Identity Controls for HIPAA

HIPAA's Security Rule requires safeguards for electronic protected health information (ePHI), and its access-related standards are about identity: who can reach ePHI, how they are authenticated, and how access is controlled in fast-moving clinical settings.

What HIPAA expects of identity

The Security Rule's technical safeguards include:

Access control: unique user identification, emergency access procedure, automatic logoff, and encryption.
Person or entity authentication: verify that a user is who they claim to be.
Audit controls: record and examine access to systems with ePHI.

What good looks like

Unique identities for every clinician and staff member, no shared logins, with MFA for remote and privileged access.
Fast, secure authentication suited to clinical workflows, where badge tap-and-go and passwordless reduce friction on shared workstations. This is why healthcare-specific access vendors exist.
Role-based access to ePHI with periodic access reviews, and prompt deprovisioning of leavers.
Emergency (break-glass) access that is controlled, logged, and reviewed.

Common pitfalls

Shared workstation logins that break unique-user attribution.
Standing broad access to ePHI without review, a common audit finding.
Break-glass access that is neither logged nor reviewed after use.

Healthcare vertical guide, IAM audit preparation. Vendors: IGA, MFA.

The audit-controls requirement is the architecture driver

Of HIPAA's technical safeguards, audit controls shape systems the most, because "who viewed this record and why" has to be answerable years later. That means access to ePHI needs attribution to a unique human at the moment of access, retained, and searchable.

Everything that breaks attribution breaks the control: shared workstation sessions left open, generic clinical logins, and application-level service accounts that read records on a user's behalf without carrying the user's identity through. That last one is the subtle case and the one most often missed in integration design.

Clinical workflow is the real constraint

Security controls that add seconds to a workflow repeated hundreds of times a shift do not survive, and clinicians will route around them. This is why badge tap-and-go and passwordless approaches specifically designed for shared workstations exist as a healthcare category, rather than being a generic MFA deployment.

Design for the shift, not for the audit: fast re-authentication on a shared terminal, automatic session termination that does not lose clinical context, and a break-glass path that a clinician can actually use in an emergency and that generates a reviewed record afterwards. See break-glass.

What incidents actually look like

Healthcare breaches in 2026 continued to run through identity rather than through exotic exploitation. The August 2026 McKesson incident began with voice phishing against employees from a lookalike domain, yielded Okta credentials, and used the resulting single sign-on session to reach Salesforce and Snowflake.

The controls that would have changed that outcome are the ones HIPAA already implies: phishing-resistant MFA so a relayed code is worthless, a help desk verification procedure that does not rely on caller-supplied facts, and step-up authentication on bulk data access.