Resource Center

Multi-Factor Authentication

Home > EHR User Guide > Security Management > Multi-Factor Authentication

Configure MFA

Multi-Factor Authentication (MFA) adds an extra layer of security to the authentication procedure. It requires more than one form of identification and prevents unauthorized access to sensitive information.

Enabling MFA for your Charm account is highly recommended as it increases the security of Patient data and prevents unauthorized access. Here are a few reasons why EHR users should enable MFA:

  1. Enhanced security and protection against data breaches: MFA makes it difficult for unauthorized users to access sensitive Patient data.
  2. Compliance: HIPAA compliance mandates security measures to ensure the confidentiality, integrity, and availability of PHI.
  3. Patient trust: Maintain Patient trust and confidence in the healthcare systems to keep their personal information confidential and secure.

Enable MFA

The Practice Admin can make MFA sign-in mandatory for all the Practice Members using the steps below:

  1. Go to the 'Settings > Security > Policies' section.
  2. Enable the toggle button under Two-Factor Authentication (TFA) for Practice Members.
  3. Click on the 'Save' button
    Two-Factor Authentication for Practice Members

Note: Click on this link to view CharmHealth's Security and Password Policy.

MFA for Selective Members

The Practice Admin can enable or disable TFA for selective members from the 'Settings > Facility > Facility Members' section.

  • Click on the 'More Options' icon alongside the member profile.
  • Choose the 'TFA Preference' option
    Member TFA Preferences
  • Enable the TFA toggle and enter the Practice Admin account password.
  • Click on the 'Save' button.

Configure MFA Method

Once enabled, Practice Members can set up one of the second-level authentication methods listed below for their account.

Authenticator Apps

OTP authenticator apps are highly secure, free, accessible in low network areas, and have backup codes for seamless login. Charm supports Zoho and Google authenticator apps.

  1. Go to the 'Settings > Account > Two-Factor Authentication' section. The system will redirect you to the MFA setup page.
    Two-Factor Authentication Option
    Multi-Factor Authentication
  2. Click on the 'Set Up Now' link available under the OTP Authenticator section.
  3. Scan the QR code or manually enter the alpha-numeric code in any authenticator app.
  4. Click on the 'Next' button
  5. Enter the OTP displayed in your authenticator app and 'Verify'.

Once enabled, the Charm system will prompt you to enter the OTP displayed on your Authenticator app when you log in with your email address and password.

Note: If you are offline during a login, choose the 'Sign-in another way' option in the authenticator app to view offline OTP or enable QR scan-in.

Hardware Tokens

To set up a security key authentication, you will require:

  • The latest version of Google Chrome or Opera browser. If you're using Mozilla Firefox, enable U2F support.
  • A U2F-enabled Hardware Token.
  1. Go to the 'Settings > Account > Two-Factor Authentication' section. The system will redirect you to the MFA setup page.
  2. Select the 'Set Up Now' link available under the Security Key section.
  3. Click on the 'Next' button and verify yourself
  4. Insert your Hardware Token into your computer's USB port and click 'Next'
  5. Wait for the Token to blink. Then, tap on the golden disc to name your Security Token.
  6. Click on the 'Configure' button.

Supported Devices: YubiKey NEO, YubiKey 4 Nano, YubiKey 4, YubiKey 4C, YubiKey 4C Nano, YubiKey NEO-n, YubiKey Edge, YubiKey Edge-n.

Once enabled, you can use your hardware token while logging into your CharmHealth EHR account.

SMS

  1. Go to the 'Settings > Account > Two-Factor Authentication' section. The system will redirect you to the MFA setup page.
  2. Select the 'Set Up Now' link available under the SMS-Based OTP section.
  3. Enter your 'Phone Number' and click 'Next'.
  4. Enter the SMS-based OTP received on your phone and 'Verify'.

Once enabled, you will receive your login OTP via SMS to the registered phone number. Provide a backup phone number to which we can send the verification code if your primary device becomes inaccessible.

Passkey

  1. Go to the 'Settings > Account > Two-Factor Authentication' section. The system will redirect you to the MFA setup page.
  2. Click on the 'Set Up Now' link available under the Passkey section.
  3. Enter a name for the passkey to identify it, then click 'Next'.
  4. Select 'A Different Device' in the prompt.
  5. Scan the QR code using your mobile device's camera.
  6. Your device will prompt you with a setup flow. Follow the instructions to generate a passkey.

If the login and passkey devices are in sync, verify using your device's screen lock in the prompt. If they are not synced, follow the steps below:

  1. Enable Bluetooth on the passkey device and your login device.
  2. Go to the Charm sign-in page
  3. Enter your username
  4. Select the 'Passkey from nearby device/A different device' option.
  5. Scan the QR code using your mobile device's camera.
  6. When prompted, verify using your device's screen lock.

Exostar Authentication

Note: This option is available only for prescribers who have completed the EPCS registration process. Before choosing this option, make sure you have completed the EPCS registration process and obtained Two-Factor authentication from Exostar.

  1. Go to the 'Settings > Account > Two-Factor Authentication' section. The system will redirect you to the MFA setup page.
  2. Click on the 'Set Up Now' link available under the Exostar Authentication section.
  3. Choose the mode of Exostar authentication option, either Hardware token or Software token (Authentication app).
  4. Enter the verification code
    - Software Token (OTP value displayed in the registered mobile's Authentication app)
    - Hardware Token (OTP value displayed in your Hardware token device)
    Exostar Authenticator
  5. Click on the 'Next' button.
  6. Enter the OTP and click on the 'Verify' button.

Once enabled, you can generate Hardware or Software OTPs based on your MFA configuration while logging in.

MFA Recovery Options

Charm MFA offers backup codes that enable users to access their accounts in situations where they cannot use MFA.
Manage Backup Verification Codes

You should generate and download a copy of the codes from the MFA setup page beforehand using the following steps:

  1. Go to the 'Settings > Account > Two-Factor Authentication' section.
  2. Click on the 'Generate Codes' button available under the 'MFA Recovery Options' section.
  3. Save the downloaded copy in a safe vault on your local device.

If you have your backup code with you, follow the steps below to log in:

  1. Go to the Charm login page
  2. Enter your username and password and click on the 'Sign in' button
  3. Choose the 'Can't access your device' link
    MFA Recovery Options
  4. Select the 'Backup Verification Code' option
  5. Enter the backup code and click on the 'Verify' button

If you are still unable to use TFA or reset your password, your Practice Admin can help you to reset the password or the TFA option using the steps below:

  1. Go to the 'Settings > Facility > Facility Members' section
  2. Click on the 'More Options' icon alongside the member name
    Reset Options
  3. Choose any one of the options based on Member requirement
    1. Reset Password - Enter and confirm the new password, the reason for reset, and 'Update'.
    2. Reset TFA - Enter the Practice Admin password and 'Save'. This enables the member to reconfigure MFA from the beginning.

If you are a Practice Admin and unable to log in using MFA, please contact support@charmhealth.com.