164.308(a)(5)(ii)(D) Password Management (Addressable)
Administrative safeguard · Addressable
The requirement as we hold it
Password Management (Addressable). Implement procedures for creating, changing, and safeguarding passwords. NIST recommends aligning to SP 800-63B authenticator assurance levels and considering multi-factor authentication for ePHI access.
The examiner asks
- Show me the procedure for creating, changing and safeguarding passwords.
- Do you require multi-factor authentication for ePHI access, and where is that set?
Evidence to bring
- the password management procedure
- the MFA configuration
Source: 164.308(a)(5)(ii)(D) at eCFR. Our statement of the clause, not the instrument verbatim.