Skip to main content

Security Policies

Praxi provides configurable security policies to protect client data and meet Australian healthcare compliance requirements. Practice owners can enforce password strength, multi-factor authentication, session management, and access controls.

Password Requirements​

Configure practice-wide password rules at Settings > Security Policy:

SettingDefaultConfigurable
Minimum length12 charactersYes (8--32)
Uppercase requiredYesYes
Lowercase requiredYesYes
Digits requiredYesYes
Special charactersYesYes
Password historyLast 5 passwords blockedYes (0--24)
Maximum ageNo expiryYes (0--365 days)
Lockout threshold5 failed attemptsYes (3--10)
Lockout duration30 minutesYes
Changes to password requirements apply to new passwords only -- existing

passwords are not retroactively invalidated. :::

Multi-Factor Authentication (MFA)​

Enabling MFA​

MFA is optional by default. To change the enforcement level:

  1. Go to Settings > Security Policy (practice-wide MFA rules) or Settings > Security (your own MFA setup)
  2. Choose the enforcement level:
    • Optional -- Users can enable MFA themselves (default)
    • Required -- All users must set up MFA before accessing the system
  3. Optionally set a grace period (default: 7 days) to give existing users time to set up MFA after you switch to required
  4. Save

MFA Compliance Dashboard​

Practice owners can monitor MFA adoption across the team:

  1. Go to Settings > Security Policy (practice-wide MFA rules) or Settings > Security (your own MFA setup)
  2. View the MFA Compliance Dashboard showing:
    • Total users vs. users with MFA enabled
    • Users currently in their grace period
    • Non-compliant users requiring setup
    • Overall compliance percentage
  3. Click Send Reminder to notify individual users who have not yet set up MFA

Supported MFA Methods​

MethodRole
Passkey (device)Recommended
Passkey (synced)Recommended
Passkey (security key)Recommended
Authenticator app (TOTP)Fallback
Recovery codesLast resort, 10 codes

A passkey uses Face ID, Touch ID, Windows Hello, a device PIN or a hardware security key. Praxi always requires the device to verify the user, so a passkey counts as full MFA on its own and meets a Required policy. Passkeys are phishing-resistant: they only work on Praxi. A synced passkey lives in a password manager such as iCloud Keychain, Google Password Manager or 1Password.

An authenticator app gives a six-digit code from Google Authenticator, Authy or similar. Recovery codes (shown as backup codes on some screens) are issued when a user sets up their first method, whether that's a passkey or an authenticator app. Each works once.

Every setup and sign-in step runs inside Praxi. See Passkeys.

Method Safeguards​

  • Users confirm it's them before adding or removing a passkey or authenticator.
  • When MFA is Required, a user can't remove their last sign-in method.
  • Praxi emails the user when a passkey is added or removed, and when a recovery code is used.

Lost Devices and Resets​

If a user loses a device:

  1. They sign in with another passkey, their authenticator code or a recovery code
  2. They add a new passkey and remove the lost one

If they have no method left, a practice owner can reset the staff member's two-step sign-in. The reset signs them out everywhere, and they set it up again at their next sign-in. Resets are fully audit-logged. See Lost Passkey or Device.

A passkey is the recommended method. Encourage staff to add a passkey on

each device they use and to store their recovery codes safely. :::

Session Management​

Configure practice-wide session behaviour at Settings > Security Policy:

SettingDefaultDescription
Session timeout (idle)480 minutesUser is logged out after inactivity (configurable 15--1440 min)
Concurrent sessionsUnlimitedMaximum simultaneous sessions per user (1--10)
Remember deviceConfigurableDuration a trusted device is remembered for MFA (1--90 days)

Per-Role Session Timeouts​

Praxi supports configuring different session timeout durations for each role. Clinical roles default to shorter timeouts to protect PHI (Essential Eight compliance). The most restrictive timeout across all of a user's roles applies.

  1. Go to Settings > Security Policy
  2. Set timeout durations for each role (5--480 minutes)
  3. Save

Access Controls​

IP Allowlisting​

Restrict access to your practice's Praxi instance by IP address:

  1. Go to Settings > Security Policy
  2. Click Add IP Range
  3. Enter the IP address or CIDR range (up to 50 entries)
  4. Save

IP allowlisting is disabled by default. When enabled, login attempts from unlisted IP addresses are blocked.

Security Audit Log​

All security-related events are recorded in the audit trail:

  • Login attempts (successful and failed)
  • MFA enrolment and usage
  • Password changes
  • Session creation and termination
  • Security policy changes

View your security activity from Settings > Security (security dashboard).

Permissions​

ActionRequired Permission
Configure security policiesPractice owner
View security audit logPractice owner or practice manager
Enable own MFAAll authenticated users

Was this page helpful?