Alongside your password you can turn on a second factor: a six-digit code from an authenticator app, such as 1Password, Bitwarden or Google Authenticator. Anyone who has your password still can’t get in.
Turning it on. Under Account & profile → Name and sign-in, in Second factor. The next time you sign in, you link your authenticator by scanning a QR code.
Sometimes required. If your business records consultation reports, or you’re listed in a professional register, you can’t turn the second factor off. That’s your clients’ health data, and it belongs behind more than a password.
Recovery codes. Create them as soon as your authenticator is linked, and keep them in your password manager. They’re only shown once. Each code works once and unlinks your authenticator, so you can link a new phone. Without codes, if you lose your phone you’ll have to rely on us.
Turning it off. That’s only possible in a session in which you signed in with the code. That way someone who only has your password can’t remove the protection themselves.