Search for "HIPAA MFA requirement" today and much of the first page will tell you that multi factor authentication became mandatory for healthcare organisations in 2026. It did not. As of October 2026, the update to the HIPAA Security Rule that would make MFA explicit is still a proposal. That does not mean you can wait, and the reasons why matter as much as the legal status.
Where the rule stands
The US Department of Health and Human Services (HHS) published a Notice of Proposed Rulemaking, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, in the Federal Register on 6 January 2025 (90 FR 898, RIN 0945-AA22). The public comment period closed on 7 March 2025.
As of October 2026 no final rule has been published, and the expected timing in HHS's regulatory agenda has already slipped. Until a final rule is published, the current Security Rule is the one that applies. Check the Unified Agenda entry for RIN 0945-AA22 for the latest timing HHS expects.
What the proposal would change
The proposed rule is the most significant rewrite of the Security Rule since it was first written. For authentication, the headline changes are:
- MFA becomes explicit. Regulated entities would have to deploy multi factor authentication for all users of any technology asset that creates, receives, maintains or transmits ePHI, with limited exceptions.
- "Addressable" goes away. The proposal removes the distinction between required and addressable implementation specifications, so security controls could no longer be set aside with a documented rationale.
- More documentation and testing, including a written technology asset inventory and network map, and regular review and testing of security controls.
Under the proposal, the final rule would take effect 60 days after publication, with compliance required 180 days after that: roughly eight months from publication to enforcement.
What applies today
The current Security Rule does not name MFA. It does require covered entities and business associates to implement access controls and to verify that a person seeking access to ePHI is who they claim to be (person or entity authentication, §164.312(d)). It also requires a risk analysis that addresses reasonably anticipated threats.
In 2026, credential theft is about as reasonably anticipated as a threat gets. A risk analysis that finds password-only remote access to ePHI and leaves it in place is hard to defend to the HHS Office for Civil Rights after a breach, whatever the proposed rule says.
The breach that shaped the proposal
In February 2024, ransomware attackers got into Change Healthcare, a UnitedHealth Group subsidiary that processes a huge share of US medical claims. UnitedHealth told the US Congress that the attackers used compromised credentials on a remote access portal that did not have MFA enabled. Claims processing across the country was disrupted for weeks, and UnitedHealth later put the number of people whose data was affected at about 192.7 million, the largest healthcare data breach on record.
One login with a password and no second factor. That is the scenario the proposed MFA requirement is written to prevent.
How to prepare now
Inventory every path to ePHI
EHR logins, remote access portals, Windows servers reached over Remote Desktop, Linux database hosts reached over SSH, and administrator consoles. The proposed rule's asset inventory requirement makes this list mandatory anyway.
Start with remote and privileged access
Remote access portals and administrator accounts are where Change Healthcare-style attacks begin. Cover them first, then extend MFA to every user.
Choose MFA clinicians will accept
Clinical staff sign in on shared workstations many times a shift. MFA that adds a code or a tap to every login gets worked around. Spriv's adaptive MFA verifies a known workstation and the user's phone in the background, out-of-band, so routine logins clear in about 175 milliseconds without interrupting care, while unusual logins are challenged. Spriv transfers no personally identifiable information, so no patient or staff PII passes through the authentication service.
Plan for the hard cases
Phones left at home, no reception in the basement imaging suite, staff who share devices. Spriv supports TOTP for offline use, SMS for staff without a smartphone app, and lets administrators postpone the second factor for up to 72 hours for a genuine short-term problem.
For a deeper look at the current requirements, read HIPAA two factor authentication and the MFA compliance guide.
This post describes the regulatory status as of October 2026 and is not legal advice. Confirm current requirements with your compliance counsel.