Articles in this section

Troubleshooting two-factor authentication

Navami
Updated

Two-factor authentication helps safeguard your account and your clients’ information. This guide covers common questions and issues related to using and managing two-factor authentication in SimplePractice.

Important: If you’re still unable to access your account after trying the troubleshooting steps below, please contact our Support team for assistance.

Below, you’ll find answers to:

Accessing your account

Receiving your verification code

Team members

Third-party service provider access

Note: For setup instructions and frequently asked questions about two-factor authentication, see Protecting your account with two-factor authentication (2FA).

What should I do if I lose access to the phone I've set up two-factor authentication with?

If you no longer have access to the phone you use for two-factor authentication, select Send code by email on the verification screen. We’ll send a verification code to the email address associated with your SimplePractice account.

If you also can’t access your account email, please contact our Support team for assistance. We'll verify your identity and guide you through the appropriate account recovery process.

Why am I seeing "Your code has expired" or "Session Expired" when signing in?

Verification codes and sign-in sessions are valid for a limited time to help keep your account secure. You may see one of these messages if:

  • It took too long to enter your verification code
  • You entered a code that has already expired
  • You requested a new code and entered an older one
  • There were too many unsuccessful verification attempts

If this happens, return to the sign-in page and try again. Be sure to use the most recently received verification code and enter it as soon as possible after receiving it.

If you're still unable to sign in, contact our Support team for assistance.

What do I do if I’m not receiving my verification text message?

If you aren’t receiving your verification code by text message, you can have it sent by email instead:

  1. On the verification screen, select Send code by email

Option to send a 2-step verification code by email

  1. Check the email address associated with your SimplePractice account for your verification code
    • If you don't see the email, check your Spam or Junk folder

If you’re still unable to sign in, contact our Support team for assistance.

Can I opt back in to receive text messages if I accidentally opted out?

If you opted out of receiving text messages by replying STOP, you can opt back in by replying to the same number with START, UNSTOP, or JOIN.

For some phone carriers, it may take up to 30 days for text messages to resume. During this time, you can continue using two-factor authentication by receiving verification codes through an authentication app or by email.

Disabling and re-enabling two-factor authentication in your SimplePractice account won’t override delays set by your phone carrier.

Important: Opting in or out of text messages doesn't enable or disable two-factor authentication. Likewise, disabling or re-enabling two-factor authentication will not opt you out of or back into receiving text messages.

What if I’m having trouble setting up or using my authentication app?

SimplePractice can’t provide direct support for third-party authentication apps. If you're having trouble, contact the support team for the app you’re using.

For help setting up your authentication app, refer to the following resources:

For steps to set up an authenticator app with your SimplePractice account, see Using an authenticator app.

Can I enable or disable two-factor authentication for my team members?

You can’t enable or disable two-factor authentication on behalf of a team member. Each team member manages two-factor authentication settings for their own login.

How do I know if my team members are using two-factor authentication?

To view each team member’s two-factor authentication status:

  • Navigate to Settings > Team > Team members
  • Under 2-step verification, confirm whether the setting is On or Off for each team member

Team members page showing 2-step verification status for each team member

Can two-factor authentication impact third-party services?

As part of SimplePractice’s ongoing commitment to account security, we're gradually requiring mandatory two-factor authentication (2FA) requirements for customers. These requirements are a core part of our security standards to protect your data and may eventually be required for HIPAA compliance. 

Potential impact on third-party service provider access

We recognize that some customers may rely on third-party service providers to support workflows involving their accounts. We also recognize that our mandatory 2FA requirements may impact certain third-party service providers’ ability to access customer accounts, potentially affecting related services or workflows. 

For example, if you’ve shared your SimplePractice login credentials with a third-party service provider, enabling 2FA may prevent that service from signing in to your account. You may also receive verification codes you didn't request if the service provider attempts to access your account.

We want to make sure customers understand the potential impact, know where to turn for assistance, and understand their responsibilities under our Terms of Service and any applicable privacy and healthcare requirements when evaluating potential solutions. 

Note: To learn where to get help if two-factor authentication affects a third-party service you use, see Third-party access limitations.

Third-party access limitations

We understand there are many tools available to you to help manage your practice. SimplePractice doesn't support third-party connections that require sharing your SimplePractice login credentials. While our Support team can provide guidance on the functionality of the SimplePractice platform, we can't advise on or troubleshoot third-party connections set up outside of SimplePractice. If enabling 2FA impacts one of these connections, please contact the third-party service provider directly regarding its compatibility with our 2FA requirements. 

Please note that any approach to third-party account access must comply with our Terms of Service. We are not able to recommend workarounds that involve sharing your login credentials or bypassing our security requirements.

Important account security and compliance considerations 

When evaluating options for third-party access, please keep the following considerations in mind: 

SimplePractice’s Terms of Service

Section 6 of our Terms of Service prohibits users from sharing credentials and passwords, which may put your account and client information at risk. It states:

“You and each person using Your Account must have separate email addresses and passwords. Users may not share entry identifications and authentication passwords and any sharing may result in a suspension or termination of access for the User, and/or an increase in charges, at SimplePractice’s sole discretion.”

If you provide a third-party service with your direct credentials, you may be in violation of this restriction in our Terms of Service. Customers should review the applicable terms and ensure access arrangements comply with them. 

Third-Party Access and Privacy Considerations

When using third-party services, we encourage you to review what information the service may access or use in your account, including whether your calendar or scheduling information contains protected health information (PHI). You're responsible for assessing and meeting your obligations under HIPAA, including determining whether a Business Associate Agreement (BAA) is required and obtaining one where necessary. You should also consider whether the service’s access permissions and information handling practices are consistent with your privacy and security responsibilities.

Related to