Two-factor authentication is a process in which an employee uses at least two of the three basic methods listed above to access ePHI – for example, a password and a key, or a PIN and a fingerprint etc.). Although an effective method for adding an extra layer of security to ePHI, HIPAA does not require two-factor authentication unless a Covered Entity identities a vulnerability in their information access management that is best resolved by implementing two-factor authentication.