For healthcare providers, protecting patient data is both a legal obligation and a necessary step in establishing trust with patients and other stakeholders.
The Health Insurance Portability and Accountability Act (HIPAA) mandates safeguards for electronic protected health information (ePHI). One of the most effective ways to meet HIPAA’s security requirement is multi-factor authentication (MFA). This post covers what HIPAA asks for on authentication, common MFA challenges and how to work through them.
HIPAA MFA refers to using multi-factor authentication to meet HIPAA's identity verification requirement: users verify their identity with at least two different factors before accessing systems containing ePHI. The second factor protects ePHI even if one credential is compromised, and it's how most organizations satisfy the HIPAA Security Rule's authentication standard.
HIPAA does not name MFA as a requirement today. The Security Rule requires regulated entities to verify that anyone seeking access to ePHI is who they claim to be, and MFA is the standard way to meet that. On December 27, 2024, the U.S. Department of Health and Human Services (HHS) proposed a Security Rule update that would make MFA mandatory, with limited exceptions.
The proposal is open for public comment until March 2025, and the current rule remains in effect until a final rule is published. Until then, MFA is what auditors and cyber-insurers expect rather than what the regulations spell out.
The HIPAA Security Rule establishes national standards to safeguard ePHI. It requires administrative, physical and technical safeguards to protect patient data. MFA satisfies the authentication standard under technical safeguards, which are designed to:
MFA supports these safeguards by requiring more than one factor, so a stolen password alone doesn't grant access.
The National Institute of Standards and Technology (NIST) provides clear guidelines on authentication, categorizing credentials into three groups:
To meet HIPAA's authentication standard in line with NIST guidance, organizations should implement MFA using at least two distinct categories, for example a password (knowledge) with a one-time passcode from a smartphone (possession).
Stolen credentials from phishing attacks are a leading cause of data breaches. MFA reduces this risk by requiring a second authentication factor, making compromised passwords alone insufficient.
Outdated systems often lack built-in security features, leaving them vulnerable to exploitation. Where a system cannot support MFA natively, the control has to sit in front of it rather than inside it, which is the case for enforcing authentication at an access layer instead of per application.
Password reuse is widespread, so one leaked password can open several accounts. MFA limits the damage from poor password hygiene by requiring a second factor.
Healthcare organizations often rely on a mix of cloud-based systems, on-premise servers and legacy infrastructure. These disparate systems typically lack unified security measures, making it difficult to enforce MFA consistently across all access points. Legacy systems, in particular, may not support native MFA, leaving gaps that a cyber criminal can work through. This fragmentation creates gaps in coverage and raises the risk of unauthorized access to ePHI.
Healthcare staff, including clinicians, administrative teams and IT professionals, often face high-pressure, time-sensitive situations where efficiency is critical.
Traditional MFA solutions, which can require additional steps or complex processes for authentication, may disrupt workflows, causing frustration and resistance among users. In some cases, staff may seek workarounds, such as sharing credentials or bypassing MFA protocols, which undermines security efforts. Finding an MFA solution that balances strong security with minimal user friction is a challenge for healthcare organizations.
Many healthcare organizations already use identity management solutions like Active Directory (AD), Okta or LDAP to manage user authentication and access. Integrating MFA into these systems can be technically challenging, requiring customization and development effort. Incompatible systems and poor integration capabilities often lead to delays, increased complexity and errors, and MFA ends up covering less than intended.
Implementing and maintaining an effective MFA solution can require real investment and technical expertise, both of which are often limited in healthcare organizations. IT teams are typically tasked with managing competing priorities, making it difficult to allocate time and resources for MFA implementation and ongoing support. These constraints can delay adoption and leave sensitive data exposed in the interim.
HIPAA audits ask organizations to show how access to ePHI is controlled and reviewed, including authentication records. Many MFA tools don't log at the level of detail that takes. Without a usable audit trail, responding to an audit request is slow and the outcome is uncertain.
The rapid adoption of remote work in the healthcare industry has created new vulnerabilities, particularly in securing access to critical systems from external locations. Many MFA deployments don't cover remote connections consistently, leaving them exposed to phishing, credential theft and brute-force attacks. Securing remote access without slowing remote staff down is a real challenge for healthcare organizations.
Most of the six challenges above come down to the same thing: MFA has to be enforced somewhere that every path to ePHI passes through, and the enforcement has to produce a record. That is what the Delinea Platform is built around. MFA can be enforced at login and again at privilege elevation through Server PAM.
Privileged Remote Access extends the same enforcement to staff and third parties connecting without a VPN, and Secret Server records the session so the authentication event and what followed it sit in the same place. That record is what makes the access decision auditable and defensible.
For the audit side, Delinea's audit and compliance solution gathers the access evidence an an HHS Office for Civil Rights (OCR) investigation asks for, which shortens the part of an audit that usually takes the longest.