Although the Administrative Safeguards stipulate Covered Entities should implement procedures for creating, changing, and safeguarding passwords, this addressable requirement was issued prior to NIST changing its recommendations for password best practices. The current guidance is that passwords should only be changed when there is evidence of compromise.