Last update:
February 2026
Aug 21, 2026
Welcome to the February release notes for the Aikyam Identity Platform. This page provides details about updates, new features, enhancements, and bug fixes included in this release.
Release date: February 24, 2026
EDA enhancements
Tenants | OHID | MAHIX | GOVID | HSID |
Impacted? | No | No | No | Yes |
Simplified OTP verification with in‑screen delivery switching
Removed the Go back button and added a secondary action on the OTP screen across all flows.
Who?
HSID users on the EDA experience.
What?
The phone OTP screen included a secondary action that allowed users to switch between SMS and voice call verification on the same screen. Users no longer needed to navigate back or restart the flow to change the delivery method.
Why?
This improved the user experience by reducing friction when OTP delivery failed, eliminating unnecessary navigation, and enabling users to complete authentication more quickly and smoothly.
Fast-track registration without email verification
Users can skip email verification when their email is already unique in HSID while using the invitation link.
Who?
HSID users registering through the EDA Fast track registration flow.
What?
Fast-track registration was enhanced to allow users with a unique email address and validated demographic information to create an HSID account without completing the email verification step.
Why?
This improved the user experience by removing unnecessary verification steps, reducing registration delays and drop‑offs, and increasing successful onboarding completion.
Improved recovery for fast-track registration errors
Fast-track registration error handling was updated so that expired, canceled, or already‑used invitation links redirected users back to the portal instead of leading to a failed registration flow.
Who?
HSID users on the EDA Fast track registration experience.
What?
Error pages were updated to direct users to return to portal during registration. When a fast-track registration link was expired, canceled, or already consumed, users were redirected back to the portal instead of being taken into a broken or failed registration flow.
Why?
This reduced failed registration attempts and user frustration by guiding users to a clear next step and enabling them to restart registration from the portal.
Passkey login: Suppress “account not found” error on initial screen
Passkey login no longer shows an “account not found” error on the initial screen. Users proceed to the password step, and errors are shown only after sign-in, improving security.
Who?
Users with Passkey enabled across the following tenants:
What?
Tenants | OHID | MAHIX | GOVID | HSID |
Impacted? | Yes | Yes | Yes | Yes |
When a user enters an email address or username on the initial login screen, the system does not display an error if the account does not exist. The user proceeds to the password screen, and the error is shown only after the sign-in attempt if the account is not found.
Why?
This improves security by preventing account enumeration and email harvesting. By not disclosing account existence during the initial step, the login experience aligns with ESRO security recommendations while maintaining a consistent user flow.
Improved security posture: Addressed SMS pumping attacks by enforcing phone number update rate limits across applicable flows
Who?
OHID users across the following flows:
- Registration
- Account recovery
- MFA setup
- Update phone number
- Skip & remove
- Other related phone update paths
Tenants | OHID | MAHIX | GOVID | HSID |
Impacted? | Yes | No | No | No |
What?
Phone number update attempts were limited to three per user. Once the limit was exceeded, users were blocked from updating their phone number for 24 hours and shown the following error message:
You have exceeded the phone number update limit. Please try again after 24 hours.
This existing protection was expanded to include additional scenarios such as Skip & Remove and other phone update paths.
Why?
This change helped prevent SMS pumping attacks and abuse of phone update mechanisms. It reduced fraud risk, lowered unnecessary SMS costs, and strengthened platform‑wide security controls.
TMX velocity check (B2C EDA): Account recovery error code corrections
Who?
EDA users whose account recovery attempts are rejected due to TMX velocity policy checks.
Tenants
Tenants | OHID | MAHIX | GOVID | HSID |
Impacted? | No | No | No | Yes |
What?
Error codes and messages shown on the UI during TMX‑rejected account recovery scenarios are corrected. The appropriate TMX rejection reason is now displayed consistently across environments.
Why?
Accurate error codes improve auditing, reporting, and security tracking, and help support and security teams correctly identify and analyze TMX‑driven rejections.
Defect fix for passkey: Prevent post-password-reset loop
Who?
Passkey users whose accounts were locked due to risk-based authentication (RBA) triggers, such as multiple incorrect OTP attempts, or due to an LDAP password lock.
Tenants | OHID | MAHIX | GOVID | HSID |
Impacted? | No | No | No | Yes |
What?
