SuperHIPAA Book a demo

Platform feature

MFA & Logging

MFA posture and audit log review across the ePHI footprint — the two controls that neutralise most breaches and most settlements.

Book a demo Get your free HIPAA readiness score

Administrative safeguards Physical safeguards Technical safeguards Privacy rule Breach notification

The two controls that have neutralised the most 2026 settlements — and the most breaches — are MFA on identity and periodic review of the logs you already collect. MFA & Logging tracks posture, cadence, and evidence of review across the ePHI footprint.

What it does

  • Records MFA state per workforce member and per privileged system, with phishing-resistant status flagged.
  • Captures audit log sources, retention, and the scheduled review cadence per system.
  • Attests to each log review with a reviewer, a date, and anomalies-of-note.
  • Reports MFA coverage gaps and overdue log reviews on the dashboard.

How it maps to HIPAA

The feature supports §164.312(a)(2)(i) (unique user ID), §164.312(d) (person or entity authentication), §164.312(b) (audit controls), and §164.308(a)(1)(ii)(D) (information system activity review). The proposed Security Rule (RIN 0945-AA22) elevates MFA from addressable to required.

Where it fits

MFA & Logging sits in the Security module with Access Control and Encryption as paired technical safeguards.

Questions

What counts as MFA for HIPAA?

Phishing-resistant MFA for all identities with ePHI access is the current practitioner standard, and the proposed Security Rule explicitly requires MFA. SMS codes count less than they used to; FIDO2 passkeys count more.

Who reads the logs?

You do, but the platform narrows what you have to look at: scheduled review cadences, anomaly surfacing, and acknowledgement of each review with the reviewer's name and the date. §164.308(a)(1)(ii)(D) is a review requirement, not a storage requirement.

See your compliance program in one place

A 20-minute walkthrough with a practitioner. No slides, no pressure.

Book a demo