MFA significantly increases the security of your organization’s accounts and systems. By requiring multiple forms of identification, you can better protect sensitive data from unauthorized access.

• Use a password plus a one-time authentication code sent to a phone or email.
• Implement a hardware security token or biometric scan as a secondary form of identification.

Tools like Google Admin Console or third-party providers offer simple setup for MFA. This is especially important for users accessing EMRs, emails, and networks.

To safeguard your network from unauthorized access, establish and enforce strong password policies:

• Password strength: Require at least 12 characters with a mix of letters, numbers, and symbols.
• Password expiration: Mandate password changes every 60–90 days.
• Training: Teach employees how to create complex passwords and avoid weak or reused passwords.

Encryption is crucial for protecting PHI stored on devices. Ensure that all devices have full-disk encryption enabled.

• BitLocker for Windows devices.
• FileVault for macOS devices.

Encryption helps keep PHI secure even if a device is lost or stolen.

Implement centralized login management to control user access, simplify account management, and improve visibility into user activity.

• Microsoft Active Directory.
• Single Sign-On, also known as SSO.

Centralized login management makes it easier to grant access, revoke access, and track user activity across critical systems.

Draft comprehensive policies that clearly define how your organization handles PHI, security responsibilities, and incident response procedures.

• Privacy: Policies for handling PHI.
• Security: Policies for protecting against breaches.
• Incident response: Steps to follow if a breach occurs.

Use NIST tools and reporting practices to identify vulnerabilities, document risks, and track improvement over time.

• Identify vulnerabilities.
• Track risks and improvements.
• Document reports to stay prepared for audits.

When sharing PHI, use secure transmission methods that protect sensitive data as it moves between people, systems, and locations.

• Email encryption.
• Secure File Transfer Protocol, also known as SFTP.
• Virtual Private Networks, also known as VPNs.

Provide staff with annual HIPAA and cybersecurity training so employees understand both the rules and the real-world risks.

• Proper PHI handling.
• How to identify phishing attempts.
• Secure transmission and storage practices.

Require employees to have only the access they need to perform their work. Avoid unnecessary local or domain admin rights whenever possible.