Implement Multi-Factor Authentication

[suhasramanand]

Implement multi-factor authentication for all users accessing ePHI remotely and for all privileged access.

Acceptance criteria

• Minimum two factors required from different categories
• Something you know (password)
• Something you have (token, phone)
• Something you are (biometric)

---

Source: § 2.5.1

Covered entities MUST implement multi-factor authentication for all users accessing ePHI remotely and for all privileged access.