The FMCSA has identified a concerning practice among many certified Medical Examiners (MEs) who have been sharing their login.gov credentials, including user IDs and passwords, with unauthorized individuals. These unauthorized parties have been accessing the MEs' National Registry accounts to perform actions on their behalf.
The National Registry System is protected under the Privacy Act, and sharing login credentials violates both the Privacy Act (5 U.S.C. § 552a) and FMCSA's IT Rules of Behavior. Specifically, this breaches requirements #8 and #10:
- Requirement #8 states that National Registry system accounts are linked to your login.gov profile for your exclusive use. Passwords or any other authentication mechanisms must never be shared or stored in an accessible printed form, and if stored digitally, they must not be in a clear-text or readable format.
- Requirement #10 mandates that any security problems or password compromises must be reported immediately to the FMCSA Information System Security Manager at FMCSASecurity@dot.gov.
Violating these rules is a prohibited practice. Users who continue to share their credentials risk permanent removal from the National Registry and potential legal consequences under Title 18 of the U.S. Code, which may include fines and up to 10 years in prison. These rules are part of the FMCSA's IT Rules of Behavior, which all account holders sign annually.
All National Registry System users must stop sharing their login credentials immediately. Users who have shared their credentials must change their passwords to prevent further unauthorized access. FMCSA will actively monitor for this prohibited behavior and will take appropriate action against violators.