Users who successfully reset their password were no longer shown a “Reset Password” prompt when attempting to sign in with Passkey in the same session, preventing an infinite password reset loop.
Why?
This change ensures Passkey authentication works as expected after account recovery, prevents users from getting stuck in recovery loops, and improves sign‑in reliability.
Operational excellence & security : Enhancement to security audit framework platforms
Who?
Security, audit, and operations teams across the platform.
Tenants | OHID | MAHIX | GOVID | HSID |
Impacted? | No | No | No | Yes |
What?
The audit framework was enhanced by expanding event coverage, enforcing tenant‑based PII access controls, and resolving audit event categorization gaps across both Aikyam and legacy flows. Platform capacity for Redshift and OpenSearch was increased to reduce downtime. Audit events were also enriched with additional details, such as country code and phone number information, to improve traceability and analysis.
Why?
These enhancements improved audit reliability, system performance, and availability. They also enabled deeper analysis and more effective monitoring to support security investigations and operational reporting.
Legacy HSID enhancements: Legacy HSID – Corrected and contextualized error messaging
Legacy HSID users encountering OTP limit exceeded or RBA locked scenarios
Tenants | OHID | MAHIX | GOVID | HSID |
Impacted? | No | No | No | Yes |
What?
Error messages were corrected and aligned to the specific authentication flow and failure condition, such as OTP limit exceeded or RBA lock. Users now see accurate, contextual, and actionable messages instead of generic or misleading errors.
Why?
Clear and accurate error messaging reduced user confusion, guided users toward the correct next steps, improved completion rates for account recovery flows, and lowered support volume caused by unclear system responses.
Release Date: February 2, 2026
EDA enhancements
Account recovery (Sign‑in flow) – UI enhancements for LDAP and RBA password lock scenarios
Who?
EDA users attempting to sign in with accounts locked due to LDAP or Risk‑Based Authentication (RBA) conditions
Tenants | OHID | MAHIX | GOVID | HSID |
Impacted? | No | No | No | Yes |
What?
The account recovery sign‑in flow was enhanced for LDAP and RBA password lock scenarios.
Previously: When an account was locked, users were shown a Reset Password message. After selecting the option, they were required to re‑enter their username or email and complete MFA before reaching the Create New Password screen.
Now: When the system detects a locked account that requires a password reset:
- The reset password prompt is skipped
- Username or email re‑entry is bypassed
- Users are redirected directly to MFA
- After successful MFA, users are taken to the Create New Password screen
Why?
These enhancements improved the user experience by:
- Eliminating redundant steps
- Creating a smoother, more intuitive recovery flow
- Reducing friction during password recovery for locked accounts
Account recovery – Dedicated URL for improved tracking
Who?
All EDA users with Account Recovery enabled.
Tenants | OHID | MAHIX | GOVID | HSID |
Impacted? | No | No | No | Yes |
A dedicated "Account Recovery URL" has been introduced. When users select options such as Forgot Username, Forgot Password, or Can’t Access This Number, they are routed to the account recovery workflow through this specific URL. The Account Recovery label clearly distinguishes this process from other authentication workflows.
Why?
This change enables accurate tracking of when users begin the Account Recovery journey. By separating account recovery from other workflows, it improved metric accuracy and reporting for analysis.
Account recovery: Added support for 12 additional languages in the Alternate Email flow
Who?
Tenants | OHID | MAHIX | GOVID | HSID |
Impacted? | No | No | No | Yes |
What?
Added localized content for 12 additional supported languages in the Alternate Email flow.
Why?
To ensure consistent content experience across all supported languages within EDA portals.
Account recovery: Improved recovery for users with shared email addresses
Who?EDA portals using the Alternate Email flow within Account recovery
Tenants | OHID | MAHIX | GOVID | HSID |
Impacted? | No | No | No | Yes |
What?
Resolved a gap in the Alternate Email flow so users with shared email addresses can successfully recover their accounts by entering either the shared email or a new unique email, without encountering errors.
Why?
This improves the user experience by removing recovery blockers and enabling shared‑email users to complete account recovery seamlessly.
EDA support for Japanese and Simplified Chinese
Who?
