A password, no matter how complex, simply isn't enough security. Two-Factor authentication or a passkey would be an excellent addition. It honestly concerns me that given the sensitivity of the data, this wasn't included from the get-go.