Two-Factor Authentication for Health Accounts: The 5-Minute Setup

A password alone is the weakest defence for a health account. Data breaches of large services regularly expose password lists; SIM-swap attacks intercept SMS codes; phishing captures credentials. Two-factor authentication (2FA) adds a second verification step that makes a stolen password much harder to exploit. The setup takes 5 minutes per account and prevents the specific attacks that account-takeovers use.

The types of 2FA, worst to best

• Method: SMS code · How it works: One-time code sent to phone · Security: Weak — SIM swap attack risk
• Method: Email code · How it works: One-time code emailed · Security: Moderate — only as safe as email itself
• Method: Authenticator app (TOTP) · How it works: Rotating 6-digit code from app · Security: Strong — offline generation
• Method: Push notification · How it works: Approve on trusted device · Security: Strong — device possession required
• Method: Hardware key (YubiKey) · How it works: Physical device tap · Security: Very strong
• Method: Passkeys (biometric) · How it works: Fingerprint / face + device · Security: Very strong — no password at all

Why SMS is weaker than most people think

• SIM swap: attacker convinces telco to reassign number to their SIM.
• SS7 interception: sophisticated attackers can intercept SMS in transit.
• Phishing: fake login pages that also collect the SMS code.
• Reused across services means one number compromise affects many accounts.
• Losing phone means recovery via number often not possible.

The specific setup — authenticator app

• Install Google Authenticator, Microsoft Authenticator, or Authy on your phone.
• In each health account's security settings, choose 'Enable 2FA' → 'Authenticator app'.
• Scan the QR code with the authenticator app.
• App now shows a 6-digit code that rotates every 30 seconds.
• Enter current code to confirm setup.
• Save the backup codes provided — you'll need these if you lose the phone.
• Do this for every health-related account: your record app, insurance portal, hospital portals, pharmacy accounts.

What to do with the backup codes

• Print them and store in a safe place at home.
• OR save in a password manager under 'Recovery codes'.
• Never store on the phone you use for the authenticator — losing phone = losing both.
• Never text them to yourself.
• Regenerate them periodically if your storage feels insecure.

Passkeys — the modern alternative

• Newer standard replacing passwords entirely.
• Uses your device's biometric (fingerprint, face).
• Nothing to phish — no code changes hands.
• Supported by increasing number of services.
• Simpler for users than authenticator app once set up.
• Set up on multiple devices for redundancy.

The specific accounts to secure first

• Email — it's often the recovery mechanism for everything else.
• Password manager if you use one.
• Health record app.
• Insurance portal.
• Bank and financial accounts.
• Hospital patient portals.
• Any account with medical data.

Common concerns and reality

• 'It's inconvenient' — 3 extra seconds per login is manageable.
• 'I might lose my phone' — that's what backup codes are for.
• 'I'll forget how it works' — use it a few times and it becomes automatic.
• 'My accounts aren't important' — health data is valuable to attackers for identity theft.
• 'It's too technical' — modern setup flows are wizard-style, no technical knowledge needed.

What to do if your phone is lost / stolen with authenticator on it

• Change your password on each affected account (using recovery methods).
• Use backup codes to log in and remove old 2FA.
• Set up 2FA fresh on new phone.
• If you had passkeys: remove the lost device's key and add new one.
• Report phone as lost to telco (they can suspend service).
• For any critical account without backup access: contact support with identity verification.

The specific family consideration

• Elderly parents often can't easily use authenticator apps.
• Solution: help them set up on their phone with clear written instructions.
• Or use SMS 2FA as second best (still better than password alone).
• Or handle their health accounts yourself as authorised proxy.
• Have a plan for their accounts if they become incapacitated.

What to record

• Which accounts have 2FA enabled.
• Location of backup codes.
• Recovery email/phone for each account.
• Any accounts still password-only (address these).

2FA is the specific security intervention with the strongest evidence for preventing account takeovers. Cost: 5 minutes and a bit of adjustment. Benefit: your health accounts become much harder for anyone to break into, even if they steal your password.

References

• NIST — authentication guidelines
• OWASP — authentication cheat sheet
• MeitY — Indian cybersecurity guidance