That's why the calls spike around the time change - because people aren't entirely sure anymore.
I think it's because that's when they reset all of their unconnected clocks (oven, microwave, wristwatch). You might as well set them accurately twice a year.
If you're setting password policy tell users to use 5 truly random words. (flip through the dictionary with their eyes closed or use a random word generator)
A random word generator is good (but you have to use the words it gives you, no do overs), but flipping through a dictionary won't give you truly random words, they will pick words that are easy, that go together, and that are in alphabetical order. And that's assuming they don't cheat by flipping through nearby pages after they select a page. If you require that they close the dictionary after each word their selections will be clustered near the center of the dictionary rather than random.
People are bad at random
We're talking about people who were doing nicely pre-EHR.
Unless you asked them questions that go across their patient population such as, "How many of your patients are overdue for their mammogram?" or "What percentage of your diabetes patients are successfully managing their A1C levels?" or even, "How many of your patients had a wellness appointment last year?"
Without an EHR you basically can't answer those questions. The benefit of an EHR isn't at the bedside.
Having said that, the problems with EHR interfaces certainly exists and hopefully will be improved over the next ten years.
"If anything can go wrong, it will." -- Edsel Murphy