MFA Is Now Mandatory: What the 2026 Security Rule Means in Practice
For two decades, practices avoided controls by documenting why they were not reasonable and appropriate. The proposed 2026 Security Rule removes that option, and MFA is the first place most practices will feel it.
What 'addressable' actually meant
Addressable never meant optional. It meant you could implement an equivalent alternative or document why the specification was not reasonable and appropriate for your environment. In practice, most small practices skipped the control and skipped the documentation too — which is how OCR ends up citing them for both the missing safeguard and the missing analysis.
What changes under the NPRM
The proposed rule removes the required/addressable distinction entirely. Every implementation specification becomes required, with narrow, specific exceptions. For most medical practices the practical impact concentrates in a handful of controls.
- →Multi-factor authentication on all accounts that can reach ePHI
- →Encryption of ePHI at rest and in transit, without exception
- →A maintained technology asset inventory and network map
- →Network segmentation separating ePHI systems
- →Annual penetration testing and six-monthly vulnerability scanning
Where MFA has to reach
The scope is wider than most practices assume. It is not just remote access. Any account that can reach ePHI is in scope, and administrative accounts are the ones attackers want most.
- →Remote access, VPN, and any remote desktop gateway
- →Email, which is both an ePHI store and the route to password resets
- →The EHR and practice management system, including vendor support accounts
- →Cloud administrative consoles and the backup platform
- →Domain and local administrator accounts
The clinical workflow objection, honestly addressed
The real objection is not philosophical, it is that a clinician moving between exam rooms cannot re-authenticate twenty times an hour. That is a legitimate constraint and it has legitimate answers: badge-tap proximity authentication with a short re-auth window, trusted-device policies that step up only on anomalies, and session persistence tuned to actual room-to-room movement. What is not an answer is a shared login on a shared workstation.
A rollout order that does not break the practice
Do not enable MFA everywhere on a Monday morning. Sequence it so that failures happen where the blast radius is small.
- →Week 1: administrators and IT accounts, where the population is small and technical
- →Week 2: remote access, since the workflow already tolerates a login step
- →Weeks 3-4: email for all staff, with enrolment support at the front desk
- →Weeks 5-8: EHR and clinical systems, piloted with one willing provider first
- →Throughout: keep a documented break-glass account, stored securely and monitored
What to keep as evidence
Turning MFA on is half the work. The other half is being able to prove it. Keep an enrolment report showing coverage against your full user list, the policy that mandates it, and the exception register for any account that genuinely cannot use it, with its compensating control. That package is what an auditor accepts; a screenshot of a settings toggle is not.
Key takeaways
- 1.Addressable never meant optional, and after the NPRM it will not exist at all
- 2.MFA scope includes email, the EHR, backups, and vendor support accounts
- 3.Badge-tap and trusted-device policies answer the clinical workflow objection
- 4.Coverage reports against a full user list are the evidence, not settings screenshots