9 Considerations for Multifactor Authentication in Healthcare

In February 2024, attackers signed into a Change Healthcare remote access portal using stolen credentials. The portal had no multifactor authentication. What followed became one of the largest healthcare breaches on record and stalled claims and pharmacy payments across the country for weeks. The pattern repeats across the sector. Hacking and IT incidents accounted for more than 80% of large healthcare breaches on the HHS breach portal in 2025, according to HIPAA Journal’s analysis of OCR data, and stolen or weak credentials sit behind many of them.

Multifactor authentication in healthcare means requiring clinicians, staff, and vendors to prove their identity with two or more independent factors before they reach systems holding electronic protected health information (ePHI). Most security leaders already agree it belongs in their stack. The harder question is how to make it work on shared nursing stations, in phone-free units, and for staff who move between a dozen devices per shift.

This guide covers what counts as MFA, where HIPAA and DEA rules stand, nine considerations to settle before rollout, and how to match methods to clinical workflows.

What Is Multifactor Authentication in Healthcare?

MFA verifies a user with factors from at least two separate categories. In hospitals and clinics, it protects EHRs, e-prescribing, imaging and lab systems, email, and remote access tools.

The Three Authentication Factors

• Something you know: a password or PIN
• Something you have: a badge, hardware security key, smart card, or authenticator app
• Something you are: a fingerprint, face, or other biometric

What Does Not Count as MFA

Two factors from the same category fail the test. HHS OCR has stated that a password plus a PIN does not qualify as MFA, since both are something you know. A password plus a security question fails for the same reason. Auditors check factor categories, not the number of prompts.

Is MFA Required Under HIPAA and DEA Rules?

What the Current HIPAA Security Rule Requires

The current rule does not name MFA. It requires unique user identification (§164.312(a)(2)(i)) and person or entity authentication (§164.312(d)), and leaves the method to your risk analysis. In practice, single-factor access to ePHI has become hard to defend in an OCR investigation or a cyber insurance renewal.

What the Proposed Security Rule Update Changes

HHS published a proposed overhaul in January 2025 that would make MFA explicit for systems handling ePHI, with limited exceptions, and remove the “addressable” category. The rule remains proposed. HHS has pushed final action to at least July 2027, so the current rule stays in force. Treat the proposal as your readiness target.

DEA Two-Factor Requirements for EPCS

Electronic prescribing of controlled substances already carries a firm mandate. DEA rules (21 CFR Part 1311) require two-factor authentication to sign controlled substance prescriptions, using two of three options: a knowledge factor, a hard token separate from the computer, or a biometric. Identity proofing and logical access controls also apply, so a generic MFA tool alone rarely satisfies an EPCS audit.

9 Key Considerations for Multifactor Authentication in Healthcare

Each point below reflects a place where multifactor authentication in healthcare departs from standard MFA, which assumes one person on one laptop.

1. Shared Workstations and Computers on Wheels

Nursing stations, workstations on wheels, and medication carts serve many users per shift. MFA on these devices has to switch users in seconds, lock sessions when someone walks away, and keep a clean audit trail per person. Shared generic logins break HIPAA’s unique user ID requirement outright.

2. Phone Restrictions in Clinical Areas

Many units restrict personal phones, and some labor agreements prevent employers from requiring staff to use their own devices for work. Push notifications and authenticator apps fail when the phone stays in a locker. Plan for factors that live on the workstation or the badge.

3. Gloves, Masks, and PPE That Block Biometrics

Fingerprint readers fail through gloves, and masks degrade some facial recognition systems. In sterile areas, touching shared surfaces adds infection risk. Test each biometric method in the units where it will run, including ORs, isolation rooms, and labs, before you commit.

4. Login Speed and Re-Authentication Frequency

Clinicians open the EHR dozens of times per shift. A 15-second login repeated 50 times costs more than 12 minutes. When MFA slows care, staff prop sessions open or share credentials. Measure time to authenticate, and pair MFA with SSO so one strong check covers several applications.

5. Phishing Resistance of Each Factor

Factor strength varies widely. SMS codes are exposed to SIM swapping, and NIST guidance classifies them as a restricted authenticator. Push approvals without number matching invite MFA fatigue attacks. FIDO2 security keys, passkeys, and certificate-based smart cards resist phishing because they bind to the legitimate site. Reserve the strongest factors for remote and privileged access.

6. Compatibility With EHR, SSO, and Legacy Systems

Confirm support for your EHR, identity provider (Microsoft Entra ID, Okta, or Active Directory), virtual desktops, and thin clients. Legacy clinical applications and medical device consoles often lack MFA support. For those, document compensating controls such as network segmentation, restricted access hours, and session logging.

7. Break-Glass Access for Emergencies

During a code or a downtime event, nobody can wait on a failed login. Define emergency access accounts in advance: who can use them, where credentials are stored, and when they expire. Every break-glass session should trigger an alert and a review within 24 hours.

