HIPAA requires password change every 30 days. I have two files with password protection, second one opens hidden. At password change users are requred to enter account name/pword for fist file, change pword. Then enter account name/old pword, then change pword again. This is workable but annoying and sometimes users get confused with the second login requiring the old pword. Previously I had the pword inside a database but not as secure so using FM7's. Any suggestions or just continue with above?

You can try using the new account management script steps. By using a Custom Dialog, with global User Name and Password input fields, you can have more control on how the login works, including propagating the Account and Password to each file and propagating changes to the Account or Password to each file.

These account propagation scripts can get complicated, depending on how thorough you are. You can search this forum for some examples and discussion.