2FA and SSO are two different login safeguards. 2FA asks for a second proof of identity on top of a password. SSO lets each person use one work login across many apps. The current HIPAA Security Rule requires practices to verify who is accessing electronic patient data, but it does not name either method.
Definition
Two-factor authentication (2FA) requires a person to prove who they are in two different ways before signing in, and single sign-on (SSO) lets each person use one company login to reach many work applications. The two are usually set up together: SSO cuts the number of passwords to one, and 2FA protects that single login.
Common second factors include:
- A code from an authenticator app on a phone
- A one-time code sent by text message or email
- A hardware security key plugged into or tapped on a device
- A push prompt on a phone that the person approves
In practice at a clinic or small practice
2FA. A front desk worker or nurse signs in to a shared workstation or a staff app, types a password, and then approves a prompt or enters a code on their phone. This matters because passwords get reused across personal sites and get captured by phishing emails. With 2FA, a stolen password alone is not enough to sign in. A common problem is staff who don't have a work phone or don't want to install work apps on a personal one. Practices usually handle this by issuing hardware keys or by giving those staff an authenticator option on a device the practice controls.
SSO. The office manager or outside IT provider sets up one company login for each person. This is often a Microsoft or Google account, or an identity provider such as Duo. Staff then use that login to sign in to email, scheduling and staff chat. When someone leaves, disabling that one account removes their access to every connected app, so no one has to track down a dozen separate accounts.
For example, a staff chat such as Chanty offers 2FA and SSO on its Business plan, and SAML SSO with directory sync and SCIM on Enterprise.
Not to be confused with
| Term | What it means |
|---|---|
| MFA (multi-factor authentication) | Two or more factors. 2FA is MFA with exactly two factors. |
| Two-step verification | Two steps at login. Sometimes both steps are things you know, such as a password and a security question, which is weaker than true 2FA. |
| Shared login | One username used by several people. This is the opposite of SSO and defeats unique user identification. 2FA does not fix it. |
| Password manager | A tool that stores many passwords. SSO replaces many passwords with one. |
| SCIM / directory sync | A system that creates and removes accounts automatically. SSO handles signing in. The two are related but separate. |
Real 2FA uses two different kinds of factor:
- Something you know: a password or PIN
- Something you have: a phone or hardware key
- Something you are: a fingerprint or face
What the rules say
"2FA" and "SSO" are industry terms. HIPAA does not define them.
- Person or entity authentication. The technical safeguards in the HIPAA Security Rule require procedures to verify that a person seeking access to ePHI is the one claimed.
- Unique user identification. Under the access control standard, each user must have a unique name or number for identifying and tracking their activity. This is the regulatory reason shared front desk logins are a problem.
- Password management. Password procedures appear under security awareness and training as an addressable specification. See addressable vs required safeguards for what "addressable" means.
- No named method in the current rule. The Security Rule as originally written does not name 2FA or MFA. HHS has proposed amendments that would require multi-factor authentication. Check with HHS or the Federal Register for whether that proposal has been finalized before relying on it.
- HHS guidance. HHS guidance on recognized cybersecurity practices recommends MFA.
In plain English: Verifying who is signing in is required. The method you choose is a decision for your risk analysis, but 2FA is widely treated as a baseline. Turning on 2FA or SSO does not by itself make a practice or a tool HIPAA compliant.
Related reading
- HIPAA Security Rule: the administrative, physical and technical safeguards for ePHI
- Addressable vs required safeguards: why password management is "addressable" and what that obliges you to do
- Security, HIPAA and BAA details for staff chat: how a staff chat handles login controls
- Back to the healthcare operations glossary
Where Chanty fits. chanty.health is published by Chanty, a team chat for clinic staff with a signed BAA from the Business plan. If your team still coordinates in personal group chats, see how HIPAA-compliant staff chat works or start free.