Remote clinician without MFA
A telehealth nurse logged into cloud EHR with password only from home. Credential stuffing succeeded. IA-2 remediation enforces IdP MFA for all EHR apps; the same password alone no longer grants access.
Identification and Authentication (Organizational Users)
High Risk
Moderate
Medium Cost
IA-2 requires the information system to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users). Unique identity plus strong authentication is the foundation of HIPAA person or entity authentication and of every access, audit, and accountability control that follows.
Control Objective
Ensure every workforce member (and their automated processes) is uniquely known and strongly authenticated before accessing systems that create, receive, maintain, or transmit ePHI.
Implementation Guidance
- Require unique user IDs for all workforce access — ban shared clinical logins except tightly controlled break-glass with monitoring.
- Enforce MFA for remote access, privileged admin, and cloud EHR/IdP apps that hold ePHI; expand MFA to local high-risk apps as risk analysis supports.
- Centralize identity in an IdP/SSO where possible so authentication policy is consistent across EHR, email, VPN, and SaaS.
- Align authenticator strength to risk: phishing-resistant options (FIDO2/passkeys, hardware keys) for admins; app/push or OTP for standard clinical remote access.
- Disable local accounts that bypass SSO unless required and inventoried.
- Bind service/process identities to unique machine or workload identities — not borrowed user passwords.
- Log authentication success/failure with user, source, and application; feed AC-7 lockout and AU monitoring.
- Re-test authentication after EHR upgrades and IdP changes.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Shared 'nurse station' EHR login
Night shift used one username for speed. Chart edits were not attributable. IA-2 drives unique badges/IDs plus proximity tap, restoring accountability for HIPAA audit controls.
Domain admin using password-only RDP
IT admins hit a jump host with a reused password. IA-2 requires separate admin accounts and phishing-resistant MFA before privileged sessions start.
Best Practices
- Prefer SSO + MFA over per-app passwords.
- Use phishing-resistant MFA for privileged roles.
- Eliminate shared accounts in clinical workflows.
- Separate standard and admin identities.
- Monitor authentication anomalies (impossible travel, new device).
- Pair IA-2 with AC-7 lockout and AC-2 account lifecycle.
Common Gaps & Violations
- Shared departmental EHR passwords.
- MFA only on VPN while cloud EHR allows password-only.
- Privileged users authenticating with SMS OTP only on high-risk paths without compensating controls.
- Service accounts using interactive user passwords.
- Local break-glass accounts undocumented and MFA-exempt forever.
Required Documentation
- Identification and authentication policy
- MFA / authenticator standard by access type
- IdP/SSO configuration evidence
- Shared/break-glass account inventory
- Authentication logging and monitoring procedures
How to Test & Validate
- Attempt EHR/VPN access with password only where MFA is required; confirm deny.
- Verify unique IDs in a sample of clinical users (no shared logins).
- Confirm privileged admin path requires stronger MFA.
- Review IdP sign-in logs for MFA challenges and failures.
- Validate service accounts are non-interactive where required.
Audit Considerations
Auditors sample live logons and ask how users are uniquely identified. Shared clinical passwords and MFA gaps on remote EHR are common HIPAA findings mapped to IA-2.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.312(d) Person or Entity Authentication — verify persons or entities seeking access are who they claim to be.
- 164.312(a)(2)(i) Unique User Identification — assign unique names/numbers for identifying and tracking user identity.
- 164.312(a)(1) Access Control — authentication enables technical access limitation.
- 164.308(a)(5)(ii)(D) Password Management — procedures for creating, changing, and safeguarding passwords support IA-2 authenticators.
Compliance Tips
- Treat cloud EHR browser access as in-scope for MFA even without VPN.
- Roll MFA to admins and remote users first, then remaining workforce.
- Document any MFA exceptions with risk acceptance and expiry.
Frequently Asked Questions
Does IA-2 require MFA for every local workstation logon?
IA-2 requires unique identification and authentication; MFA strength should follow risk and baseline overlays. Remote and privileged ePHI access are the usual first mandates.
How is IA-2 different from IA-8?
IA-2 covers organizational users (workforce). IA-8 covers non-organizational users such as patients, partners, or external providers authenticating to your systems.
Are biometric badge taps enough?
They can support unique identification if bound to a person and combined with an authenticator policy your risk analysis accepts — document the assurance level.
References & Resources
- NIST SP 800-53 Rev. 5 — IA-2
- NIST SP 800-63B Digital Identity Guidelines
- HIPAA §§ 164.312(a), 164.312(d)
- Related controls: IA-4, IA-5, IA-8, AC-7, AC-2
Related Guidelines
Related controls that commonly accompany IA-2.
Need Help Implementing IA-2?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.