164.312(d) Person or Entity Authentication (Standard)
Technical safeguard · Standard
The requirement as we hold it
Person or Entity Authentication (Standard). Implement procedures to verify that a person or entity seeking access to ePHI is the one claimed. NIST recommends multi-factor authentication and authenticator assurance levels per SP 800-63B.
The examiner asks
- Show me how you verify that a person or entity seeking ePHI is who they claim.
- Is multi-factor authentication in place, and where?
Evidence to bring
- the authentication policy
- the MFA configuration
Source: 164.312(d) at eCFR. Our statement of the clause, not the instrument verbatim.