Identity for Healthcare

The job identity does in healthcare

Healthcare identity has to reconcile two things that fight each other: strict control over electronic protected health information (ePHI), and clinicians who cannot wait twenty seconds to log in while a patient is in front of them. The result is a domain with unusual access patterns, shared workstations, roaming staff and rapid context switching, plus a hard requirement that every access still maps to a unique, accountable individual.

It also spans more than clinicians: administrative staff, billing and clearinghouse partners, third-party providers, patients on portals and apps, and the machine identities of connected equipment all need governed access.

Healthcare accounts for 4 of the 123 incidents in the Identity Breach Database (3.3%), but by people affected it is the largest sector in the record: the two incidents that report a count reached about 199.6 million records between them. All 4 failed at authentication, and MFA was absent on the abused accounts in 2 of them; the other 2 have not said.

The identity threat picture, from the incident record

One remote access portal without MFA. On 12 February 2024 attackers used compromised credentials to log into a Change Healthcare Citrix remote access portal that did not have MFA, moved laterally, took data and deployed ransomware on 21 February. The outage disrupted claims and pharmacy payments across the US for weeks. Change Healthcare's updated filing with HHS OCR counted about 192.7 million individuals, and UnitedHealth's 2024 10-K reported $2.2 billion of direct response costs plus $867 million of estimated business disruption for 2024 alone. CEO Andrew Witty confirmed the missing MFA in written testimony to Congress.

Reused passwords and a feature that multiplied them. Between April and September 2023 attackers stuffed reused passwords into about 14,000 23andMe accounts. Through the DNA Relatives feature those accounts exposed profile data on about 6.9 million other users. The UK ICO fined 23andMe £2.31 million in June 2025, citing the lack of mandatory MFA and of extra verification before raw genetic data could be downloaded. See credential stuffing.

Employee accounts at a distributor. McKesson said that on 25 August 2026 it became aware of a cybersecurity incident targeting employee corporate accounts and involving third-party applications, with unauthorized access and exfiltration of data between 20 and 25 August; it reported the incident in an SEC Form 8-K on 28 August. ShinyHunters claims it voice-phished employees into their Okta single sign-on accounts and used them to reach Salesforce and Snowflake; McKesson has not confirmed that chain, and the 6.4 million email addresses Have I Been Pwned counted in the leak are not a McKesson figure. See the incident record.

Vishing a device maker. Dexcom said on 10 October 2026 that targeted vishing led to unauthorized access to limited information in internal documents, with no impact on products or operations. It has not said how many people are affected. See vishing and help desk social engineering.

As in insurance and financial services, the pattern is a password alone on an exposed login, or a person talked out of access.

The regulatory floor

• HIPAA Security Rule today. The technical safeguards at 45 CFR 164.312 require unique user identification and an emergency access procedure (both "Required"), automatic logoff and encryption ("Addressable"), audit controls, and person or entity authentication: procedures "to verify that a person or entity seeking access to electronic protected health information is the one claimed." The current rule does not name MFA. See HIPAA and identity controls for HIPAA.
• The proposed update. HHS published a notice of proposed rulemaking on 6 January 2025 (90 FR 898; comments closed 7 March 2025). It would remove the distinction between required and addressable specifications and require regulated entities to "deploy multi-factor authentication to all technology assets" in relevant systems. As of 5 November 2026 the only Federal Register document under RIN 0945-AA22 is the proposal, and the Fall 2025 Unified Agenda moved it to long-term actions with a final action listed for July 2027. Plan for MFA anyway: the proposal itself cites a large covered entity whose CEO said it had not deployed MFA throughout its enterprise.
• E-prescribing of controlled substances (DEA EPCS). DEA's 21 CFR 1311.115 requires two of three factors to sign a controlled substance prescription; a hard token must be separate from the computer being accessed and meet at least FIPS 140-2 Security Level 1. Under 1311.105, practitioners get the credential after identity proofing at NIST SP 800-63-1 Assurance Level 3 or above, issued over two channels.
• Substance use disorder records. Programs under 42 CFR Part 2 had to comply with the 2024 final rule, which aligns consent, breach notification and penalties with HIPAA, from 16 February 2026.
• Outside the US. The NIS2 Directive covers healthcare, and GDPR treats health and genetic data as special category data. See identity controls for NIS2. California's CCPA/CPRA cybersecurity audits, which assess MFA and access controls, are first due 1 April 2028 for the largest businesses.

The identity controls that matter most

1. MFA on every externally reachable login, no legacy exceptions. Inventory VPNs, Citrix and remote desktop gateways, vendor portals and clearinghouse connections, and close any that accept a password alone. See MFA rollout and conditional access.
2. Fast, unique clinical authentication. Badge tap-and-go with a PIN, or passwordless on shared workstations, keeps attribution intact without slowing care. Shared logins break 164.312(a)(2)(i).
3. Phishing-resistant MFA and call-back verification for IT and help desk. Dexcom shows the phone is still an entry point. Phishing-resistant MFA plus verified resets removes the codes a caller asks for.
4. Patient accounts protected against stuffing. Mandatory MFA or passkeys, breached-password screening and rate limits on features that reveal other people's data were the controls the ICO named.
5. Break-glass that is controlled and reviewed. The HIPAA emergency access procedure is required; make break-glass accounts vaulted, alerting and reviewed after each use (see the incident-response runbook).
6. Role-based ePHI access with reviews and prompt deprovisioning. Access certification, deprovisioning and the access review checklist.
7. Third-party and device access as privileged access. Vendor remote support and medical device service accounts belong in PAM with session recording and time limits.

Workforce vs patient identity

Vendor shortlist

• Clinical access and EPCS signing: Imprivata.
• Workforce identity: Microsoft Entra ID or Okta; see best identity tools for healthcare and top 5 IAM for healthcare.
• Governance for ePHI access: SailPoint or Saviynt; see best compliant IGA platforms.
• Privileged and vendor access: CyberArk (Idira) or BeyondTrust.
• Patient identity: Auth0, Ping Identity or Transmit Security; see best CIAM for healthcare.
• Phishing-resistant MFA: Yubico or HYPR; compare methods in the MFA matrix.

Common pitfalls

• A single legacy remote access path left out of MFA because it "only serves one team".
• Shared workstation logins that break unique-user attribution and audit.
• Standing broad access to ePHI that is never reviewed.
• Break-glass access that is neither logged nor reviewed.

Where it is heading

Expect MFA to become an explicit HIPAA requirement if HHS finalizes the 2025 proposal, badge and passwordless authentication to keep displacing passwords at the bedside, and help desk verification to become a standard audit item as vishing keeps showing up in the record.

Frequently asked questions

Does HIPAA require MFA?

Not explicitly today. 45 CFR 164.312(d) requires person or entity authentication without naming a method. HHS proposed in January 2025 to require MFA, but the rule has not been finalized.

How did the Change Healthcare attack start?

Attackers used compromised credentials on a Citrix remote access portal that did not have MFA, on 12 February 2024, then moved laterally and deployed ransomware nine days later.

What does DEA require for EPCS?

Two of three factors (knowledge, possession, biometric) to sign controlled substance prescriptions, with any hard token separate from the computer and meeting FIPS 140-2 Level 1, after identity proofing by an approved provider.

When will the HIPAA Security Rule update be final?

No date is fixed. The Fall 2025 Unified Agenda lists the final action for July 2027 as a long-term action.