authentication Controls

Multi-factor authentication is required for all user accounts

Strong password policies are enforced at the identity provider, including breached-password checks

Authenticate users, processes, and devices before granting access

Implement technical policies and procedures to allow access to ePHI only to authorized persons or software programs

Implement procedures to verify that a person or entity seeking access to ePHI is who they claim to be

Identities are proofed and bound to credentials based on the context of interactions

Users, services, and hardware are authenticated

Logical access security measures restrict access to assets