Many cybersecurity experts believe long passphrases are more resilient to brute force attacks than shorter complex passwords. However, if users are susceptible to phishing attacks, it is more likely they will disclose easy-to-remember passphrases than complex passwords. Covered Entities should conduct a risk assessment to establish the best format to include in their HIPAA compliant password policy; and, if the conclusion is that complex passwords are more secure, implement a password manager with credential autofill capabilities so users do not have to remember their passwords.