Password must have one capital letter, one number and a symbol character. It must also be a minimum of 8 characters in length.
For example, BestPractices!
Level of security rules regarding passwords can vary. For instance, the Health Insurance Portability and Accountability Act may require higher level of rules. See HIPPA.
Also read this blog.
Wherever NPI is stored, the password must be changed every three months.