{"id":50053,"date":"2019-02-20T00:00:00","date_gmt":"2019-02-20T00:00:00","guid":{"rendered":"https:\/\/www.techopedia.com\/two-factor-authentication-a-top-priority-for-hipaa-compliance\/"},"modified":"2023-08-25T13:57:46","modified_gmt":"2023-08-25T13:57:46","slug":"two-factor-authentication-a-top-priority-for-hipaa-compliance","status":"publish","type":"post","link":"https:\/\/www.techopedia.com\/two-factor-authentication-a-top-priority-for-hipaa-compliance\/2\/33761","title":{"rendered":"Two-Factor Authentication: A Top Priority for HIPAA Compliance"},"content":{"rendered":"
The traditional login process with a username<\/a> and password<\/a> is insufficient in an increasingly hostile healthcare data environment. Two-factor authentication<\/a> (2FA) has become increasingly important. While the technology is not mandatory under HIPAA<\/a>, HIPAA Journal noted that it is a smart way to go from a compliance perspective \u2013 actually calling the method<\/a> “the best way to comply with the HIPAA password requirements.” (To learn more about 2FA, see The Basics of Two-Factor Authentication<\/a>.)<\/p>\n An interesting thing about 2FA (sometimes expanded into multi-factor authentication<\/a>, MFA) is that it is in place at many healthcare organizations \u2013 but for other forms of compliance, including the Drug Enforcement Administration’s Electronic Prescription for Controlled Substances Rules<\/a> and the Payment Card Industry Data Security Standard<\/a> (PCI DSS). The former is the basic guidelines to be used in prescribing any controlled substances electronically \u2013 a set of rules that is parallel to the HIPAA Security Rule in specifically addressing technological safeguards to protect patient information. The latter is actually a payment card industry regulation that governs how any data associated with card payments must be protected to avoid fines from major credit card companies.<\/p>\n The EU’s General Data Protection Regulation<\/a> draws the concern with 2FA into even greater focus throughout the industry, given its additional oversight and fines (and its applicability to any organization that handles European individuals’ personal data).<\/p>\n Two-factor authentication has been recommended by the HHS Department’s Office for Civil Rights (OCR) for many years. In 2006, the HHS was already recommending 2FA as a best practice for HIPAA compliance<\/a>, naming it as the first method to address the risk of password theft which could, in turn, lead to the unauthorized viewing of ePHI. In a December 2006 document, HIPAA Security Guidance<\/a>, the HHS suggested that the password theft risk is addressed with two key strategies: 2FA, along with the implementation of a technical process for the creation of unique usernames and authentication<\/a> of remote employee access.<\/p>\n The Office of the National Coordinator for Health Information Technology (ONC) has shown its specific concern with this technology through its “ONC Data Brief 32” from November 2015, which covered adoption trends of 2FA by acute-care hospitals around the country. The report was on how many of these institutions had the capability for 2FA (i.e., the capability<\/em> for the user to adopt it, as opposed to a requirement<\/em> for it). At that point, in 2014, it certainly made sense that the regulators were pushing it, given that less than half the study group had it implemented, although with numbers rising:<\/p>\n \u25cf 2010 \u2013 32%<\/p>\n \u25cf 2011 \u2013 35%<\/p>\n \u25cf 2012 \u2013 40%<\/p>\n \u25cf 2013 \u2013 44%<\/p>\n \u25cf 2014 \u2013 49%<\/p>\n Certainly, 2FA has been more widely adopted since that point \u2013 but it is not ubiquitous.<\/p>\n Another aspect that is important to note is the need for paperwork \u2013 which is critical if you end up getting investigated by federal auditors while also fulfilling risk analysis<\/a> requirements, provided that you include that discussion. Documentation is necessary since the password rules are listed as addressable<\/em> \u2013 meaning (as ridiculous as it may sound) to provide documented reasoning for using this best practice. In other words, you do not have to implement 2FA but must explain why if you do.<\/p>\n One of the biggest challenges with 2FA is that it is inherently inefficient since it adds a step to a process. Actually, though, the concern that 2FA slows healthcare down has been allayed, to a great deal, by the surge of single sign-on<\/a> and LDAP<\/a> integration functions for integrated authentication between healthcare systems.<\/p>\n As noted in the header, 2FA software itself does not (humorously enough, since it’s so critical to compliance) need to be HIPAA-compliant since it transmits PINs<\/a> but not PHI<\/a>. While you can choose alternatives in lieu of two-factor authentication, top divergent strategies \u2013 password management tools<\/a> and policies of frequent password changes \u2013 are not as easy a way to comply with HIPAA password requirements. “Effectively,” noted HIPAA Journal, “Covered Entities never need to change a password again” if they implement 2FA. (For more on authentication, check out How Big Data Can Secure User Authentication<\/a>.)<\/p>\n The importance of using strong and experienced hosting and managed service providers<\/a> is underscored by the need to go beyond 2FA with a comprehensive compliant posture. That’s because 2FA is far from infallible; ways that hackers<\/a> can get around it include the following<\/a>:<\/p>\n \u25cf Push-to-accept malware<\/a> that pummels users with \u201cAccept\u201d messages until they finally click it in frustration<\/p>\n \u25cf SMS one-time password scraping programs<\/p>\n \u25cf SIM card fraud<\/a> via social engineering<\/a> to port phone numbers<\/p>\n \u25cf Leveraging mobile carrier networks for voice and SMS interception<\/p>\n \u25cf Efforts that convince users to click bogus links or log into phishing<\/a> sites \u2013 handing over their login details directly<\/p>\n2FA Long Trusted by Federal Regulators<\/span><\/h2>\n
Study: Two-Factor Authentication Underused for HIPAA<\/span><\/h2>\n
2FA Documentation IS Required<\/span><\/h2>\n
2FA Software Does Not Itself Need HIPAA Compliance<\/span><\/h2>\n
HIPAA Objective: Ongoing Risk Mitigation<\/span><\/h2>\n