8. Enrollment and Account Recovery for Frontline Staff

For multifactor authentication in healthcare, identity assurance starts at enrollment. Patient transporters, environmental services teams, and per diem staff often have no corporate email or company phone, so self-service enrollment links never reach them. Plan supervised or kiosk-based enrollment and a recovery path that does not depend on email. OLOID, for example, is built around this kind of shared-device workforce.

9. Third-Party Vendor, Contractor, and Locum Access

Business associates were involved in 127 of the 345 breaches reported to OCR by mid-2025 (GovInfoSecurity). Require MFA for every vendor remote session, time-box accounts for locum and travel staff, and remove access the day a contract ends.

Choosing MFA Methods by Clinical Workflow

No single factor covers every workflow, so multifactor authentication in healthcare usually combines two or three methods across the organization.

MFA Method Comparison

The right authentication method depends on the application, access risk, and clinical workflow. A factor that works well for remote access may not be practical at a shared nursing station.

Organizations should also distinguish between a single authentication factor and a complete MFA configuration. For example, a badge is generally a possession factor, while a PIN is a knowledge factor. Combining the two can provide MFA, subject to the implementation and applicable requirements.

Phishing resistance should be evaluated based on the complete authentication protocol and implementation, not simply the factor's label.

Recommended Factors by Workflow

The recommended configuration should be validated against the organization's security requirements, application capabilities, and the specific clinical workflow. A method that works for remote access may not be appropriate for every shared workstation.

How to Roll Out Multifactor Authentication in Healthcare

Phase 1: Assess Authentication Risks

Identify systems that store or access ePHI, user groups, remote access paths, privileged accounts, and applications that cannot support modern authentication.

Phase 2: Prioritize High-Risk Access

Start with remote access, email, privileged accounts, and other high-risk systems where MFA can be deployed with minimal clinical workflow disruption.

Phase 3: Map Clinical Workflows

Identify shared workstations, mobile carts, phone-restricted units, legacy applications, and emergency access scenarios.

Phase 4: Pilot in a Clinical Unit

Run a pilot in a representative clinical environment. Collect feedback from clinicians, IT operations, and the help desk before expanding.

Phase 5: Scale and Monitor

Expand deployment in phases, document exceptions, and monitor authentication coverage, login time, workarounds, and support tickets.

How OLOID Fits Into a Healthcare MFA Strategy

Healthcare organizations need authentication that protects access to clinical systems while accommodating the realities of frontline work. Shared workstations, phone-restricted units, frequent user switching, and time-sensitive clinical workflows can make conventional authentication methods difficult to deploy consistently.

OLOID supports passwordless authentication for frontline healthcare workflows, including shared workstations and devices used across clinical shifts. With authentication options such as badge and face, OLOID helps organizations verify individual users at shared devices while integrating with existing identity infrastructure.

For healthcare IT and security teams, the goal is to extend strong authentication to clinical workflows without relying on shared accounts or creating unnecessary login friction. The right deployment depends on the organization's applications, identity provider, security requirements, and clinical workflows. Authentication methods should be evaluated and validated before deployment across each relevant environment.

FAQs

1. Is multifactor authentication required by HIPAA?

Not by name yet. The current Security Rule requires unique user identification (§164.312(a)(2)(i)) and person or entity authentication (§164.312(d)), and OCR expects your risk analysis to justify any single-factor access to ePHI. HHS has proposed making MFA mandatory for nearly all ePHI systems, with final action pushed to at least July 2027. Organizations that deploy MFA now avoid a rushed rollout once the rule becomes final.

2. Does a text message code count as MFA?

Yes, because the phone adds a possession factor. It is also the weakest common option: SIM swapping and interception can hand an attacker the code, and NIST classifies SMS as a restricted authenticator. Keep SMS as a fallback at most, and protect remote access, email, and admin accounts with FIDO2 keys or push with number matching.

3. Is a password plus a PIN considered MFA?

No. HHS OCR has stated that a password and a PIN are both “something you know,” so together they still count as single-factor authentication. Many organizations believe they have MFA when they only have two knowledge prompts, and that gap shows up in audits. A compliant setup pairs the PIN with a badge, security key, or biometric.

4. What is the best MFA method for shared hospital workstations?

Badge tap plus PIN or facial recognition fits most shared workstations. Both authenticate in seconds, work when personal phones are banned, and tie each session to one clinician for HIPAA’s unique user ID requirement. Before choosing, test face recognition in masked units and badge readers on workstations on wheels, since slow or failed logins push staff back to shared accounts.

5. Is two-factor authentication required for e-prescribing controlled substances?

Yes. Under 21 CFR Part 1311, DEA requires two of three factors to sign a controlled substance prescription: a knowledge factor, a hard token kept separate from the computer, or a biometric. Prescribers must also complete identity proofing, and two authorized people must approve their access. A standard MFA tool rarely meets all of these by itself, so check your EPCS workflow against the full rule.