I work for a company in which the age of our average user is over 70. We have an app* that helps them collect and submit physiological data to their doctors.
I found this question that I believe is helpful if you're helping your mother set a password: Secure Memorable Passwords for Older Users
However, we're struggling to develop a policy for our 5000+ users, particularly given these additional wrinkles:
- The users' accounts are set up at the doctor's office by a non-technical medical professional that probably thinks "Dog123" is a good password. We can educate them about password complexity, but getting them to similarly educate users on-site is a different ballgame.
- Many of our users don't have an email address, making it infeasible to send a password reset email
- Password managers are also infeasible, because we can't expect our medical staff to be setting up LastPass for the users (especially with no email address)
- This is medical data, with all the regulation that comes with it.
Any suggestions for a password policy that secures our sensitive data without frustrating and driving away our entire user base?
*EDIT: Mobile app. There is a web app in the ecosystem in which medical staff reviews collected data, but it currently has no functionality for the patients.
ALSO EDIT: A lot of debate here between "you can assume they have smart phones" and "no you can't." It's a bit moot in our case because we provide $20 Androids to patients without one.