Global EDA users, particularly those in Japan and Simplified Chinese–speaking markets.
Tenants | OHID | MAHIX | GOVID | HSID |
Impacted? | No | No | No | Yes |
What?
Expands EDA’s international readiness and localization coverage to support Japanese and Simplified Chinese language.
Why?
This improves accessibility, increases adoption, and reduces friction for multilingual users.
Added Azerbaijan to the HSID registration country dropdown (Aikyam codebase for EDA)
Who?
UHC Global users attempting to login or register from Azerbaijan.
Tenants | OHID | MAHIX | GOVID | HSID |
Impacted? | No | No | No | Yes |
What?
- Azerbaijan is now unblocked as a country where HSID can successfully send OTPs to users during login or registration.
- Consumers in Azerbaijan can complete authentication processes smoothly, without encountering errors or limitations.
Why?
- To enable consumers in Azerbaijan to successfully receive OTP during login or registration.
- To ensure consistent practices on both legacy HSID and Aikyam platforms.
Security – platform enhancements
Read-only access secure admin role and enforcement in Aikyam Identity Console
Who?
OHID users during registration using the “Call Me” option
Tenants | OHID | MAHIX | GOVID | HSID |
Impacted? | Yes | No | No | No |
What?
As part of fine‑grained access (FGA), Aikyam Identity Console now includes a secure, read‑only administrator role.
Why?
This supports Operations teams during peak periods by providing specific admin access to view sensitive data and configurations while maintaining overall system integrity.
OHID - Aikyam platform | Add exponential back off for confirming OTPs (email and phone)
Who?
OHID users during registration and account recovery.
Tenants | OHID | MAHIX | GOVID | HSID |
Impacted? | Yes | No | No | No |
What?
Exponential backoff is implemented for the “Call Me” feature on OHID registration and account recovery screens.
Why?
This enhancement adds exponential backoff support, with APIs referencing tenant configuration to determine whether the exponential backoff timer should be enforced or disabled for end users.
Legacy HSID enhancements
Optum.com users seamlessly redirected to the registration page
Who?
Users navigating to the legacy HSID login or registration page from Optum.com
Tenants | OHID | MAHIX | GOVID | HSID |
Impacted? | No | No | No | Yes |
What?
Optum.com users attempting to register are now redirected directly to the HSID registration page, where they can select the Optum product they need. This eliminates an unnecessary intermediate page.
Why?
This streamlines the registration experience by removing a non–value‑adding step, making the process faster, clearer, and more intuitive for Optum.com users.
Enhanced email verification link with additional encrypted identifier (UUID)
Who?
HSID legacy users verifying their email from the Account Settings page.
Tenants | OHID | MAHIX | GOVID | HSID |
Impacted? | No | No | No | Yes |
What?
Email verification links now include an encrypted UUID, passed along with existing attributes.
Why?
This enables accurate OTP tracking, prevents OTP collisions, and improves the security and reliability of the email verification process.
OTP screen content update
Who?
All members using legacy portals, including UHC and Optum Bank.
Tenants | OHID | MAHIX | GOVID | HSID |
Impacted? | No | No | No | Yes |
What?
The OTP screen messaging was updated to:
- Prompt users to check their text messages
- Set expectations that OTP delivery may take several minutes
- Clearly state the OTP expiration time
Why?
Users experienced confusion when OTP delivery was delayed. This update improves clarity and reduces frustration during sign‑in.
Improve security posture
SMS rate limiting (monitoring only)
Who?
Tenants | OHID | MAHIX | GOVID | HSID |
Impacted? | Yes | No | No | Yes |
What?
SMS rate limiting is a protective control designed to prevent abusive use of SMS‑based operations, such as one‑time passwords (OTPs).
- A limit is applied to the number of OTPs that can be sent per tenant and country combination (international countries only).
- The feature operates in monitoring‑only mode for the initial period.
- There is no user interface impact while operating in monitoring mode.
- Fraud prevention: to combat SMS pumping attacks
- Cost optimization:to reduce unnecessary SMS usage
Previous:
March 2026
Next:
November 2025
Share additional feedback to help us improve.
0/255
|
Powered by Aikyam @2025 All rights reserved
+1 866 451 2735
+1 866 451 2735
+1 855 819 5909