Multi-factor authentication (MFA) is not a requirement of HIPAA per se. However, if a Covered Entity conducts a risk assessment that identifies weaknesses in their information access management, MFA could be used as a reasonable and appropriate security measure to address the weaknesses.