What HIPAA requires for passwords

HIPAA’s Security Rule asks you to have procedures for creating, changing and safeguarding passwords. It doesn’t say how long a password must be, which characters it needs, or how often to change it. Those numbers go in your own policy. The most detailed federal guidance, NIST SP 800-63B-4, asks for at least 15 characters when the password is the only check. It allows 8 when the sign-in also uses multi-factor authentication (MFA: a second check after the password, such as an app code). See What is two-step verification? for how the second check works.

What the Security Rule says

The rule is Subpart C of 45 CFR Part 164. The word “password” appears in only two of its sections. Section 164.304 defines it as confidential authentication information made of a string of characters. The other is 164.308(a)(5)(ii)(D), “Password management (Addressable),” which calls for “Procedures for creating, changing, and safeguarding passwords.”

That specification sits under 164.308(a)(5), security awareness and training. So the rule treats passwords mainly as something your staff are trained to handle. OCR’s audit protocol shows what an auditor may look for here. The list covers staff roles in handling passwords, how passwords should be created, changed and safeguarded, and what to do when one is compromised. Auditors also check that the right people were trained.

Addressable doesn’t mean optional. Under 164.306(d)(3), you assess whether the specification is reasonable and appropriate for your practice. If it is, you implement it. If it isn’t, you document why and implement an equivalent alternative where that is reasonable and appropriate. More on the labels is in What is the HIPAA Security Rule?

Other rules that shape how passwords are used

Three more provisions affect passwords without using the word.

NIST SP 800-66r2 is NIST’s resource guide to the Security Rule. Under person or entity authentication, it asks whether passwords are unique to the individual. It also asks whether they’re long and strong enough to protect ePHI (patient health information kept electronically), and whether technical settings enforce that. Under training, it asks whether your policies prohibit staff from sharing passwords.

Where the numbers come from

Since HIPAA gives no figures, you take them from guidance. NIST SP 800-63B-4, finalized in July 2025, gives the most detail. Its scope is people signing in to government systems, so it doesn’t bind a private practice. NIST’s HIPAA resource guide points to SP 800-63B for authentication, though it cites the edition before -4. Section 3.1.1.2 of SP 800-63B-4 sets these rules for the system that checks passwords:

• At least 15 characters when the password is the only factor, and at least 8 when it’s part of MFA.
• Allowing passwords of at least 64 characters is recommended, not required.
• No composition rules, such as requiring a mix of letters, numbers and symbols.
• Check each new password against a blocklist of common or breached passwords.

HICP is a set of recommended practices for health care that HHS publishes with industry through its 405(d) program. The 2023 volume for small practices says to give each user a separate account, remind staff not to share passwords, and use work passwords that differ from personal ones. The volume for larger organizations recommends passphrases with a minimum of 8 characters and up to 64 allowed. It also recommends denylists and limits on how fast someone can retry. That volume cites NIST’s June 2017 edition, which came before the 15-character minimum for passwords used alone. A side-by-side of NIST, CISA and PCI DSS numbers is in How long should a password be?

Scheduled changes

The rule asks for procedures for “changing” passwords. That word sets no schedule. A 90-day rule in your policy is your choice, not HIPAA’s. NIST SP 800-63B-4 says verifiers shall not require periodic changes, and shall force a change when there’s evidence of compromise. OCR’s audit protocol also asks what you do when a password is compromised. So a written answer to “what triggers a change?” covers both. The reasoning behind dropping scheduled changes is in Do passwords still need to be changed every 90 days?

What HHS has proposed

In January 2025, HHS proposed amendments to the Security Rule (90 FR 898). Proposed 164.312(f)(2)(i) would require technical controls that make users adopt unique passwords “consistent with the current recommendations of authoritative sources.” The same proposal would require MFA at proposed 164.312(f)(2)(ii). It hasn’t been finalized. The federal regulatory agenda lists a projected final action date of July 2027. Unless a final rule is published, password management stays addressable, with no figures in the rule.

Passwords on shared logins

The figures above assume one password belongs to one person. On a login several staff share, a 15-character password is known to all of them. When one leaves, they still know it, so you change it and give the new one to everyone else. Each change means every remaining person learns a new long password. Unique user identification is the required piece, and a shared login can’t meet it (Can staff share an EHR login?). What else to close when someone leaves is in Which accounts to close when someone leaves a medical practice, and how fast.