Does HIPAA require MFA? – Ep 418 

We all know how important it is to keep our personal information and important data secure. MFA can add an extra layer of protection to our digital lives. But does HIPAA require MFA? The short answer: no, but yes. Listen in to hear how best to lock your cyber door against cyber attacks.

In this episode:

Does HIPAA require MFA? – Ep 418

Today’s Episode is brought to you by:

Kardon

and

HIPAA for MSPs with Security First IT

 Subscribe on Apple Podcast. Share us on Social Media. Rate us wherever you find the opportunity. 

Great idea! Share Help Me With HIPAA with one person this week!

Learn about offerings from the Kardon Club

and HIPAA for MSPs!

Thanks to our donors. We appreciate your support!

If you would like to donate to the cause you can do that at HelpMeWithHIPAA.com

Like us and leave a review on our Facebook page: www.Facebook.com/HelpMeWithHIPAA

If you see a couple of numbers on the left side you can click that and go directly to that part of the audio. Get the best of both worlds from the show notes to the audio and back!

Thanks to our donors.

HIPAA Briefs

As the June OCR newsletter makes clear, it isn’t just about whether or not it specifically states anything about MFA. It is about assessing your risk just like anything else with HIPAA.

HIPAA Say What!?!

This is commonly called the 4-factor breach assessment, and they are:

1. The nature and extent of the PHI involved, including types of identifiers, and the likelihood of re-identification
2. The unauthorized party who used the PHI or to whom the disclosure was made
3. Whether PHI was actually acquired or viewed
4. The extent to which the risk to the PHI has been mitigated

Each factor is rated as high, medium, or low risk, and then used to establish the overall risk of a HIPAA breach. If the risk assessment finds a low probability of compromise of PHI, the organization is not required to notify affected individuals. Notification is mandatory, however, when the factors lead to the conclusion that there is a medium or high risk of a breach.

Knowing how to identify PHI, where it is located, and how it flows through your organization will be vital in this assessment.

Does HIPAA require MFA?

June 2023 OCR Cybersecurity Newsletter | HHS.gov

What is MFA?

At least two of the following:

1. Something you know (e.g., password, personal identification number (PIN))
2. Something you have (e.g., smart ID card, security token)
3. Something you are (e.g., fingerprint, facial recognition, other biometric data)

That means you are not doing MFA simply by using a password AND a pin code. That solution is just using two of the same from the list above – something you know.

Everyone needs to implement MFA

You should understand what you’re implementing when you implement MFA. Often, you have a choice – email, SMS (text message) or authentication app. We do not recommend doing MFA via text message or even email really. It’s better than nothing, but it’s very easy to spoof those methods. Using an authenticator app is preferable. You should have MFA on your email, financial sites, VPN connections (or any other remote access application) and on anything that contains valuable or sensitive data.

HIPAA doesn’t specifically require MFA, but it does. Every industry guidance and best practices recommends some sort of MFA. It is well documented. So, if you aren’t doing it and an incident occurs, it’ll be much harder to defend you if you aren’t implementing MFA or some kind of compensating control.

Remember to follow us and share us on your favorite social media site. Rate us on your podcasting apps, we need your help to keep spreading the word. As always, send in your questions and ideas!

Special thanks to our sponsors Security First IT and Kardon.