HIPAA Security Rule
Technical

HIPAA Security Rule 164.312(d): Person or Entity Authentication (Standard)

Implement procedures to verify that a person or entity seeking access to ePHI is the one claimed. NIST recommends multi-factor authentication and authenticator assurance levels per SP 800-63B.

What else in your programme already covers this

This control maps to 86 controls across 27 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 8 controls

  • 10.2.1.1 Log all user access to CHD
  • 2.2.2 Vendor default accounts are managed as follows: • If the vendor default account(s) will be used, the default password is changed per Requirement 8.3.6. • If the vendor default account(s) will not be used,
  • 8.2.1 All users are assigned a unique ID before access to system components or cardholder data is allowed
  • 8.3.1 All user access to system components for users and administrators is authenticated via at least one of the following authentication factors: • Something you know, such as a password or passphrase. • Something you
  • 8.4.1 MFA is implemented for all non-console access into the CDE for personnel with administrative access
  • 8.4.2 MFA is implemented for all non-console access into the CDE
  • 9.2.3 Physical access to networking and telecommunications hardware restricted
  • 7.3.1 An access control system(s) is in place that restricts access based on a user's need to know and covers all system components

NIST SP 800-53 Rev 5 · 6 controls

  • NIST800-AU-10 Non-repudiation. Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed [organization-defined]
  • NIST800-IA-11 Re-authentication
  • NIST800-IA-12 Identity proofing
  • NIST800-IA-2 Identification and authentication of organizational users
  • NIST800-IA-5 Authenticator management
  • NIST800-IA-8 Identification and authentication of non-organizational users

CIS Controls v8 · 5 controls

  • CIS-5.2 Use Unique Passwords
  • CIS-6.3 Require MFA for Externally-Exposed Applications
  • CIS-6.4 Require MFA for Remote Network Access
  • CIS-6.5 Require MFA for Administrative Access
  • CIS-6.6 Establish and Maintain an Inventory of Authentication and Authorization Systems

FedRAMP High · 5 controls

  • IA-1 Policy and Procedures
  • IA-2 Identification and Authentication (Organizational Users)
  • IA-2(1) MFA to Privileged Accounts
  • IA-5 Authenticator Management
  • IA-8 Identification and Authentication (Non-Organizational Users)

FedRAMP Moderate · 5 controls

  • IA-1 Policy and Procedures
  • IA-2 Identification and Authentication (Organizational Users)
  • IA-2(1) MFA to Privileged Accounts
  • IA-5 Authenticator Management
  • IA-8 Identification and Authentication (Non-Organizational Users)

UK Cyber Essentials · 5 controls

  • CE-AC.2 Authenticate Users Before Granting Access
  • CE-AC.7 MFA for Administrative Accounts
  • CE-AC.8 Passwordless Authentication
  • CE-SC.4 Authenticate Users Before Access
  • CE-SC.6 Multi-Factor Authentication for Cloud Services

NIST SP 800-171 Rev 3 · 4 controls

NIST SP 800-53 Rev 5 LOW · 4 controls

  • IA-1 Policy and Procedures
  • IA-2 Identification and Authentication (Organizational Users)
  • IA-5 Authenticator Management
  • IA-8 Identification and Authentication (Non-Organizational Users)

NIST SP 800-53 Rev 5 MODERATE · 4 controls

  • IA-1 Policy and Procedures
  • IA-2 Identification and Authentication (Organizational Users)
  • IA-5 Authenticator Management
  • IA-8 Identification and Authentication (Non-Organizational Users)

NIST SP 800-53 Revision 5.1 HIGH · 4 controls

  • IA-1 Policy and Procedures
  • IA-2 Identification and Authentication (Organizational Users)
  • IA-5 Authenticator Management
  • IA-8 Identification and Authentication (Non-Organizational Users)

SOC 2 · 4 controls

  • SOC2-CC6.1 Implements logical access security software, infrastructure and architectures over protected information assets
  • SOC2-CC6.2 Prior to granting access, registration and authorization processes are established
  • SOC2-CC6.3 Role-based access and least privilege are enforced
  • SOC2-CC6.6 Measures against threats outside system boundaries are implemented

ACSC Essential Eight · 3 controls

  • E8-MFA-ML1 Multi-Factor Authentication - Maturity Level 1
  • E8-MFA-ML2 Multi-Factor Authentication - Maturity Level 2
  • E8-MFA-ML3 Multi-Factor Authentication - Maturity Level 3

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 3 controls

  • ANSSI-HYG-10 Define and Verify Password Selection and Sizing Rules
  • ANSSI-HYG-12 Change Default Authentication Elements on Equipment and Services
  • ANSSI-HYG-13 Prefer Strong Authentication Where Possible

CMMC 2.0 · 3 controls

ISO 27002:2022 · 3 controls

  • 5.15 Access control
  • 5.17 Authentication information
  • 8.5 Secure authentication

NIST SP 800-161 Rev 1 · 3 controls

  • 161R1-IA-1 Policy and Procedures
  • 161R1-IA-2 Identification and Authentication (Organizational Users)
  • 161R1-IA-8 Identification and Authentication (Non-Organizational Users)

AWS Well-Architected Security Pillar · 2 controls

Australia My Health Records Act 2012 · 2 controls

  • MYHR-REG-11 Ensuring required information is given to the System Operator
  • MYHR-REG-2 Healthcare recipient registration and identity verification

Azure Security Benchmark · 2 controls

  • IM-4 Authenticate server and services
  • IM-6 Use strong authentication controls

C5 (Germany) · 2 controls

ISO 27001:2022 · 2 controls

  • 5.17 Authentication information
  • 8.5 Secure authentication

NIST SP 800-172 · 2 controls

  • 3.5.1e Identification of Systems, Components, and Devices
  • 3.5.3e Prohibit Connection of Unknown or Unverified System Components

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-20 Multi-factor authentication (Essential)

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

NIST Cybersecurity Framework 2.0 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Technical

You are reading one control. How much of HIPAA Security Rule have you already done?

HIPAA Security Rule 164.312(d) is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of HIPAA Security Rule your existing evidence covers. Hold ISO 27001:2022 and 53 of 67 HIPAA Security Rule controls already carry evidence.

If you hold ISO 27001:202279.1% covered · 14 gapsIf you hold ISO 27002:202279.1% covered · 14 gapsIf you hold FedRAMP Moderate77.6% covered · 15 gapsIf you hold NIST SP 800-53 Rev 577.6% covered · 15 gapsIf you hold C5 (Germany)76.1% covered · 16 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.167.2% covered · 22 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 64 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 86 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll HIPAA Security Rule controls