Passwords were never a particularly strong defense. They get reused, stolen, guessed, and sold. The problem is not that people choose weak ones, though they often do; it is that a password is a single point of failure, and attackers have become extraordinarily good at exploiting them. Multi-factor authentication (MFA) exists to change that equation by requiring more than one form of verification before access is granted.

The idea is straightforward. Even if an attacker has a valid password, they cannot get in without also satisfying a second or third condition. That second condition might be a code sent to a phone, a fingerprint, a hardware key, or a push notification. The specific method means more than most organizations realize, and the gap between weak MFA and strong MFA has become one of the most consequential security distinctions in healthcare.

 

How MFA works

HealthTech notes that "As data breaches in healthcare persist, multifactor authentication could help close the security gaps, shoring up defenses and preventing breaches, alongside other cybersecurity best practices." MFA requires users to verify at least two of three distinct categories. The first is something they know, typically a password or PIN. The second is something they have, such as a mobile device, a hardware security key, or a smart card. The third is something they are, meaning a biometric factor like a fingerprint, facial scan, or voice recognition.

The authentication process works by requiring factors from more than one of these categories simultaneously. A clinician logging into a patient portal might enter a password and then approve a push notification on their phone, or enter a password and provide a fingerprint. The security benefit comes from the combination. An attacker who steals a password still needs the second factor, and vice versa.

One-time passwords (OTPs) are among the most common MFA implementations. A unique code is generated each time authentication is requested, valid for a short window, and tied to the specific user. Time-based OTP apps generate codes every 30 seconds using a seed value established during setup. SMS codes work on the same principle but deliver the code via text message rather than an app. Both are considerably more secure than a password alone, though neither is without vulnerability.

Read more: Enhancing HIPAA compliance with MFA

 

Why MFA matters in healthcare

Healthcare accounts hold more valuable information per record than almost any other target, combining clinical history, insurance details, Social Security numbers, and prescription data in a single accessible location. A compromised email account at a healthcare organization is an inbox, and often a gateway to patient records, billing systems, referral workflows, and years of protected health information.

The Verizon 2026 Data Breach Investigations Report found that stolen credentials were involved in 22% of all confirmed breaches, with 88% of web application attacks relying on them specifically. MFA addresses that vector directly by ensuring that stolen credentials alone are not enough to complete authentication. According to Paubox's 2025 Healthcare Email Security Report, only 5% of known phishing attacks in healthcare are reported by employees, which means credential-harvesting emails are reaching and succeeding against clinical staff far more often than breach reports suggest. MFA is one of the few controls that limit the damage even when a credential is compromised.

HIPAA does not explicitly mandate MFA by name. Still, the Security Rule's access control requirements, under 45 CFR 164.312(d), require covered entities to implement procedures to verify that a person seeking access to ePHI is who they claim to be. In practice, password-only authentication has become difficult to defend as a sufficient control during OCR investigations, and the proposed HIPAA Security Rule update published in December 2024 moves toward making MFA effectively mandatory for ePHI access.

Read also: HHS proposes updated HIPAA security rule

 

The limits of standard MFA

MFA is not a complete solution against modern attacks, and the distinction between different MFA methods has become critical. Push notification-based MFA, where a user receives a prompt on their phone and taps to approve, is vulnerable to what researchers call prompt bombing or MFA fatigue. The Verizon 2026 DBIR found MFA fatigue was involved in 14% of breaches it analyzed, showing how consistently attackers flood users with approval requests until one goes through under pressure or confusion.

Adversary-in-the-middle (AiTM) attacks present a more sophisticated threat. Rather than waiting for a user to approve a suspicious prompt, AiTM attacks intercept the authentication session in real time, capturing both the credential and the MFA token as the user completes a login they believe is legitimate. Microsoft specifically warned about this technique, noting that they had identified an ongoing large-scale phishing campaign using AiTM sites that stole passwords and hijacked user sign-in sessions even when MFA was enabled, with over 10,000 organizations targeted. SMS-based MFA carries additional risks through SIM swapping, where attackers convince mobile carriers to transfer a target's phone number to a new SIM, redirecting all OTP codes.

These vulnerabilities do not mean MFA is ineffective, they mean that some forms of MFA are meaningfully stronger than others.

 

Phishing-resistant MFA

CISA identifies two implementations as genuinely phishing-resistant, FIDO2/WebAuthn and PKI-based authentication using smart cards or certificate-based credentials. Both rely on public-key cryptography that binds authentication to the specific device and the specific legitimate domain. A private key never leaves the authenticator, and the cryptographic challenge is tied to the real origin, so an AiTM proxy cannot relay the authentication because the response is domain-specific. A fake login page cannot receive a valid FIDO2 response even if it perfectly mimics the real one.

