MFA and encryption for small health companies
Short answer: HIPAA's current Security Rule requires reasonable access controls and is generally interpreted to call for strong authentication. The proposed update would make MFA and encryption explicit. Small health companies can skip the wait for a final rule: turn on MFA for every account and encrypt every laptop and phone now.
Multi-factor authentication (MFA) and encryption are the two controls most likely to stop a breach and the two the proposed HIPAA Security Rule update would make explicit. As of mid-2026 the update was still a proposed rule, but there is no reason to wait. Pair these steps with the broader HIPAA IT checklist for remote-first care teams.
Does HIPAA require multi-factor authentication?
The current Security Rule requires access controls that are reasonable for your risks. In practice that usually means MFA for remote access, email and admin accounts. The proposed update would name MFA and encryption as required. Either way, turning them on now reduces breach risk.
Step 1: List every system with client data
Include your EHR, email, chat, billing, scheduling, video, cloud storage and any spreadsheet that holds client information.
Step 2: Turn on single sign-on where you can
Single sign-on lets you enforce MFA in one place and remove access quickly when someone leaves.
Step 3: Require MFA for everyone
- Use an authenticator app or security key rather than text messages where possible.
- Start with administrators and remote access, then extend to every account.
- Provide backup codes and a documented recovery process.
Step 4: Encrypt devices
- Turn on full-disk encryption on every laptop and phone.
- Enforce it through device management so staff cannot turn it off.
- Keep a record of which devices are encrypted.
Step 5: Encrypt data in transit and at rest
- Require HTTPS everywhere and approved, encrypted tools for email, video and file sharing.
- Confirm your vendors encrypt stored data and that they will sign a business associate agreement.
Step 6: Protect backups
Encrypt backups, store at least one copy separately and test restoring from them.
Step 7: Handle exceptions
Record any system that cannot support MFA or encryption, why, and what compensating control you use.
Step 8: Train and verify
- Explain to staff why MFA matters and how to use it.
- Run a quarterly report of accounts without MFA and devices without encryption.
- Record the results as evidence for your risk analysis.
Frequently asked questions
Does MFA slow staff down?
Slightly at first. Single sign-on with sensible session lengths keeps friction low.
Is encryption on a lost laptop enough to avoid breach reporting?
Properly encrypted devices are generally treated differently under breach rules, but confirm the details with counsel.
Should we wait for a final HIPAA Security Rule update?
No. MFA and encryption are good practice under the current rule. The proposed update would make them explicit, but waiting does not reduce risk today.
Where does MFA fit in a broader HIPAA IT checklist?
MFA sits with identity and access controls. Use the HIPAA IT checklist for the full control set around devices, email, vendors and monitoring.
Sources and last check
Last checked October 11, 2026. Primary sources: HHS OCR Security Rule materials and the proposed Security Rule updates in the Federal Register. MFA and encryption settings should also match your cyber insurer's questionnaire.
How Keepwell helps
Keepwell enforces MFA, device encryption and backup testing for remote-first care companies. Get an IT assessment.