Account & security · 4 min read · Beginner

Turn on two-factor authentication

Two-factor auth adds a second check at sign-in, so a stolen password alone can't reach your patients' information. Here's how to switch it on in a few minutes, save your backup codes, and require it for your whole team.

Updated Jul 9, 2026

Two-factor authentication (2FA) adds a second step when you sign in: after your password, you confirm it's really you with a code from your phone or a tap of your face. That means a stolen or guessed password isn't enough to get into your account on its own. Because your dashboard touches patient information, we strongly recommend every person on your team turns 2FA on — and that Admins require it for everyone.

Tip

The most common way accounts get broken into isn't clever hacking — it's a reused password that leaked somewhere else. Two-factor auth closes that door. It takes about three minutes to set up once.

Choose how you'll verify

Valian supports three second factors. You can start with one and add another later:

Authenticator app (recommended). A free app on your phone — Google Authenticator, 1Password, Authy, and others all work — shows a rotating 6-digit code. This is the most reliable option because it works even without a cell signal.
Text message (SMS). A code is texted to your phone number. Easy to set up, though a little less secure than an app.
Passkey or security key. Use Face ID, Touch ID, or a hardware key. The fastest option on a device you own.

Turn on two-factor auth

Open Settings → Two-factor authentication. You'll see your current status and the methods available.
Select Set up and pick a method. For an authenticator app, Valian shows a QR code.
Scan the QR code with your authenticator app (or add the text-message or passkey method if you chose one of those). Your app starts generating 6-digit codes.
Enter the current code from your app to confirm the link. This proves the pairing worked.
Save your backup codes. Valian gives you a set of one-time backup codes — store them somewhere safe, like a password manager. They get you in if you ever lose your phone.

Once it's on, your next sign-in asks for your password and then a code. That's it — you're protected.

Note

Save your backup codes before you close the setup screen. They're the safety net if your phone is lost, stolen, or replaced. Treat them like spare keys: keep them somewhere private, not on a sticky note at the front desk.

Require two-factor auth for your team

Owners and Admins can make 2FA mandatory for everyone on the account, so no one can sign in without it. Open Settings → Two-factor authentication and turn on the option to require two-factor auth for the team. Anyone who hasn't set it up yet is prompted to do so the next time they sign in — nothing breaks, they're just walked through it. For a practice handling patient information, requiring 2FA is one of the highest-value security settings you can flip.

You can see who already has 2FA on from Settings → Team & logins — each person's row shows their status at a glance.

If you lose your phone

Don't panic, and don't get locked out for good:

Use a backup code. At the code prompt, choose to enter a backup code instead, and use one of the codes you saved. Each works once.
Add your new phone. Once you're in, open Settings → Two-factor authentication, remove the old method, and set up the app or passkey again on your new device.
No backup codes? Ask an Owner or Admin at your practice to remove your 2FA so you can sign in and set it up fresh. If you're the only Owner and you're locked out, submit a ticket from the Help Center or email help@valiansystems.com and we'll verify your identity and help you back in.

Frequently asked questions

Do I have to use an authenticator app? No, but it's the most reliable. Text-message codes and passkeys both work. Pick whatever you'll actually keep handy.

Will I need a code every single time I sign in? You'll confirm your second factor at sign-in. On a device you use regularly, it's a quick tap or a short code — not a hurdle.

Can an Admin see my codes or my password? Never. Two-factor is personal to you. An Admin can require 2FA or remove your method if you're locked out, but no one can read your codes or your password.

What if a staff member leaves? Remove their login entirely from Settings → Team & logins — that's cleaner than just turning off their 2FA. See Add another user to your practice for the remove flow.

Is two-factor auth part of how Valian meets HIPAA? It's a big piece of it. Strong sign-in is one of the ways your practice's data stays protected. For the full picture, read How Valian protects your data.

Still need a hand?

Reach the Valian team any time at help@valiansystems.com, or open a ticket from the Help Center inside your dashboard. During onboarding, your onboarding contact is at onboarding@valiansystems.com.