Why two-factor authentication (MFA) is now mandatory ?

To protect your clients' health information, Colib now requires two-factor authentication (MFA) for every user. Here is why, and why it matters even more if you practice in Quebec.

1What is MFA?

MFA adds a second step when you log in. After entering your password, you confirm your identity with a code sent by email or sms.

• Even if someone gets your password, they cannot access your account without that second step.
• You only need a few seconds per login.

2Why we made it mandatory

Passwords alone are no longer enough. They get reused, guessed, or stolen through phishing emails and data leaks on other websites.

• Health records are among the most targeted data online, because they are highly sensitive and valuable.
• A single compromised account can expose every client file, note and invoice it has access to.
• Making MFA mandatory protects every account on the platform, including your colleagues' and your clinic's.

3Why it matters especially in Quebec

Quebec has some of the strictest privacy rules in Canada for health information.

• Law 25 — requires organizations to take security measures that are reasonable given how sensitive the information is, and to report serious confidentiality incidents to the Commission d'accès à l'information (CAI).
• Law 5 (the Act respecting health and social services information) — in force since July 1, 2024, it adds specific rules for health information. It can apply to private practices, including people operating a private professional office. It requires reasonable security measures and the ability to identify who accessed health information, and when.

Good to know: these laws do not name a specific technology, but MFA is widely recognized as a basic, reasonable security measure for sensitive data. Using it helps you meet your obligations and shows you took the protection of your clients' information seriously. If you have questions about your own obligations, check with your professional order.

4What this means for you

• You will be asked for a verification code when you log in at each login.
• Keep your verification method up to date (phone number, email or app) so you are never locked out.

Important: each team member needs their own account. Never share a login: shared accounts make it impossible to know who accessed a file, which is exactly what Law 5 asks you to track.

5How to set it up

Follow the steps in How to configure the 2 factor authentication (2FA) ?. It takes about two minutes.

Still have a question?

If you have trouble logging in, submit a ticket and our team will help you.