HIPAA password and MFA requirements
What the HIPAA Security Rule actually says about passwords and multifactor authentication today, what HHS has proposed, and what we recommend for a small practice or company.
HIPAA password and MFA requirements at a glance
The current HIPAA Security Rule requires covered entities and business associates to verify that anyone accessing ePHI is who they claim to be (45 CFR 164.312(d)) and to have procedures for creating, changing and safeguarding passwords, an addressable specification (164.308(a)(5)(ii)(D)). It does not name multifactor authentication or set password rules. MFA would become required under the Security Rule changes HHS proposed in January 2025, which are not final; today we recommend it wherever your risk analysis supports it.
| Required now | Person or entity authentication — 164.312(d) |
|---|---|
| Addressable | Password management procedures — 164.308(a)(5)(ii)(D) |
| MFA | Not named in the current rule; required in the 2025 proposal (not final) |
| Password length or expiry | Not set by HIPAA |
| We recommend | MFA on email, EHR, remote access and admin accounts; long passphrases; no shared logins |
What the current rule says
Two parts of the Security Rule deal with sign-in:
- Person or entity authentication (164.312(d)) — a required standard: implement procedures to verify that a person or entity seeking access to ePHI is the one claimed. A password, a security key, a code from an app and biometrics are all ways to do it; the rule doesn’t pick one.
- Password management (164.308(a)(5)(ii)(D)) — an addressable specification within security awareness and training: procedures for creating, changing and safeguarding passwords. Addressable means you implement it if it is reasonable and appropriate; if not, you document why and implement an equivalent alternative measure if that is reasonable and appropriate.
Access control adds unique user identification (required) and automatic logoff (addressable).
What HHS has proposed
In January 2025, HHS proposed changes to the Security Rule that would, among other things, require multifactor authentication with limited exceptions. As of October 2026 the proposal has not been finalized. Until it is, MFA is a safeguard your risk analysis may call for, not a rule in itself.
What we recommend
These are our recommendations, not HIPAA text:
- Turn on MFA for email, the EHR or practice management system, remote access, cloud admin consoles and any account that can export data. Phishing of email accounts is one of the most common causes of breaches.
- Prefer long passphrases and a password manager to complexity rules; NIST’s guidelines advise against forced periodic changes without signs of compromise.
- Never share accounts; disable them the day someone leaves.
- Write your password and MFA rules into your policies and cover them in training.
Scenarios
Related requirements
- Access control and sign-in →§ 164.312(a)(1)
- Security risk analysis →§ 164.308(a)(1)(ii)(A)
- HIPAA training requirements →§ 164.530(b)
- Audit controls and activity logs →§ 164.312(b)
Frequently asked questions
Does HIPAA require MFA?
The current Security Rule has no general, explicit MFA requirement. It requires authentication and a risk analysis with reasonable and appropriate safeguards — so where your risk analysis shows a password alone isn't enough, MFA is a measure to put in place now. HHS proposed making MFA mandatory in January 2025; that rule has not been finalized.
How often does HIPAA require password changes?
HIPAA sets no interval. NIST's digital identity guidelines advise against forcing periodic changes unless there is evidence of compromise.
Can staff share a login if they work the same desk?
No. Unique user identification is a required specification (164.312(a)(2)(i)), so each person needs their own account.