Ethics & Law · single question
Which of the following best protects patient privacy under HIPAA?
Show answer and explanation
Correct answer: B. Multiple factor authentication for password
Under the HIPAA Security Rule, multi-factor authentication (MFA) is recognized as an important technical safeguard for protecting electronic protected health information (ePHI). MFA requires users to verify identity through two or more factors (something you know, something you have, something you are). While password changes can help, MFA provides significantly stronger protection. Sharing passwords — even with trusted employees — violates the principle of unique user identification required by HIPAA.
- A. INCORRECT. Sharing passwords — even with trusted employees — violates HIPAA's requirement for unique user IDs. Each workforce member must have their own unique credentials to ensure audit trails and accountability.
- B. CORRECT. Multi-factor authentication (MFA) provides the strongest protection for ePHI under HIPAA. It ensures that even if a password is compromised, an additional verification step prevents unauthorized access.
- C. INCORRECT. Changing passwords every 60 days is an older recommendation that is actually being revised in modern cybersecurity guidelines (NIST now recommends against forced periodic changes unless compromise is suspected). It provides less protection than MFA.