Sign in with the emailed username + password.

ONE code path for existing and non-existing usernames. Every observable — status code, message, Retry-After, and the progressive delay — is produced by the same statements regardless of whether the account is real, so the response cannot be used to enumerate which hospitals are partners. Usernames here are derived deterministically from the organization name, which is what made the old 5th-attempt 429/401 split a partnership-disclosure leak.

The hard lock is scoped to (username, ip): five wrong guesses stop THAT caller, not the hospital. A username-only lock let anyone who could guess massgeneral hold Mass General out of its own portal indefinitely.