What's New in the SAFHIR Registration Portal
Each release card below summarises a feature shipped to the portal. Click a card to see the full step-wise guide explaining what the user sees and what the system does at every step.
Multi-Factor Authentication (MFA)
SMS-based MFA powered by Twilio Verify, applied across registration, login and profile updates. Every user must verify their mobile number before MFA is activated on their account.
- OTP-verified registration with mandatory phone number
- Login challenge with method selection (SMS / Email / Call)
- Profile phone-change requires re-verification before save
- Rate-limiting, lockout and resend cooldown handled server-side
Authenticator App (TOTP)
Stronger, phishing-resistant second factor using Google Authenticator, Authy or any TOTP app. TOTP is opt-in from the profile and becomes a faster alternative to SMS at login.
- Enrol from the profile by scanning a QR code (auto-blurred after 30s)
- Confirm with a 6-digit code from the authenticator app
- Pick TOTP or SMS at login for users who have both enabled
- Remove the authenticator at any time; account safely falls back to SMS
UM Vendor Onboarding
End-to-end onboarding for Utilization Management vendors — covering account registration with OTP verification, MFA-protected login, and application creation with scope selection.
- UM Vendor role selection during registration with OTP-verified phone
- MFA-gated login with SMS verification at every sign-in
- Application creation wizard with UM-scoped FHIR resource selection
- Application enters Pending state awaiting admin approval after submit
Application Registration & Payer Review
A streamlined application registration experience and richer payer admin review — real-time form validation, auto-set application fields, and a new applicant details panel with protected identifiers.
- Real-time username & email availability checks with inline errors on all registration forms
- Simplified application form — version removed, Application ID & Type set automatically
- Dedicated "Application already registered" page for re-registration attempts
- Payer admin review shows applicant details (Name, Email, Organization, Persona) with TIN masked behind a "Show" toggle, plus EIN and NPI
- Rejecting an application now requires rejection remarks