To implement multifactor authentication across an ABA practice, lock the systems and account populations in scope, then choose authenticators by risk, phishing resistance, usability, accessibility, and vendor support. Define enrollment, binding, backup, recovery, replacement, revocation, logging, help-desk verification, emergency access, and downtime. Test every supported role and keep unsupported accounts, failed enrollments, and temporary exceptions in the denominator.

Define Brennan's MFA coverage and authenticator lifecycle register

Brennan treats MFA as an account-lifecycle control rather than a switch. A strong authenticator can fail if the recovery desk resets it after a weak identity check. Push approval can invite fatigue attacks. A text code can be the weakest available fallback. The register records the actual method used by each account population, including administrators and vendor support.

Build a decision-ready register

The MFA coverage and authenticator lifecycle register records system, account population, privilege, exposure, data, primary and backup authenticator, phishing-resistance status, enrollment identity check, binding event, recovery proof, replacement, revocation, device loss, accessible alternative, shared-device rule, emergency route, log, owner, exception, expiry, test, and outcome. Structured fields support ownership, alerts, expiry, comparison, and validation. Narrative captures workflow context, client and workforce access, uncertainty, disagreements, source limits, failed tests, and why the accountable owner approved, restricted, repaired, deferred, or rejected the item.

Run the operating workflow

Brennan starts with administrators, email, file storage, remote access, and systems holding sensitive information. He pilots authenticators with representative clinical, mobile, shared-workstation, and disability-access scenarios. Support staff rehearse recovery without asking for secrets they should never collect. Rollout reports coverage by system and account population, while bypasses and enrollment failures remain open work.

Keep authority and system capability separate

MFA verifies control of multiple factors under a configured process. It does not prove the person's job role, continuing access need, clinical authority, or identity at every later action. Shared credentials defeat attribution even when a second factor is present. Emergency access follows a separate, logged, time-limited control.

Protect clinical continuity and communication access

Brennan maps which client-specific safety, health, clinical, and communication information the workflow can affect. A qualified clinician decides whether care can proceed after a material technology failure. Staff preserve an accessible way to communicate, including AAC when used, and follow emergency, medical, privacy, security, and reporting routes while technical work continues.

Keep failures, unknowns, and temporary work visible

Brennan records every failed or skipped test, unknown asset or account, workaround, dependency, vendor case, owner, due date, escalation, and retest. Conditional approval states its exact scope, safeguard, operating restriction, evidence, expiry, and stop condition. The 7 unresolved account populations in the fictional example remain visible rather than leaving the denominator.

Work through a fictional practice example

Brennan locks 31 fictional account populations. Twenty-four have required MFA, an approved method, tested enrollment, recovery, revocation, accessible fallback, and logs. One vendor admin uses a shared phone, two systems allow password-only fallback, one recovery script accepts public facts, one prompt is inaccessible, and two populations have no owner. Five repair; two stay restricted. The scenario is synthetic and tests the register and denominator. It establishes no security, privacy, legal, clinical, accessibility, contract, payer, employment, or product conclusion for a real practice or person.

Measure the locked cohort

Brennan's initial control readiness is 24 of 31, or 77.4%. Report the numerator, all 31 account populations due, the review date, unresolved reasons, and age of open work. Accounts, users, applications, assets, events, permissions, tests, defects, and remediation attempts use separate denominators.

Test the highest-risk failure modes

Brennan tests first enrollment, wrong factor, phishing simulation, prompt fatigue, lost phone, new phone, inaccessible method, no cellular service, shared workstation, recovery call, former user, vendor support, and emergency access. Each case keeps the system and version, starting state, user or identity, data, expected safeguard, observed result, evidence, defect, owner, retest, and disposition. Passage applies only to the named configuration and conditions.

Address the main operating risk

A practice can report high MFA adoption while excluding service accounts, former users, vendor administrators, recovery bypasses, or people who cannot complete the chosen prompt.

Require independent acceptance evidence

Brennan gives an independent reviewer the locked scope, source map, configuration, raw evidence, test results, failures, approvals, monitoring, remediation, and closure proof. The reviewer reproduces one normal case and one hard failure. A changed cohort, hidden manual fix, missing audit event, or result that depends on an undocumented step fails acceptance.

Anchor the work in current healthcare security duties

Brennan uses the CASP public organizational overview only for high-level business, clinical-operations, and risk context. HHS risk-analysis guidance requires a regulated entity's analysis to cover all ePHI it creates, receives, maintains, or transmits. The current Security Rule page still labels the January 2025 cybersecurity update proposed, so this workflow applies current law and treats newer ideas as readiness signals.

Separate legal requirements from voluntary technical guidance

Current 45 CFR 164.308 supplies administrative-safeguard duties and 45 CFR 164.312 supplies technical-safeguard duties. The voluntary HHS Healthcare Cybersecurity Performance Goals prioritize high-impact healthcare practices, while NIST CSF 2.0 organizes cybersecurity outcomes. Brennan maps each control to its real source instead of presenting a framework recommendation as a universal mandate.

Use the page-specific technical sources within scope

Brennan's page-specific evidence includes National Institute of Standards and Technology, SP 800-63-4 Digital Identity Guidelines, Cybersecurity and Infrastructure Security Agency, Require Multifactor Authentication, National Institute of Standards and Technology, SP 800-53 Rev. 5 Security and Privacy Controls, American Speech-Language-Hearing Association, Augmentative and Alternative Communication. These sources supply current definitions, controls, examples, or regulated duties within their stated domains. Federal-system NIST guidance and voluntary CISA or HHS goals are implementation aids for a private ABA practice unless another source makes them binding.

Rehearse lost-authenticator recovery

Asha treats recovery as part of MFA, not as a help-desk shortcut around it. A tabletop starts with a clinician reporting a lost phone before a scheduled session. The responder verifies identity through an approved channel, revokes the lost factor and exposed sessions, records the recovery approval, and enrolls a replacement without asking for a password or clinical information in an insecure message. The practice also tests what happens after hours and when a user cannot operate the default factor because of disability, connectivity, or device constraints. Backup methods stay limited, accessible, monitored, and subject to the same termination and review controls as ordinary enrollment.

Maintain the register after release

Brennan assigns a review cadence and change triggers for systems, versions, configurations, users, roles, vendors, subprocessors, data, workflows, incidents, law, contracts, integrations, and ownership. Urgent response proceeds immediately. The page stays draft until the named technology, privacy, security, clinical, accessibility, and legal reviewers complete their work.

Related resources

Sources