Security.
2. Under Two-step verification, choose Turn on two-step verification.
3. If you don't have one yet, install an authenticator app on your phone. Any app that makes 6-digit codes works, such as Microsoft Authenticator, Google Authenticator, 1Password or your phone's built-in password manager.
4. In the app, scan the QR code on the page. If you can't scan it, type the key shown under it into the app instead.
5. Enter the code the app shows in Code from your app, then choose Verify and turn on.
6. Save your 10 recovery codes. Choose Download as a file or Print, then choose I've saved them.

Good to know

• Recovery codes are shown only once. Each one lets you in once if you don't have your phone, so keep them somewhere safe and separate from it.
• Next time you log in, you'll be asked for a code. On a device you trust, tick Don't ask again on this device for 14 days.
• If the code doesn't match, check that your phone sets its time automatically, then try the code showing now. Codes change every 30 seconds.
• Your Security page shows how many recovery codes you have left.