Cybersecurity experts believe long passphrases are harder to crack using brute force attacks than shorter complex passwords. However, if users are susceptible to phishing attacks, the harder a complex password is to remember, the less likely users are to inadvertently reveal it. Covered Entities should conduct a risk assessment to establish the best format to include in a HIPAA compliance password policy; and, if the solution is complex passwords, implement a password manager with credential autofill capabilities so users do not have to remember passwords.