Is Your Health Plan Secure?

Identity authentication is a process that corroborates a person's identity prior to granting the person access to a system or digital platform. Authentication can take numerous forms, such as a password, PIN, security token, or biometric data. Access to systems that house or transmit sensitive information, including electronic protected health information ("ePHI"), typically require multi-factor authentication ("MFA"), such as a password and sending a verification code to the user's phone.

There are also phishing-resistant forms of MFA that decrease the risk of disclosure of sensitive information to illegitimate sources. For example, phishing-resistant MFA may include a password and a form of authentication that only the user would have, such as a software-based token authenticator. Passwords and PINs are less secure when used alone, because they are a form of authentication that a person "knows" but is not an identifier specific to the person (e.g., fingerprint)