title: Implementing a mandatory password change policy at an academic medical institution.
abstract: UW Medicine implemented a new policy requiring users to change passwords at least once every 120 days. In the first two password change cycles, many users did not take action upon notification, and their passwords expired, causing high help desk loads. Compliance and support loads improved in subsequent cycles. We conclude that policy changes requiring user behavior modification should be seen as a cultural change, and the implementation strategy should consider socio-technical factors.
authors.affiliation: UW Medicine Information Technology Services, Seattle, Washington, USA.
authors.forename: Michael W
authors.initials: MW
authors.lastname: Brogan
authors.forename: Ching-Ping
authors.initials: CP
authors.lastname: Lin
authors.forename: Rakesh
authors.initials: R
authors.lastname: Pai
authors.forename: Ira J
authors.initials: IJ
authors.lastname: Kalet
mesh_terms: D000046:Academic Medical Centers / Q000458:organization & administration; D016494:Computer Security; D009936:Organizational Innovation; D016134:Organizational Policy