I work for a company in which the age of our average user is over 70. We have an app\* that helps them collect and submit physiological data to their doctors.

I found this question that I believe is helpful if you're helping your mother set a password: [Secure Memorable Passwords for Older Users](https://security.stackexchange.com/questions/104998/secure-memorable-passwords-for-older-users)

However, we're struggling to develop a policy for our 5000+ users, particularly given these additional wrinkles:

* The users' accounts are set up at the doctor's office by a
non-technical medical professional that probably thinks "Dog123" is a
good password. We can educate them about password complexity, but
getting them to similarly educate users on-site is a different
ballgame.
* Many of our users don't have an email address, making it infeasible to send a password reset email
* Password managers are also infeasible, because we can't expect our medical staff to be setting up LastPass for the users (especially with no email address)
* This is medical data, with all the regulation that comes with it.

Any suggestions for a password policy that secures our sensitive data without frustrating and driving away our entire user base?

\*EDIT: Mobile app. There is a web app in the ecosystem in which medical staff reviews collected data, but it currently has no functionality for the patients.

ALSO EDIT: A lot of debate here between "you can assume they have smart phones" and "no you can't." It's a bit moot in our case because we provide $20 Androids to patients without one.