Does your application require users to set their own password after an administrator reset or on first use of the account?

This question is asking whether your application forces users to create their own password when their account is first created or after an administrator resets their password, rather than continuing to use a temporary or administrator-set password. This is important for security because: 1. Administrator-set or temporary passwords are often shared through potentially insecure channels (email, text messages, etc.) 2. Temporary passwords may be documented or stored in IT systems, creating security risks 3. Users should be the only ones who know their own passwords (password confidentiality) 4. Forcing password changes ensures that shared or potentially compromised credentials are quickly replaced In the context of HIPAA compliance, this is particularly important because it helps protect access to systems that may contain Protected Health Information (PHI). HIPAA requires covered entities to implement technical safeguards that control access to ePHI, and proper password management is a fundamental control. When answering this question, you should clearly state whether your application: - Forces password changes after admin resets - Forces password creation on first login - Includes any exceptions to these rules - Has any additional related password security features If your application doesn't enforce these practices, you should explain what compensating controls you have in place to mitigate the associated risks.