Covered Entities must comply with the requirement to “implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed”. Username and password combinations are the easiest and least expensive way to do this, but if the Covered Entity implements an alternate authentication method which is just as effective as username and password combinations and which can identify and track user activity, then it is possible not to use passwords and still comply with HIPAA.