Overview

Password fatigue is a silent productivity killer in healthcare environments. Staff and patients alike struggle to remember complex password requirements, trigger repeated lockouts, and burden IT support teams with endless password reset requests. Yet removing password protection entirely is not an option when sensitive medical information is at stake.

Passwordless authentication offers a path forward that security teams rarely discover: strong protection without the friction. By eliminating the password requirement altogether, healthcare organizations can reduce support overhead, improve user experience, and actually strengthen security by removing the weakest link in traditional authentication. The miniOrange Multi-Factor Authentication plugin for Joomla makes passwordless login available on the platform, allowing healthcare providers to deliver a seamless authentication experience while maintaining institutional security standards. Users simply provide their username or email, receive a time-limited secure link or push notification, and gain instant access without ever typing a password.

Prerequisites

This use case has been implemented using the plugin listed below:

Multi-Factor Authentication (MFA) Plugin for Joomla

Download Extension

Challenge

A regional medical center operates a patient portal and staff management system on Joomla, providing appointment scheduling, lab results, prescription information, and administrative functions to both patients and healthcare workers. The institution's security policy mandated passwords meeting strict complexity requirements: uppercase letters, numbers, symbols, and a minimum length.

What should have been a security asset became a usability nightmare. Elderly patients, who represent a significant portion of the portal's user base, struggled to create and retain these complex passwords. Medical staff working long shifts across multiple systems faced overwhelming password fatigue, leading to predictable behavior: users wrote passwords on sticky notes, reused simple variations across systems, or reset credentials multiple times per week. The help desk received hundreds of password reset tickets each month, stretching IT resources thin during peak patient-demand periods.

The institution faced an impossible choice. Weakening password requirements would reduce security. Enforcing complex passwords would worsen the support burden and user frustration. And two-factor authentication, while secure, still required users to remember and type a base password first, which did nothing to address the core problem.

Implementation

The medical center deployed passwordless authentication using the miniOrange MFA plugin for Joomla, configured to support both Email Link and Mobile Push Notification delivery methods. This eliminated the password requirement entirely while preserving strong authentication controls.

Step 1: Install and activate the miniOrange Multi-Factor Authentication plugin on your Joomla instance.

Step 2: In the plugin's panel, navigate to the Passwordless Authentication configuration section and enable the passwordless login feature for your desired user roles.

Step 3: Select the delivery methods available to your users. Email Link delivery allows users to click a secure link sent to their registered email address. Mobile Push Notification delivery sends an authentication prompt to the user's registered mobile device. Configure both methods to give users flexibility based on their situation.

Step 4: Configure the security parameters for passwordless authentication. Set the expiration time for authentication links (typically 10-15 minutes for security while remaining practical). Ensure that each link is single-use only and can be consumed just once, preventing unauthorized access if a link is forwarded.

Step 5: Update your Joomla login page to display passwordless authentication as the primary login method. The plugin allows you to completely hide the password field, presenting only the username or email input and a button to request the authentication link or push notification.

Step 6: Define which user roles have access to passwordless authentication. For example, configure all patient accounts and staff members to use passwordless login by default, while reserving traditional password-based logins for emergency administrative access only.

Step 7: Optionally, enable a backup authentication method for users who do not have email access or a registered mobile device. This ensures that technical issues do not prevent legitimate users from accessing the system.

Step 8: Test the authentication flow thoroughly with a representative group of staff and patients before deploying to production. Gather feedback on the mobile push notification experience and email delivery times to identify any adjustments needed.

Step 9: Communicate the passwordless authentication transition to users well in advance. Provide clear instructions on how to use the new login flow, explain the security benefits of eliminating passwords, and clarify that no passwords are required moving forward.

Conclusion

By implementing passwordless authentication, the medical center has fundamentally transformed its approach to login security and user experience. Patients, particularly those with limited technical familiarity, now log in by entering only their username or email and then clicking a link or accepting a push notification. No complex passwords to create, remember, or reset. The authentication is instant, the user journey is frictionless, and the security is demonstrably stronger because it relies on something the user actually possesses, their email account or mobile device, rather than something they struggle to remember.

The impact was immediate. Password reset tickets dropped by more than 80 percent. Support staff was freed to focus on actual patient care issues rather than credential recovery. Users reported higher satisfaction with the portal, and login abandonment rates declined significantly. Healthcare staff could access patient records and administrative functions without the cognitive burden of password management, allowing them to focus on what matters most: delivering care.

The medical center discovered what many security teams eventually realize: sometimes the most powerful security improvements are also the ones that most improve the user experience. Passwordless authentication is that rare solution.

Additional Resources

1. Multi-Factor Authentication (MFA) Plugin for Joomla
2. Check out our documentation