Does HIPAA require MFA? What medical practices need to know

Last reviewed: October 27, 2026. The proposed MFA requirement is not yet final. The current HIPAA Security Rule remains in effect.

The practical answer

MFA is one of the most valuable protections a medical practice can deploy because a stolen password alone is no longer enough to enter an account. Under the current rule, a practice must authenticate users and choose safeguards based on its risk analysis. HHS guidance explains that MFA may be a reasonable and appropriate response to identified risk. The proposed Security Rule update would go further and generally require MFA.

Where medical practices should enable MFA first

1. Email and collaboration accounts
2. Administrative and privileged accounts
3. Remote access and support tools
4. Billing, banking, payroll, and payment systems
5. Cloud file storage and backup administration
6. EHR, practice-management, imaging, and clinical systems when supported

Common rollout mistakes

• Protecting staff accounts while leaving administrator or vendor accounts exposed
• Using text messages as the only method when stronger options are practical
• Failing to document emergency and recovery access
• Leaving former employees, shared accounts, or unused vendor access active
• Assuming MFA eliminates phishing, unsafe approvals, or session theft

How to make MFA workable for staff

Plan the rollout around real workflows. Identify employees without organization-owned phones, shared clinical workstations, after-hours access, provider travel, emergency accounts, and systems that do not support modern sign-in methods. Give staff simple instructions and a clear support path. Record any exception, the reason, approval, compensating safeguard, and review date.

MFA is one layer, not the whole program

Strong sign-in protection works best with prompt account removal, managed devices, email filtering, limited administrative access, protected backups, incident preparation, and staff training. It reduces a common path into the practice but cannot correct every weak process or unsupported system.

Frequently asked questions

Is MFA required by HIPAA today?

Not as a blanket requirement for every system. The current rule requires authentication and risk-based safeguards. A practice's risk analysis may show that MFA is necessary and reasonable for particular access.

Will MFA become mandatory?

HHS has proposed generally requiring MFA with limited exceptions. A final rule may differ, so practices should monitor HHS and avoid treating the proposal as final.

What if a clinical system does not support MFA?

Document the limitation, involve the vendor, reduce exposure with other safeguards, and include replacement or remediation in the risk-management plan. Do not silently ignore the gap.

Sources

• HHS proposed Security Rule fact sheet
• HHS OCR cybersecurity newsletter: MFA
• HHS current Security Rule summary

General educational information only; not legal or compliance advice.