Two-factor authentication (2FA) adds an extra layer of security to your SimplePractice account by requiring both your password and a unique verification code when you sign in. This helps prevent unauthorized access and protects your and your clients’ information.
After enabling 2FA, you can also create a passkey to sign in using your fingerprint, face, device PIN, or password manager instead of entering your password and a verification code.
In this guide, we’ll cover:
- Setting up two-factor authentication
- Using text message
- Using an authenticator app
- Creating a passkey
- FAQs
Note: For more information on troubleshooting common setup, sign-in, and recovery issues, see Troubleshooting two-factor authentication.
Setting up two-factor authentication
When enabled, two-factor authentication adds an extra layer of security to your account by requiring a second form of verification when you sign in. You can choose to receive a verification code by text message or use an authenticator app.
Authenticator apps can generate verification codes without cell service. Depending on the app, you may be able to use it on a phone, tablet, or computer.
Important: Once you enable two-factor authentication, you won’t be able to turn it off.
To enable two-factor authentication for your account:
- Navigate to Settings > Profile > Profile and security
- Next to SimplePractice security, click Manage
- Next to Two-factor authentication, click Set up
- Enter your password
- Choose how you want to receive your verification code:
Tip: To exit the setup process, click X in the top right corner.
Need help? If you’re having trouble setting up or using two-factor authentication, see Troubleshooting two-factor authentication.
Using text message
Note: The phone number you use for two-factor authentication is only used to send verification codes. It isn't visible to clients or used for client communications.
Follow the steps below to complete two-factor authentication setup using text message:
- If needed, click Edit to update your phone number
- Click Next to receive a text message with your verification code
- You’ll receive a confirmation text when you opt in to text message verification (message and data rates may apply)
- Enter your verification code
- If you didn’t receive a code, click Resend code
- Click Complete setup
Important: Verification codes expire after 3 minutes or if a new code is requested.
Using an authenticator app
Follow the steps below to complete two-factor authentication setup using an authenticator app:
- Download an authenticator app on your device
- Google Authenticator, Duo, Authy, Zoho OneAuth, and 1Password are commonly used options
- Open the app and scan the QR code displayed in SimplePractice
- Follow the prompts in the app to add your SimplePractice account
- For detailed instructions, see:
- Zoho OneAuth: Add 2FA accounts to OneAuth
- 1Password: Use 1Password as an authenticator for sites with two-factor authentication
- Google Authenticator: Get verification codes with Google Authenticator
- Duo: Third-Party Account Setup
- Authy: Add a New Two Factor Authentication (2FA) Account Token in the Authy App
- For detailed instructions, see:
- Click Next
- Enter the code from your authenticator app
- Click Complete setup
Creating a passkey
Note: Passkeys are being released in phases. If you don't see the option to add a passkey yet, it isn’t available for your account.
After enabling two-factor authentication, you can create a passkey for faster and easier sign-ins. A passkey lets you sign in using your fingerprint, face, device PIN, or password manager instead of entering your password and a verification code.
To create a passkey:
- Navigate to Settings > Profile > Profile and security
- Next to SimplePractice security, click Manage
- Next to Passkey, click Add passkey
For detailed setup and sign-in instructions, see Using a passkey to sign in.
FAQs
- Is two-factor authentication required?
- Will I need to enter a verification code every time I sign in?
- I don't have access to a mobile phone. Can I still use two-factor authentication?
- I have a biller or virtual assistant. Can they use my SimplePractice login?
- How can someone access my account if I'm unavailable?
- Why can’t I turn off two-factor authentication?
Is two-factor authentication required?
We encourage all customers to enable two-factor authentication to help protect their account and client information. Enabling two-factor authentication strengthens your account security and helps your practice stay ahead of evolving healthcare security best practices. We’ll communicate any changes to two-factor authentication requirements in advance.
To learn more about the importance of two-factor authentication, see Why therapists should care about two-step verification.
Will I need to enter a verification code every time I sign in?
No. After signing in with two-factor authentication, you can select Remember this device for 30 days.
You won't need to enter another verification code when signing in from the same device and browser during the 30-day period.
You may be asked to verify again if you clear your browser data, use a different browser, or change certain browser settings.
Note: For security, only select Remember this device for 30 days on a personal device that you don't share with others.
I don't have access to a mobile phone. Can I still use two-factor authentication?
Yes. You can still use two-factor authentication without a mobile phone.
If you only have a landline or work in an environment where mobile phones aren't permitted, you can set up an authenticator app on another supported device, such as your computer.
Some authenticator apps, like Zoho OneAuth and 1Password, support desktop-based authentication, which lets you generate verification codes without using a mobile phone.
I have a biller or virtual assistant. Can they use my SimplePractice login?
Each person who needs access to your practice should be added as a team member and use their own login credentials. They can enable two-factor authentication for that login.
Sharing account login credentials results in an inaccurate HIPAA Audit Log, violates Section 6 of our Terms of Service, and puts the security of client data at risk.
An Account Owner or practice manager can add a biller or virtual assistant as a team member and assign the appropriate role and permissions. On the Plus plan, the practice biller and practice scheduler team member roles can be added at no additional cost.
This lets each person securely access the information they need while helping keep your account secure. To learn more, see Adding and managing team members.
How can someone access my account if I'm unavailable?
If someone needs to access your account because you’re unavailable, they should contact our Support team. We'll work with the individual to verify their identity, review any required documentation, and follow our account transfer and access procedures.
If you're planning for an extended leave, retirement, or unexpected incapacity, we recommend creating a continuity plan for your practice, such as a professional will. To learn more about managing and sharing important practice documents in your account, see Managing business files.
Why can’t I turn off two-factor authentication?
Once two-factor authentication is enabled, it can't be turned off. Keeping two-factor authentication enabled helps protect your account and client information from unauthorized access.
If you’re having trouble signing in or accessing your verification method, see Troubleshooting two-factor authentication.