HIPAA MFA Requirements: Current Rule vs 2025 NPRM Proposal

Today’s Legal Frame

• §164.312(d) Person or Entity Authentication is a Required standard — verify identity of persons/entities seeking access.
• MFA is a strong method to meet that standard for remote and privileged access, but it is not named as a standalone Required MFA mandate in the current CFR text.
• NPRM: proposed MFA as part of updated technical expectations; wait for a final rule before claiming “new mandatory MFA.”

Programme Guidance

1. Require MFA for remote access to ePHI systems and for privileged accounts.
2. Prefer phishing-resistant factors where feasible for high-risk roles.
3. Log MFA success/failure into your audit-control pipeline (§164.312(b)).
4. Document MFA coverage gaps in the risk analysis and remediation plan.

How CyberSilo Helps

• ThreatHawk detects MFA fatigue / anomalous auth patterns against ePHI systems
• CSA tracks authentication control status and evidence URLs

Frequently Asked Questions

Does HIPAA require MFA today?

There is no standalone Required MFA specification in the current Security Rule. Authentication is Required (§164.312(d)); MFA is widely appropriate. The 2025 NPRM proposed MFA — not final as of 2026.

Where should MFA be applied first?

Remote access to ePHI, privileged/admin accounts, EHR and billing portals, and any cloud console holding ePHI.

How does MFA relate to OCR audits?

OCR frequently examines access controls and authentication. Document MFA coverage and exceptions in your risk analysis and policies.

Related HIPAA Resources

HIPAA hub · Encryption · Audit logs · CSA