Topic starter
10/07/2026 9:22 pm
TL;DR: HIPAA’s proposed Security Rule would make MFA explicit across systems that create, receive, maintain, or transmit ePHI, with limited exceptions, and it points healthcare teams toward phishing-resistant methods such as passkeys and security keys, according to Authsignal. Password-only access and SMS-based fallback strategies are becoming harder to defend as durable healthcare identity controls.
Editorial analysis by NHI Mgmt Group, based on content published by Authsignal: “HIPAA MFA requirements and what to do before the final rule lands”.
Key questions
Q: What breaks when healthcare access still depends on passwords?
A: Passwords break down when clinical speed and security are forced into the same rigid workflow.
Q: Why does phishing-resistant MFA matter more than SMS codes for healthcare access?
A: SMS codes remain vulnerable to interception, redirection, and social engineering, so they do not materially reduce phishing risk for high-value healthcare systems.
Q: How should healthcare teams prioritise MFA rollout across their identity estate?
A: Start with privileged access, remote access, and third-party access to ePHI, because those paths combine the highest impact with the weakest tolerance for compromise.
Practitioner guidance
- Inventory every ePHI access path List all systems that create, receive, maintain, or transmit ePHI, including remote portals, admin consoles, vendor connections, patient portals, and legacy clinical apps.
- Classify current authentication methods by risk Document where the environment still relies on passwords, SMS, shared accounts, local credentials, or vendor-managed access, then rank those paths by exposure.
- Move privileged and remote access to phishing-resistant MFA Start with administrator accounts, remote access portals, and business associate sessions, then use passkeys or security keys where the workflow can support them.
Bottom line: Healthcare MFA is moving from implied good practice to explicit governance expectation across ePHI systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:45 pm
HIPAA’s MFA shift is really an identity governance reset, not just a compliance update. Once MFA becomes explicit across ePHI systems, the question changes from whether teams can justify exceptions to whether they can still defend password-based access paths at all. The practical implication is that healthcare programmes must align authentication policy, vendor access, and system classification under one governance model.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What should organisations do when a legacy clinical system cannot support modern MFA?
A: Treat the exception as a controlled risk decision, not a permanent workaround. Document the constraint, apply compensating controls such as segmentation and restricted access windows, and set a migration plan so the exception does not become a standing weak point.
👉 Read our full editorial: HIPAA MFA requirements are shifting healthcare identity design