With regards to EHR systems, the HIPAA password requirements are the same as for accessing databases and other directories containing ePHI. Therefore – according to NIST´s recommendations, passwords should only be changed when there is evidence that the password has been compromised or shared among healthcare workers, students, and other employees.