Why Healthcare's MFA Push Is Working and What Comes Next

TL;DR

• The proposed HIPAA Security Rule update would make MFA mandatory across all systems accessing ePHI — the right move, and one most security leaders are already pursuing
• MFA confirms a credential is valid. It doesn't confirm the human presenting it — and that distinction is where both major healthcare breaches of the past two years were decided
• OCR's enforcement posture is increasingly focused on whether controls are implemented in practice and documented — not just whether policies exist on paper
• The cost of leaving the human moment unverified accumulates every week, long before a breach forces the conversation

For the better part of two decades, MFA sat in HIPAA's "addressable" category — meaning healthcare organizations could assess whether it was reasonable for their environment and document why they chose not to implement it. Most security leaders knew MFA was the right call. The regulatory framework just didn't require it.

That's changing. The proposed HIPAA Security Rule update, published January 2025, would make MFA mandatory across all systems accessing ePHI. The final rule hasn't published yet, but the direction is clear — and most security leaders aren't waiting for it to act.

As healthcare organizations work to implement and strengthen MFA across their environments, a practical question emerges: MFA confirms that a valid credential is being used. It doesn't confirm the human presenting it. Understanding where that distinction matters most — and how to address it — is what makes an identity security program genuinely defensible, both against attackers and in an OCR audit.

What MFA Covers

MFA is a meaningful control and the sector is right to prioritize it. Here's what it does well:

• Raises the cost of credential theft significantly. An attacker with a stolen password still needs a second factor — a device, a biometric, a token — to get in. That's a material barrier.
• Closes the entry point that brought Change Healthcare down. In February 2024, an attacker used stolen credentials on a Citrix portal with no MFA enabled. Nine days of undetected lateral movement. Ransomware deployed. 190 million Americans affected. UnitedHealth Group CEO confirmed before the House Energy and Commerce Committee that the missing MFA was the vulnerability.
• Creates an auditable access record. Every MFA event generates a log — who authenticated, when, from where, through what method. That record matters increasingly as OCR's enforcement posture shifts toward verifiable, documented controls rather than policies on paper.
• Supports the broader compliance posture the proposed rule requires. Beyond MFA, the proposed rule would mandate encryption of ePHI, semiannual vulnerability scanning, annual penetration testing, and written documentation of workforce access procedures. MFA implementation builds the operational discipline those requirements depend on.

OCR's enforcement approach in 2026 is increasingly focused on an evidence binder — documentation organized by requirement, date-stamped, showing what was implemented, when, and how risks were reduced. Healthcare organizations that have already deployed MFA broadly and documented it well are ahead of that standard.

Three Placed to Look After MFA Is in Place

MFA secures the credential. The moments it wasn't designed to fully cover are the ones worth examining as organizations strengthen their identity programs — because they're also the moments where the most significant healthcare breaches of the past two years were decided.

1. Helpdesk credential resets.

When someone calls the helpdesk claiming to be a locked-out employee, MFA has already happened — or hasn't yet. The question is what confirms the caller's identity before a reset is processed. In August 2026, McKesson was breached when attackers called employees, impersonated IT staff using the domain mckesson[.]claims, and social-engineered their way into Okta SSO credential resets. Okta worked exactly as designed. The breach happened before it was involved. Health-ISAC had warned the sector about this exact pattern one month earlier.

The control here isn't a different MFA configuration. It's requiring out-of-band identity confirmation before any reset is processed — and building a documented record of how that confirmation happened.

2. MFA re-enrollment requests.

When a workforce member claims to have lost access to their authenticator, re-enrollment is effectively a full credential reset with an additional layer of social engineering opportunity. It's one of the highest-risk moments in an identity lifecycle and one of the least examined. What confirms the person requesting re-enrollment is who they claim to be, before a new device is enrolled?

3. Privileged access approvals.

Accounts with broad SSO access — executives, IT administrators, security personnel — connect to the most systems from a single login. They're primary targets for exactly that reason. What additional verification happens before those accounts are modified or their access extended? The answer to that question, documented, is also the answer OCR wants to see in an investigation.

Across all three moments, the underlying question is the same: authentication confirms which credential is acting, verification confirms which person is. Every week those moments go unaddressed, the exposure accumulates whether or not a breach ever occurs.

The Risk Doesn't Start at the Breach

The security industry measures identity risk in breach costs — and those numbers are real. IBM's 2025 Cost of a Data Breach Report puts the average healthcare breach at $7.42 million, the highest of any industry for 14 consecutive years. Change Healthcare exceeded $3 billion in total response costs. McKesson faced a $55.2 million ransom demand before anyone outside the organization knew a breach had occurred.

But those figures represent the moment the risk became visible. The exposure was accumulating long before.

For a 15,000-employee health system, unverified identity costs roughly $150,000 a week in breach exposure, helpdesk load, and lost clinical hours — before anything breaks. That's the number Nametag's Cost of Doing Nothing research puts on the risk sitting inside the three moments described above: the credential reset that depended on an agent's judgment call, the re-enrollment request nobody verified, the privileged access approval that didn't ask who was actually on the other end.

MFA is the right foundation and the sector is right to build on it. The proposed HIPAA Security Rule formalizes what most security leaders already know to be true. The natural next question — once the credential is confirmed, what confirms the human behind it — is worth answering now, before a breach or an OCR audit makes it urgent.