NIST SP 800-63B classifies FIDO2 and PKI methods as Authentication Assurance Level 3 (AAL3), the highest defined level, and treats all other MFA methods, including push notifications, OTP apps, and SMS codes, as lower assurance levels that remain vulnerable to phishing and interception. CISA's phishing-resistant MFA guidance explicitly recommends that organizations, especially those in healthcare handling sensitive data, migrate toward FIDO2 security keys or passkeys for high-risk access scenarios.

Passkeys are the consumer-friendly implementation of FIDO2, now built into iOS, Android, Windows, and macOS. They replace passwords with a cryptographic key pair stored on the device, with biometric or PIN verification to authorize use. For healthcare organizations looking to strengthen authentication without disrupting clinical workflows, passkeys offer a practical path toward phishing-resistant authentication without requiring separate hardware tokens for every staff member.

Learn more: What is a phishing attack?

 

Adaptive and location-based MFA

Not all authentication decisions require the same level of friction. Adaptive authentication, sometimes called risk-based authentication, adjusts what it asks of a user based on contextual signals assessed at the time of login. A clinician accessing a patient record from their usual workstation during normal hours might be asked only for a fingerprint. The same account logging in from an unfamiliar country at 3 am might be asked for a hardware key or blocked pending manual review.

Location-based MFA is a related concept, using IP address and geographic data to flag logins that fall outside normal patterns. Neither approach replaces strong authentication for high-risk access, but both reduce the friction burden on staff during routine workflows while concentrating security requirements where the risk actually is.

 

MFA and email security in healthcare

Email is where most healthcare credential theft begins, phishing campaigns deliver credential-harvesting pages that capture usernames and passwords, and the MFA tokens are generated immediately after, through AiTM proxies that complete the authentication relay in real time. According to Paubox's 2026 Healthcare Email Security Report, phishing-driven mailbox takeovers exposed 630,000 individuals in 2025, making them the most damaging email attack type by patient data impact.

MFA on email accounts reduces the probability of a successful takeover, but it does not prevent the phishing email from reaching the inbox in the first place. Pre-delivery filtering that removes phishing attempts before clinical staff encounter them addresses the problem upstream, before any authentication decision is made. Paubox Inbound Email Security uses AI to analyze sender behavior, message intent, and contextual signals across every inbound message, catching the phishing attempts that bypass signature-based filters before they reach staff who may be working under time pressure. The combination of strong MFA on email accounts and pre-delivery filtering addresses both the credential theft risk and the delivery mechanism that enables it.

Learn more: Paubox Inbound Email Security

 

In the news

The use of a new phishing-as-a-service (PhaaS) platform called 'Tycoon 2FA' is gaining popularity among cybercriminals targeting Microsoft 365 and Gmail accounts in an attempt to bypass two-factor authentication (2FA) protection. Discovered by analysts during routine threat hunting in October 2023, the PhaaS kit has been active since at least August of that year, when it was offered through private Telegram channels by the Saad Tycoon group. Similarities with other adversary-in-the-middle platforms like Dadsec OTT suggest possible code reuse or developer collaboration between them. A newer version of Tycoon, released in 2024, is said to be more covert than its predecessor, indicating ongoing efforts toward improvement. Currently using over a thousand domains, this service has been used over a thousand times for phishing attacks.

See more: Phishing kit that bypasses MFA targets Gmail and Microsoft 365

 

FAQs

What is the difference between MFA and two-factor authentication?

Two-factor authentication (2FA) is a subset of MFA that requires exactly two verification factors. MFA is the broader category requiring two or more. In practice, the terms are often used interchangeably, but MFA can involve three or more factors for higher-security access scenarios.

 

Does MFA satisfy HIPAA requirements?

HIPAA's Security Rule requires covered entities to verify the identity of anyone accessing ePHI, and MFA is the most widely accepted method for meeting that requirement. The proposed HIPAA Security Rule update published in December 2024 moves toward making MFA explicitly mandatory. MFA alone does not satisfy all Security Rule requirements, but its absence is increasingly difficult to defend during OCR investigations into breach incidents.

 

Can MFA be integrated with existing healthcare IT systems?

Yes, MFA can be integrated with most existing healthcare IT systems, including electronic health records (EHR) systems, patient portals, and communication tools. Many modern MFA solutions are designed to be compatible with various platforms and can be customized to meet the specific needs of a healthcare organization.

 

What are the challenges of implementing MFA in healthcare, and how can they be overcome?

Challenges to implementing MFA in healthcare include user resistance, the cost of deployment, and the difficulty of integrating with existing systems. These challenges can be overcome by providing training and communicating the importance of MFA for protecting patient data, choosing scalable MFA solutions, and working with experienced vendors who offer seamless integration and support for existing healthcare IT infrastructure.

See also: HIPAA Compliant Email: The Definitive Guide