At Cash Practice, protecting account security and safeguarding patient health information is a top priority. In response to the U.S. Department of Health and Human Services (HHS) Notice of Proposed Rulemaking (NPRM) to strengthen the HIPAA Security Rule and improve cybersecurity protections, changes are coming to the login process. The proposal includes a requirement for the use of Multi-Factor Authentication (MFA), with limited exceptions when accessing electronic protected health information (ePHI).
HHS also proposes adding a formal definition of MFA and strengthening technical safeguard requirements under the HIPAA Security Rule. While the proposal is not yet final, healthcare entities should be aware that these changes are widely expected to move forward and may require action within the next year after a final rule is published. Implementing MFA now is considered a cybersecurity best practice and positions your clinic to be better prepared for future regulatory requirements.
As part of our ongoing commitment to security, Multi-Factor Authentication (MFA) will be implemented across the platform in the coming months. MFA adds an important layer of protection by requiring a second verification step during login, helping prevent unauthorized access even if a password is compromised. This standard may already be familiar through use with banking accounts, practice management software, or eligibility portals such as Availity.
❗Action Required: Review Your User Accounts
To prepare for this change, ensure that each staff member has their own individual user account.
Because MFA verifies the identity of the person logging in, shared usernames and passwords will not be supported once MFA is enabled. Individual accounts improve security, accountability, and audit tracking while helping your practice transition smoothly when MFA is launched.
To review current users, follow the steps in this article:
How do I View my Account Users?
Why This Matters
Protecting patient information is a shared responsibility. Strong authentication controls help reduce the risk of unauthorized access, credential theft, ransomware, and other cybersecurity threats that continue to impact healthcare organizations nationwide. Soon, it will also be a HIPAA requirement.
Looking Ahead
Additional information, training resources, and an official rollout date will be provided as implementation approaches. For now, please take a few minutes to review user accounts and ensure every team member has a unique login.
For more context on upcoming regulations, review the HHS OCR Fact Sheet.
For assistance with creating user profiles or setting up accounts, please contact the Cash Practice Support Team: support@cashpractice.com