Multi-factor authentication (MFA) is an option for complying with the Technical Safeguards of the Security Rule; but, as HIPAA is technology-neutral, it is not a requirement. Covered Entities can choose to implement MFA as a standalone authentication method – provided it complies with other Security Standards – or implement MFA to strengthen defenses against password hacks and phishing.