Connect

Password Policy Update Coming Nov. 9

Keeping UVA Health’s systems, data, and patients safe is a responsibility shared by all team members.

Beginning Nov. 9, Health Information Technology (HIT) will update UVA Health’s password policy. The change eliminates the requirement to update your UVA Health account password every 60 days and introduces a modern standard that supports longer, more secure passphrases. This approach improves both security and the team member experience.

Passphrases are more secure and easier to remember than traditional passwords. The minimum passphrase length for UVA Health accounts will increase to 15 characters. The update will not affect your account immediately. Instead, it will take effect the next time you are prompted to change your password on or after Nov. 9.

This update follows guidance from the National Institute of Standards and Technology (NIST) and supports UVA Health’s goals of maintaining strong cybersecurity and improving the user experience.

To learn more, read the FAQs below.

FAQs

Will I still have to change my password every 60 days?

No. Once you create a password that meets the new 15-character minimum requirement, you will no longer be required to reset your password every 60 days. Password changes will only be required if an account is compromised or when otherwise directed by HIT.

Once I set my passphrase after Nov. 9, will I be able to change it?

Yes. Once you set a new passphrase, you will be able to change it. If you would like to change your UVA Health account passphrase, press Control + Alt + Delete on your UVA Health workstation or contact the HIT Help Desk for support at 434.924.5334.

Does this change affect all UVA Health systems?

The new policy applies to UVA Health network accounts. You should continue to follow any additional password requirements specific to systems or applications you use.

What is a passphrase?

A passphrase is a longer password made up of multiple words, numbers, and special characters. Creating a passphrase with at least 15 characters is typically easier to remember and type than complex passwords, while also providing greater security. As always, avoid using personal information, such as your name, birthday, employee ID, or easily guessed words.

Why are longer passphrases considered more secure?

Longer passwords are generally more resistant to password-cracking techniques and unauthorized access attempts. Increasing password length is one of the most effective ways to strengthen account security.

Does a passphrase have complexity requirements, like special characters, numbers, or capital letters?

No. Passphrases do not have specific complexity rules, they just need to be secure. Microsoft Password Protection helps by blocking known compromised passwords, commonly used passwords, and passwords on custom block lists. This gives team members more flexibility to create longer, easier-to-remember passphrases without following traditional complexity requirements.

How does using a passphrase help protect patients and UVA Health?

Strong passwords are an important part of protecting systems, safeguarding sensitive information, and reducing the risk of unauthorized access. By using longer passphrases and following cybersecurity best practices, team members help protect UVA Health data and support safe patient care.

What happens if my current password is fewer than 15 characters?

You can continue using your current password until your next required password change. When you update your password after Nov. 9, 2026, your new passphrase must meet the 15-character minimum requirement.

Will my current password still work if it is already 15 characters or longer?

If your current password already meets the new 15-character minimum requirement, you will still be prompted to change your password at their next scheduled password change. After that update, routine password expiration will no longer be required unless your account is compromised or a password reset is otherwise directed by HIT.

Who can I contact if I need help?

If you have questions or need support:

• Contact the HIT Service Desk at 434.924.5334
• Submit a request through ServiceNow