Multi-factor authentication (MFA) requires a second, independent proof of identity beyond the password — an authenticator app code, a push approval on a phone, or a hardware security key — so that a single leaked or guessed password no longer opens patient data on its own. The factors are meant to be genuinely independent: "something you know" plus "something you have," so that compromising one does not hand over the other. This is one of the cheapest, highest-impact controls available for protecting access to PHI.
For a telemedicine product, MFA shows up as a requirement from several directions at once. It is mandatory for electronic prescribing of controlled substances (EPCS), it is something hospital and enterprise security reviews will expect before they buy, and the proposed update to the HIPAA Security Rule (45 CFR Part 164, Subpart C) moves MFA from a recommended safeguard toward an effectively required one. Treating it as table stakes rather than a feature request is the right posture.
Implementation detail is where MFA succeeds or fails. Not all second factors are equal: SMS one-time codes can be phished or SIM-swapped, while phishing-resistant factors based on FIDO2/WebAuthn (such as passkeys and hardware keys) resist the attacks that actually happen. Prioritize the strong factors for the highest-risk accounts first — prescribing clinicians and administrators with broad data access. The most common pitfall is the recovery flow: an account-reset path that drops back to email or a security question quietly becomes the bypass that defeats the whole control, so the recovery process must be as strong as the login it restores.
The handbook · 7 volumes
Fora Soft Video Engineering Handbook
MFA is now mandatory under the 2026 HIPAA update, but patients still need to reach a video visit without friction. Our seven-volume handbook covers the whole video stack, and for teams adding MFA start with Volume 7: production pipelines, regulation and biometrics. Volume 3 covers WebRTC calls and Volume 1 encoding. Written by Nikolay Sapunov, CEO at Fora Soft.
Adding MFA without losing patients at the login screen?
We will design MFA flows for patients and clinicians that meet the HIPAA update and keep visit join rates high, with an estimate. 250+ video products shipped since 2005.
