mfa Controls

Multi-factor authentication is required for all user accounts

Phishing-resistant MFA is enforced for privileged and high-value accounts

Authenticate users, processes, and devices before granting access

Implement technical policies and procedures to allow access to ePHI only to authorized persons or software programs

Implement procedures to verify that a person or entity seeking access to ePHI is who they claim to be

Identities are proofed and bound to credentials based on the context of interactions

Users, services, and hardware are authenticated

Logical access security measures restrict access to assets