HIPAA Person or Entity Authentication (45 CFR 164.312(d))
Required standard to verify that a person or entity seeking access to ePHI is the one claimed. The Security Rule is technology-neutral on the mechanism; risk analysis drives whether MFA is reasonable.
Primary source
45 CFR 164.312(d) — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312#p-164.312(d)
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
45 CFR 164.312(d)) is a one-line required standard: implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.
The Security Rule is technology-neutral — it does not name passwords, MFA, smart cards, or biometrics. The risk analysis at 164.308(a)(1)(ii)(A) drives the choice. OCR's Cybersecurity Newsletter has repeatedly recommended MFA in the context of phishing, ransomware, and remote access. NIST SP 800-66 r2 points to NIST SP 800-63B for the authoritative federal authentication framework.
A defensible baseline for a small practice: MFA on EHR, email (at the identity provider), VPN, cloud storage, and admin accounts. Phishing-resistant FIDO2/WebAuthn where supported; TOTP or push-based as the next tier; SMS only when no stronger option exists.
The HHS proposed Security Rule update would make MFA an explicit requirement for many ePHI-bearing systems. The final rule has not been published as of this entry's last_reviewed date; the current Security Rule controls until then.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Security Access Control (45 CFR 164.312(a))Technical policies and procedures for systems containing ePHI to allow access only to those granted access rights, with required specifications for unique user identification and emergency access.
- RegulationHIPAA Technical Safeguards (45 CFR 164.312)Five standards covering access control, audit controls, integrity, person or entity authentication, and transmission security for ePHI.
- RegulationNIST SP 800-63B: Digital Identity Guidelines (Authentication and Lifecycle Management)Federal authentication framework defining three Authenticator Assurance Levels (AAL1, AAL2, AAL3), authenticator types, and lifecycle requirements.
- RegulationHIPAA Audit Controls Standard (45 CFR 164.312(b))Required technical safeguard: implement hardware, software, and procedural mechanisms that record and examine activity in information systems containing ePHI.
- ComplianceHIPAA Encryption Policy Template (45 CFR § 164.312(a)(2)(iv) + (e)(2)(ii))2026 HIPAA encryption policy template — 45 CFR § 164.312(a)(2)(iv) at-rest, § 164.312(e)(2)(ii) in-transit, NIST SP 800-111 algorithms, key management.
- SRACMS Promoting Interoperability and the Security Risk Analysis AttestationHow the CMS Promoting Interoperability program (formerly Meaningful Use) requires a HIPAA Security Risk Analysis for each EHR reporting period, what the attestation actually claims, and how CMS audits it after the fact.
- GlossaryAccess ControlsTechnical policies and procedures that allow only authorized persons or software programs to access ePHI.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.