One-page guide / HIPAA

MFA, Conditional Access, and Identity Security for Healthcare

Harris Ejiofor, CISM – CyberShield Advisory

Stolen passwords are one of the easiest ways into a practice's email and patient data. A one-page guide to MFA, Conditional Access and the identity basics that matter most.

Why identity matters

In most healthcare organizations, patient information now sits behind a sign-in screen: email, the health record, billing portals, file storage. If someone gets a staff member's username and password, they may be able to walk straight in. Phishing emails, reused passwords and fake sign-in pages make that more common than many owners expect.

Protecting identities is therefore one of the most practical ways to protect patient information.

Multi-factor authentication (MFA)

MFA asks for something more than a password, such as an app prompt, a code or a security key. Even if a password is stolen, MFA makes it much harder for an attacker to use it.

Turn on MFA for every account that can reach patient information or email, not only for executives.
Start with administrator accounts and remote access.
Prefer authenticator apps or security keys over text messages where you can. CISA describes phishing-resistant methods, such as security keys, as the strongest option.
Teach staff to reject MFA prompts they did not start, and to report them.

Conditional Access

MFA answers "is this really the user?" Conditional Access adds "should this sign-in be allowed right now?" In Microsoft 365, Conditional Access policies can consider factors such as the user's location, the device they are using, and how risky the sign-in looks, and then allow, block or ask for more proof.

Common starting policies include requiring MFA for all users, blocking older sign-in methods that cannot use MFA, and limiting administrator sign-ins to trusted devices. Conditional Access requires Microsoft Entra ID P1 or higher. Organizations without it can still use Microsoft's security defaults, which turn on baseline protections such as MFA.

Identity basics that support both

Unique accounts. Everyone signs in as themselves; no shared logins to systems with patient data.
Fast offboarding. Disable accounts the day someone leaves, including in vendor-managed systems.
Least privilege. Give people only the access their role needs, and keep administrator accounts separate and few.
Review. Check sign-in activity and access lists regularly.

How this connects to HIPAA

The HIPAA Security Rule expects you to verify that people are who they claim to be before they access electronic patient information, to give each user a unique identity, and to control access. MFA and Conditional Access are common ways to meet those expectations, and your risk analysis should explain how you handle them.

Take the next step

Our free HIPAA security assessment gives you a quick, private view of where your safeguards for patient information may have gaps. A limited assessment like this cannot establish complete HIPAA compliance, but it shows you where to start.