Coming soon: New password management policy

This message is sent on behalf of William Bornstein, MD, PhD, CMO & CQO, EHC; Dee Cantrell, CIO, EHC; and Marc Overcash, Interim Enterprise CIO and Senior Vice Provost for Library Services and Digital Scholarship, Emory University

Dear Team EHC,

Emory University and Emory Healthcare are implementing a new password policy that requires changing passwords at least every 365 days and complying with a more rigorous standard for password creation.

Key Messages

• Emory University is going live with this policy Wednesday, September 9. Emory Healthcare will go live with this policy shortly after; the technical teams involved are finalizing the date.
• Emory Healthcare already requires passwords be changed every 180 days for most users and has a password creation policy. This current policy (outlined in the “More Information” section below) will remain in effect until the new one goes live.
• If you maintain a login/password at BOTH Emory University and Emory Healthcare (e.g., TEC faculty physicians or EHC employees who are students at Emory University), during the time between go-live dates, your Emory University password will need to comply with the new policy, while your EHC password will need to comply with the current policy.
• See below for details on the new policy, how to change your password, the current policy for reference and why password management is important.

More information: New policy for Emory University and Emory Healthcare
You will be prompted to change your password at least every 365 days. Password requirements:

• Must be between 9 and 30 characters in length.
• Must contain at least two alphabetic characters (A-Z, a-z) and at least two non-alphabetic characters (spaces, numbers, punctuation and/or special characters).
• Your login ID cannot be part of the password.
• No more than two consecutive characters can be identical.
• The password cannot match any of the previous 24 passwords used with the account.
• Never use your Emory login and password for non-Emory sites.
• Never give your password to anyone, not even someone claiming to be an Emory IS staff member – not even if they ask. (Emory IS will never ask for your password.)

How to change your password
Emory University: Follow the steps on the Emory University password change page or call the university IT support line at 404-727-7777 for help.

Emory Healthcare: Click on the Password Reset Tool on the Virtual Desktop login screen (see screen shot). The link to this tool is also located under Applications in the Quick Links section on the home page of the intranet – www.ourehc.org (see screen shot). Or, call 8-HELP.

 

Current Emory Healthcare policy for reference
Most users are required to change their EHC password every 180 days and are prompted to do so at that time. Some older accounts do not have this requirement in place. Current EHC password requirements are:

• Have 8 characters
• Have 1 or more letters
• Have 1 or more numeric characters
• Have 1 or more capital letters
• Do not contain special characters (EHC uses a single sign-on for all systems requiring passwords and some of our systems have historically not accepted special characters)

This policy will be retired when the new policy goes into effect.

Why is smart password management important?
Information security is important to all of us, and we can’t secure our information unless all of us work together to protect it. Together, we must protect information related to patients, staff, research and finances. Password management is an important action we can all take to protect sensitive information.

Related Links
• Emory University Department of Medicine
• Emory University School of Medicine
• Emory University password change page
• Our EHC