When HIPPA was written, it was deliberately technology-neutral to remain relevant as technology advances. Therefore, HIPAA – in this case the Technical Safeguards of the Security Rule – mandates that verification and authentication measures are put in place, but doesn´t specify which ones to use. However, if a Covered Entity identifies a vulnerability in an access control measure that could be resolved by multi-factor authentication, and fails to implement it, HHS will be interested to know why MFA was not implemented if the Covered Entity subsequently experiences a data breach.