MFA Would Be Mandatory for Every System Accessing ePHI Under the Proposed 2026 Rule: What This Means for FQHC Staff Workflows

Multi-factor authentication has been a recommended best practice in healthcare for years. The proposed 2026 HIPAA Security Rule update would close the gap between recommendation and requirement: MFA would be legally mandated for every workforce member who accesses electronic protected health information if the rule is finalized.

For a Federally Qualified Health Center, the practical implication is significant. The workforce is diverse — physicians, nurses, medical assistants, behavioral health counselors, health educators, enabling services staff, billing specialists, front desk coordinators, and administrative personnel. Each role accesses ePHI in different ways, through different systems, from different devices. A single MFA policy must work for all of them.

This guide explains what the proposed HIPAA Security Rule update (MFA and encryption) means specifically for FQHCs, how to implement it across a diverse workforce, and what accommodations are appropriate for staff who face barriers to standard MFA methods.

Not sure where your FQHC stands today? Take our free security assessment to find out.

The Full Scope of the Proposed MFA Requirement

The proposed 2026 HIPAA Security Rule would require MFA for "any user accessing electronic protected health information." This language is broad — and intentionally so. For an FQHC, the systems that would be covered include:

Electronic Health Record. The primary clinical system (eClinicalWorks, Greenway, NextGen, Epic, Athenahealth, OCHIN, or equivalent). Every clinical and administrative user must authenticate with MFA.

Email System. If Microsoft 365 or Google Workspace accounts receive patient-related emails — appointment communications, referral coordination, care plan attachments, patient messages — those accounts access ePHI. MFA is required.

Patient Portal Administration. Health centers that manage a patient portal (typically integrated with the EHR) have staff accounts with access to patient-submitted information. MFA required.

Billing Systems. Claim management software, clearinghouses accessed via web portal, Medicaid managed care portals — all contain ePHI in the form of diagnosis codes, patient identifiers, and service records. MFA required.

Remote Access / VPN. Any system through which staff access the health center's internal network from outside — whether for remote work, satellite site access, or after-hours clinical support — must require MFA before access is granted.

Cloud Storage. SharePoint, OneDrive, Google Drive, or any cloud storage system where clinical documents, care plans, or patient records are stored requires MFA for access.

Implementation Across a Diverse FQHC Workforce

The Recommended Approach: Centralized Identity Platform

The most efficient MFA implementation for a multi-system FQHC uses a centralized identity platform — Microsoft Entra ID (for Microsoft 365 users) or Google Workspace identity management — as the single authentication source. Benefits:

• Enforce MFA once, apply everywhere: A Conditional Access policy that requires MFA at the identity provider level applies to every system that uses that identity provider for authentication — EHR (via SSO/SAML), email, SharePoint, and remote access simultaneously.
• Manage exceptions centrally: Staff who need accommodation (see below) are managed through the identity platform's exception procedures, not system by system.
• Audit centrally: Authentication logs from the identity platform record all MFA events across all systems in one place — simplifying HIPAA audit log requirements.

MFA Methods for Different Staff Types

Clinical staff with smartphones (nurses, physicians, behavioral health). Microsoft Authenticator or Google Authenticator push notification. Tap "Approve" on the phone after entering the password. Total login time: 5–10 additional seconds.

Front desk and administrative staff at shared workstations. Consider FIDO2 hardware security keys (like YubiKey) for staff who share workstations. The key is physically present at the workstation; the user taps it after entering their password. No phone required. The key stays at the workstation — it is not taken home.

Enabling services and outreach staff without smartphones. SMS text message codes are a lower-security but functional alternative for staff without smartphones. Hardware tokens are an alternative. Budget for the token cost if needed.

Staff who do not speak English as a primary language. MFA authenticator apps and push notifications are largely language-independent — the approval is a button tap, not a language-dependent response. Enrollment instructions should be available in relevant languages.

Managing the Enrollment Process

MFA enrollment is the most operationally intensive step. It requires every staff member to register their authentication method before the policy is enforced.

Best practice for FQHC MFA rollout:

1. Communicate to all staff two weeks before go-live: what MFA is, why it is required, how to enroll
2. Designate site-level MFA champions at each location who can assist colleagues with enrollment
3. Set a two-week enrollment window before enforcement begins
4. Have the IT administrator (or managed service provider) available for troubleshooting during enrollment
5. After enforcement begins, have a clear process for staff who are locked out during the first week (without creating a security bypass)

What to Do When Staff Say MFA Is Too Difficult

MFA resistance from staff is common during initial rollout. The most frequent objections and responses:

"It takes too long." Push notification approval adds 5–10 seconds to a login. This is a one-time adjustment. Most staff report the friction becoming invisible within two weeks of consistent use.

"I don't have a smartphone." Provide a hardware token. Budget for it. MFA without a smartphone is achievable.

"I share my login with a colleague." Account sharing is a HIPAA violation regardless of MFA. Each staff member must have an individual account. This is the moment to address shared credentials — do not configure MFA workarounds that enable continued account sharing.

"What if I lose my phone?" Have a documented account recovery process that requires IT verification before bypassing MFA. Recovery should not be self-service — it should require a call to IT or the managed security provider.

Implement MFA across your entire FQHC workforce — aligned with the proposed 2026 HIPAA requirements and current SHIN-NY standards. ShieldForce manages the full MFA deployment — configuration, enrollment, exception management, and ongoing support — for community health centers.

Explore Community Health Center Solutions →

Start with a free HIPAA assessment to evaluate your current authentication posture.

Schedule Your Free Assessment → | View Pricing →

Take the Free Security Assessment →