Registration Guidance (Login.Gov and ID.me)
Multi-Factor Authentication (MFA)
Register more than one Multi-Factor Authentication (MFA) method. When creating your Login.gov or ID.me account, please configure at least two MFA methods (for example, an authenticator app and a phone number). Having multiple MFA methods helps you:
- Maintain access if one method becomes unavailable.
- Avoid delays accessing NIH resources.
- Reduce the likelihood of needing to recover or recreate your account.
Important: If you lose access to all your registered MFA methods, you may need to delete and create a new Login.gov or ID.me account. Creating a new account, or updating your existing account details, may potentially affect your access to downstream systems that rely on your account information.
Email Guidance (CADRs only)
Use your institutional or government issued email address. Access to NIH Controlled Access Data Repositories (CADRs) requires an approved email address that meets NIH and HHS security requirements.
Acceptable email addresses
- NIH-issued email addresses (for NIH staff)
- U.S. Federal government email addresses
- Institutional email addresses issued by universities, research institutions, hospitals, or employers
- Email addresses from approved InCommon Federation member organizations
- Personal email accounts from free email providers (such as Gmail, Yahoo, Outlook.com, Hotmail, etc.)
- Email domains identified in NIH or HHS prohibited lists
- Other email addresses that do not satisfy data repository security requirements
Important: If your identity is associated with a prohibited email address, you may be denied access to NIH controlled data, even if another linked account contains an acceptable email address.