Physicians demanding shared ED workstation login
IA-1 policy backs nursing leadership: tap-and-go with unique badges replaces shared passwords while meeting speed-to-care needs.
Identification and Authentication Policy and Procedures
High Risk
Moderate
Medium Cost
IA-1 requires identification and authentication policy and procedures addressing purpose, scope, roles, management commitment, coordination, and compliance, plus procedures to implement the IA family. Healthcare IA-1 sets enterprise rules for unique user IDs, MFA to EHR/VPN/cloud, shared account prohibitions, and authenticator lifecycle so only verified workforce and services reach ePHI.
Control Objective
Define and maintain policy and procedures that ensure users, devices, and services are uniquely identified and strongly authenticated before accessing ePHI systems.
Implementation Guidance
- Publish IA-1 policy covering workforce, privileged users, patients/proxies (as applicable), devices, and service accounts.
- Require unique IDs; forbid shared clinical logins except documented break-glass with accountability.
- Mandate MFA for remote access and for EHR/admin access commensurate with risk.
- Define authenticator standards (password length/rotation alternatives, phishing-resistant MFA where feasible).
- Assign IdP/IAM ownership and clinical exception processes.
- Address identity proofing for remote hires and BA users.
- Review policy annually and after IdP or EHR auth model changes.
- Align with IA-2, IA-4, IA-5, and AC emergency access procedures.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Vendor remote support
Procedure requires named vendor identities federated or JIT with MFA — not a standing “vendor” password on the EHR jump host.
Password spray against patient portal
Policy update strengthens portal authenticators and lockout/review procedures under IA-1 governance.
Best Practices
- MFA for remote and privileged ePHI access.
- Unique IDs enterprise-wide.
- Documented emergency authentication path.
- Service account inventory and ownership.
- Phishing-resistant MFA roadmap for admins.
- Clinical UX solutions (badge, proximity) that preserve uniqueness.
Common Gaps & Violations
- Shared nursing or ambulatory logins.
- MFA only on email, not EHR/VPN.
- Service accounts with interactive login and weak passwords.
- No identity proofing for remote contractors.
- Policy not updated after moving to cloud IdP.
Required Documentation
- Identification and authentication policy (IA-1)
- Authenticator and MFA procedures
- Exception / break-glass identity procedures
- Roles for IAM administration
- Policy review records
How to Test & Validate
- Review IA-1 policy for MFA and unique ID requirements.
- Sample EHR users for unique accounts (no generics).
- Verify MFA enforcement on VPN and privileged paths.
- Inspect service account controls against policy.
- Confirm emergency access authentication is documented.
Audit Considerations
HIPAA unique user identification and emergency access map directly to IA governance. Shared accounts remain a classic, high-visibility finding.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.312(a)(2)(i) Unique User Identification — assign a unique name and/or number for identifying and tracking user identity.
- 164.312(a)(2)(ii) Emergency Access Procedure — obtain necessary ePHI during an emergency.
- 164.312(d) Person or Entity Authentication — verify that a person or entity seeking access is the one claimed.
- 164.316 Policies and procedures — document IA policy and procedures.
Compliance Tips
- Fund clinical-friendly MFA (badge/FIDO) so policy is enforceable at the bedside.
- Inventory shared accounts monthly until zero.
- Put IA-1 requirements in BA remote access exhibits.
Frequently Asked Questions
Does HIPAA require MFA explicitly?
Not by name, but authentication must be reasonable and appropriate; MFA is expected for remote and high-risk ePHI access in modern risk analyses.
Are patient portal passwords under IA-1?
Yes when your systems authenticate individuals to ePHI — include consumer identity standards in policy scope.
How are break-glass accounts handled?
Allow under strict procedure with unique accountability, monitoring, and post-event review — not standing shared passwords.
References & Resources
- NIST SP 800-53 Rev. 5 — IA-1
- NIST SP 800-63
- HIPAA § 164.312(a), (d)
- Related controls: IA-2, IA-4, IA-5, AC-2, AC-7
Related Guidelines
Related controls that commonly accompany IA-1.
Need Help Implementing IA-1?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.