OCR Guidance Underscores Importance of Authentication under HIPAA

McDermott Will & Emery

In its tenth OCR Cyber Awareness Newsletter of the year (Newsletter), the Office for Civil Rights (OCR) reminded HIPAA-covered entities and business associates of the importance of selecting an appropriate authentication method to protect electronic protected health information (ePHI). Authentication is the process used to “verify whether someone or something is who or what it purports to be and keeps unauthorized people or programs from gaining access to information.” The Newsletter notes that the health care sector has been a significant target of cybercrime and that some incidents result from weak authentication methods.

Authentication methods can consist of one or more factors and are often described as: (1) something you know, such as a password; (2) something you are, such as a fingerprint; or (3) something you have, such as a mobile device or smart card. Single-factor authentication requires use of only one of the methods. Multifactor authentication requires use of two or more methods (for example, a password prompt followed by an additional prompt to a mobile device).

The selection of an authentication method should be tied to the results of a covered entity’s or business associate’s required security risk assessment, which can uncover “the vulnerabilities of current authentication methods, the threats that can exploit the weakness, the likelihood of a breach occurring. . . .” Based on the probability of potential risks and vulnerabilities to the ePHI, business associates and covered entities should select a form of authentication that is “reasonable and appropriate” for the size, complexity, technical infrastructure, hardware and software capabilities of the organization.

OCR’s Cyber Awareness Newsletter was launched in February 2016 in order “to assist the regulated community to become more knowledgeable about the various security threats and vulnerabilities that currently exist in the healthcare sector, to understand what security measures can be taken to decrease the possibility of being exposed by these threats; and how to reduce breaches of ePHI.” Past issues of the Newsletter are available on the OCR website and have covered various security topics, including ransomware, malware and medical devices, business associate preparedness for a security incident, vulnerabilities in third-party application software, inter-organizational information sharing, and file transfer protocol vulnerabilities.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© McDermott Will & Emery | Attorney Advertising

Written by:

McDermott Will & Emery

McDermott Will & Emery on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.