Two-factor authentication helps safeguard your account and your clients’ information. This guide covers common questions and issues related to using and managing two-factor authentication in SimplePractice.
Important: If you’re still unable to access your account after trying the troubleshooting steps below, please contact our Support team for assistance.
Below, you’ll find answers to:
Accessing your account
- What should I do if I lose access to the phone I've set up two-factor authentication with?
- Why am I seeing "Your code has expired" or "Session Expired" when signing in?
- Why am I asked for a verification code every time I sign in on my phone or tablet?
Receiving your verification code
- What do I do if I’m not receiving my verification text message?
- How do I opt back in to receive two-factor authentication text messages?
- What if I’m having trouble setting up or using my authentication app?
Team members
- Can I enable or disable two-factor authentication for my team members?
- How do I know if my team members are using two-factor authentication?
Third-party service provider access
Note: For setup instructions and frequently asked questions about two-factor authentication, see Protecting your account with two-factor authentication (2FA).
What should I do if I lose access to the phone I've set up two-factor authentication with?
If you no longer have access to the phone you use for two-factor authentication, select Send code by email on the verification screen. We’ll send a verification code to the email address associated with your SimplePractice account.
If you also can’t access your account email, please contact our Support team for assistance. We'll verify your identity and guide you through the appropriate account recovery process.
Why am I seeing "Your code has expired" or "Session Expired" when signing in?
Verification codes and sign-in sessions are valid for a limited time to help keep your account secure. You may see one of these messages if:
- It took too long to enter your verification code
- You entered a code that has already expired
- You requested a new code and entered an older one
- There were too many unsuccessful verification attempts
If this happens, return to the sign-in page and try again. Be sure to use the most recently received verification code and enter it as soon as possible after receiving it.
If you're still unable to sign in, contact our Support team for assistance.
Why am I asked for a verification code every time I sign in on my phone or tablet?
If you manually sign out and use your password to sign back in, you’ll need to enter a new two-factor authentication code every time.
For faster mobile sign-ins, create a passkey through SimplePractice in a web browser. Once the passkey is available on your mobile device, you can select Sign in with passkey in either the mobile browser or SimplePractice for Clinicians mobile app on iOS and Android. A successful passkey sign-in doesn’t require your SimplePractice password or a two-factor authentication code.
To learn more, see Using a passkey to sign in.
What do I do if I’m not receiving my verification text message?
If you aren’t receiving your verification code by text message, you can have it sent by email instead:
- On the verification screen, select Send code by email
- Check the email address associated with your SimplePractice account for your verification code
- If you don't see the email, check your Spam or Junk folder
If you previously replied STOP to a 2FA text message, see How do I opt back in to two-factor authentication text messages?
If you’re still unable to sign in, contact our Support team for assistance.
How do I opt back in to receive two-factor authentication text messages?
If you opted out of receiving two-factor authentication text messages by replying STOP, you can opt back in by sending a new text message to 514913 with one of the following:
- START
- UNSTOP
- JOIN
You’ll receive a text message confirming that you’ve opted back in.
For some phone carriers, it may take up to 30 days for text messages to resume. During this time, you can continue using two-factor authentication by receiving verification codes through an authenticator app or by email.
Important: Opting in or out of text messages only affects whether you can receive 2FA codes by text. It doesn't enable or disable two-factor authentication.
What if I’m having trouble setting up or using my authentication app?
SimplePractice can’t provide direct support for third-party authentication apps. If you're having trouble, contact the support team for the app you’re using.
For help setting up your authentication app, refer to the following resources:
- Google Authenticator: Get verification codes with Google Authenticator
- Duo: Third-Party Account Setup
- Authy: Add a New Two Factor Authentication (2FA) Account Token in the Authy App
- Zoho OneAuth: Add 2FA accounts to OneAuth
- 1Password: Use 1Password as an authenticator for sites with two-factor authentication
For steps to set up an authenticator app with your SimplePractice account, see Using an authenticator app.
Can I enable or disable two-factor authentication for my team members?
You can’t enable or disable two-factor authentication on behalf of a team member. Each team member manages two-factor authentication settings for their own login.
How do I know if my team members are using two-factor authentication?
To view each team member’s two-factor authentication status:
- Navigate to Settings > Team > Team members
- Under 2-step verification, confirm whether the setting is On or Off for each team member
Can two-factor authentication impact third-party services?
As part of SimplePractice’s ongoing commitment to account security, we're gradually requiring mandatory two-factor authentication (2FA) requirements for customers. These requirements are a core part of our security standards to protect your data and may eventually be required for HIPAA compliance.
Potential impact on third-party service provider access
We recognize that some customers may rely on third-party service providers to support workflows involving their accounts. We also recognize that our mandatory 2FA requirements may impact certain third-party service providers’ ability to access customer accounts, potentially affecting related services or workflows.
For example, if you’ve shared your SimplePractice login credentials with a third-party service provider, enabling 2FA may prevent that service from signing in to your account. You may also receive verification codes you didn't request if the service provider attempts to access your account.
We want to make sure customers understand the potential impact, know where to turn for assistance, and understand their responsibilities under our Terms of Service and any applicable privacy and healthcare requirements when evaluating potential solutions.
Note: To learn where to get help if two-factor authentication affects a third-party service you use, see Third-party access limitations.
Third-party access limitations
We understand there are many tools available to you to help manage your practice. SimplePractice doesn't support third-party connections that require sharing your SimplePractice login credentials. While our Support team can provide guidance on the functionality of the SimplePractice platform, we can't advise on or troubleshoot third-party connections set up outside of SimplePractice. If enabling 2FA impacts one of these connections, please contact the third-party service provider directly regarding its compatibility with our 2FA requirements.
Please note that any approach to third-party account access must comply with our Terms of Service. We are not able to recommend workarounds that involve sharing your login credentials or bypassing our security requirements.
Important account security and compliance considerations
When evaluating options for third-party access, please keep the following considerations in mind:
SimplePractice’s Terms of Service
Section 6 of our Terms of Service prohibits users from sharing credentials and passwords, which may put your account and client information at risk. It states:
“You and each person using Your Account must have separate email addresses and passwords. Users may not share entry identifications and authentication passwords and any sharing may result in a suspension or termination of access for the User, and/or an increase in charges, at SimplePractice’s sole discretion.”
If you provide a third-party service with your direct credentials, you may be in violation of this restriction in our Terms of Service. Customers should review the applicable terms and ensure access arrangements comply with them.
Third-Party Access and Privacy Considerations
When using third-party services, we encourage you to review what information the service may access or use in your account, including whether your calendar or scheduling information contains protected health information (PHI). You're responsible for assessing and meeting your obligations under HIPAA, including determining whether a Business Associate Agreement (BAA) is required and obtaining one where necessary. You should also consider whether the service’s access permissions and information handling practices are consistent with your privacy and security responsibilities.