Two-factor authentication at a medical practice, and what happens on shared logins

HIPAA’s Security Rule doesn’t require multi-factor authentication (MFA) by name. MFA means a second check after the password, such as a code from an app on your phone (What is two-step verification?). HHS has proposed making it mandatory, and its voluntary goals for health care include it. One firm federal rule does exist, from the DEA: prescribers must use two factors to sign controlled-substance e-prescriptions. On a login several staff share, adding MFA leaves two problems. The code reaches one phone, and the system’s records still don’t show who signed in.

What the current Security Rule says

The relevant standard is 45 CFR 164.312(d), person or entity authentication. It asks for procedures to “verify that a person or entity seeking access” to ePHI is the one claimed. ePHI is patient health information kept or sent electronically. The standard names no method, so the method is yours to choose, as long as it’s sufficient to confirm identity. OCR’s audit protocol asks whether your authentication procedures are good enough to confirm that identity.

NIST’s resource guide to the Security Rule, SP 800-66r2, adds detail. It lists the three common factors: something a person knows, has, or is. MFA, it says, uses two or more of them. It suggests considering MFA “when the risk to ePHI is sufficiently high.” Remote access and administrator functions are its examples. So under the current rule, your risk analysis decides where MFA goes.

What HHS has proposed

In January 2025, HHS proposed amendments to the Security Rule (90 FR 898). Proposed 164.312(f)(2)(ii)(A) would require you to “Deploy multi-factor authentication to all technology assets” in your relevant systems. The proposal hasn’t been finalized. The federal regulatory agenda lists it as a long-term action, with a projected final action date of July 2027. Until a final rule is published, MFA stays a choice your risk analysis makes.

HHS’s voluntary goals and practices

HHS’s Healthcare and Public Health Sector Cybersecurity Performance Goals (CPGs) list MFA as one of ten essential goals. HHS describes the CPGs as voluntary. The MFA goal covers assets and accounts reachable from the internet. It applies “where safe and technically capable.” The CPGs are covered in The HHS cybersecurity performance goals for accounts and logins.

HICP, guidance HHS publishes with industry through its 405(d) program, gets more specific. Its 2023 volume for small practices recommends MFA for email, remote access, VPN connections and every administrator account. It warns that a username and password alone aren’t enough anymore, because phishing emails often steal them. The volume for larger organizations asks for MFA on every privileged account people use directly. It suggests hardware security keys for those accounts.

Where two factors are required: e-prescribing controlled substances

DEA rules for electronic prescriptions of controlled substances are in 21 CFR Part 1311. Section 1311.115 says the prescribing application must require two of three factors to sign. They are something the prescriber knows, such as a password; a biometric, such as a fingerprint; and a “hard token,” a physical device separate from the computer. That device must meet at least FIPS 140-2 Security Level 1.

Section 1311.102(a) rules out sharing outright. The prescriber “must retain sole possession of the hard token” and must not share the password or biometric with anyone. They also must not let anyone else use them to sign. A prescriber who fails to secure these factors risks having their DEA registration revoked or suspended. A lost or compromised factor must be reported within one business day. Under 1311.102(k), staff can still enter a prescription for the prescriber to review; the prescriber stays responsible for it.

What happens when you add MFA to a shared login

An authenticator-app code or a text-message code goes to the phone or number that was registered. On a shared login, that means the code reaches one person. When that person is off, nobody else can sign in. Two workarounds make it worse. If everyone scans the setup QR code, every phone can make codes, and none of them can be taken back one at a time. If you hand out backup codes, each copy is another way in. The options are compared in Sharing two-step verification across a team.

The records don’t improve either. MFA checks that whoever signs in holds the factor. The system’s log still shows the shared account’s name. Unique user identification, 164.312(a)(2)(i), is labeled required: each user gets a unique name or number so their activity can be traced. A shared login can’t meet that, with or without MFA. So you still need a separate record of who used it.

Choosing a setup

Start with a list of your systems. For each, note whether it supports MFA, whether people share any login, and when the vendor contract or next upgrade comes up. That list tells you where personal logins are possible now, and where a shared login will stay for a while.