HIPAA
Health Insurance Portability and Accountability Act
HIPAA sets U.S. national standards for protecting individuals' health information. Its Privacy Rule governs use and disclosure of protected health information, and its Security Rule requires administrative, physical, and technical safeguards for electronic protected health information (ePHI). On January 6, 2025 HHS proposed an update to the Security Rule (90 FR 898, RIN 0945-AA22), which would require multi-factor authentication, remove the distinction between required and addressable implementation specifications, and set fixed access termination clocks. Comments closed on March 7, 2025; the proposal is not final, and the current Unified Agenda lists it as a long-term action with final action projected for July 2027.
Who it applies to
Covered entities such as health plans, health care clearinghouses, and most health care providers, along with their business associates that handle ePHI on their behalf.
Identity requirements
- Implement procedures to verify that a person or entity seeking access to ePHI is the one claimed (person or entity authentication)
- Establish technical policies that allow access to ePHI only to authorized persons or software, including unique user identification
- Implement audit controls to record and examine activity in systems that contain or use ePHI
- Apply administrative safeguards including workforce access authorization, supervision, and termination procedures
- Conduct an accurate and thorough risk analysis of threats to ePHI and manage identified risks
- Provide automatic logoff and, where reasonable and appropriate, encryption to protect ePHI access
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Authentication & MFA | Entities must verify the identity of anyone seeking access to ePHI, driving strong authentication on clinical and administrative systems. |
| Identity governance (IGA) | Access to ePHI must be limited to authorized users via documented authorization, review, and termination procedures. |
| Privileged access (PAM) | Administrative and technical safeguards require tight control over elevated access to systems holding ePHI. |
| Audit, logging & accountability | Audit controls must record and allow examination of activity in systems that contain or use ePHI. |
| Breach notification | The Breach Notification Rule requires notifying affected individuals, HHS, and sometimes the media after a breach of unsecured PHI. |
Penalties
Civil monetary penalties are tiered by culpability and can reach into the millions of dollars per violation category per year, with potential criminal penalties for knowing misuse of PHI.
Status and dates last verified against primary sources on 2026-11-05.
HIPAA: frequently asked questions
- Does HIPAA require multi-factor authentication?
- The current Security Rule does not name MFA explicitly, but it requires person or entity authentication and access controls, and a risk analysis will often make MFA the reasonable and appropriate safeguard for ePHI. The January 2025 proposed update (90 FR 898) would make MFA an explicit requirement for all technology assets in relevant electronic information systems, with limited exceptions; it is not yet final.
- Who enforces HIPAA?
- The HHS Office for Civil Rights (OCR) investigates complaints, conducts audits, and imposes penalties for HIPAA Privacy, Security, and Breach Notification Rule violations.
- Are business associates directly liable under HIPAA?
- Yes. Since the HITECH Act and Omnibus Rule, business associates are directly liable for compliance with applicable HIPAA Security Rule and certain Privacy Rule requirements.
- What would the proposed 2025 HIPAA Security Rule update change for identity?
- The notice of proposed rulemaking published on January 6, 2025 (90 FR 898) would require multi-factor authentication for access to relevant electronic information systems and for any action that changes a user's privileges, with exceptions for assets that cannot support MFA (subject to a migration plan), emergencies, and certain FDA-authorized devices. It would require ending a departing workforce member's access within one hour, notifying other regulated entities within 24 hours of a change or termination of access, and make all implementation specifications required with limited exceptions. HHS proposed a compliance date 180 days after a final rule takes effect. As of November 5, 2026 the rule is not final: reginfo.gov's current Unified Agenda lists it as a long-term action with final action projected for July 2027.