HIPAA Password Requirements

HIPAA Password Requirements


February 23, 2018 | Reading Time: 3 Minutes

Please support Telehealth.org’s ability to deliver helpful news, opinions, and analyses by turning off your ad blocker. How

For behavioral health professionals, HIPAA password requirements are an important part of keeping your sensitive health data safe and avoiding HIPAA fines.
But what does HIPAA regulation have to say about implementing secure passwords?

HIPAA regulation is broken up into several different rules governing the use and integrity of protected health information (PHI). PHI is any demographic information that can be used to identify a patient. Common examples of PHI include names, addresses, dates of birth, Social Security numbers, telephone numbers, full facial photos, insurance ID numbers, and health care data, to name a few.

Under the HIPAA Security Rule, there are specific Physical, Technical, and Administrative standards that must be in place to ensure that PHI is kept safe.

HIPAA password requirements fall under the Administrative requirements of the HIPAA Security Rule. The HIPAA Security Rule is a federally required regulation for all health care professionals and vendors, and includes other standards in regards to keeping PHI and electronic PHI (ePHI) secure.

In addition to the HIPAA requirements, behavioral health professionals should also adhere to NIST standards (National Institute of Standards and Technology). NIST is a regulatory body that releases guidance on the industry best practices for the use of technology.

Below, we discuss the NIST and HIPAA password requirements that all behavioral health professionals should keep in mind. These are easy steps you can take right now to work on your HIPAA compliance program, and ensure that patient data is not subject to the growing risk of data breaches and malware.

NIST and HIPAA password requirements include:

  • Using a minimum of eight characters: if the password is protecting particularly sensitive data, NIST also suggests using passwords up to 64 characters in length.
  • Avoiding the use of password hints: when you create a password and you’re prompted to create a hint in case you forget, NIST suggests you should avoid this entirely. Using hints like such as “my son’s name” or “my address” can easily compromise even the strongest passwords.
  • Creating passwords you’ll remember: even though you may have heard that long and randomized passwords are more secure, NIST no longer suggests these complicated passwords. In the long run, they may be no more secure than something you’ll remember.
  • Don’t put your password on a post-it note: as we recently saw with the false alarm in Hawaii, you should not keep a physical reminder of your password anywhere near your computer.
  • Running passwords against a list of weaker options: NIST suggests that all passwords within your organization should be vetted against a list of commonly chosen, insecure options (such as “123456789,” “password,” “ChangeMe!,” and so on). You can run this test with the help of your IT firm.

At the end of the day, these are easy steps you can take right now to start to develop a HIPAA compliance program in your practice, all while addressing your HIPAA password requirements. Don’t forget to address the many other federally mandated regulatory requirements necessary for total HIPAA compliance! Implementing an effective HIPAA compliance program is one of the easiest ways to keep patients’ data safe and protect your practice.

HIPAA Resources

Compliancy Group gives behavioral health professionals confidence in their HIPAA compliance with The Guard®. The Guard is a web-based HIPAA compliance solution, built by former auditors to help simplify compliance.

Compliancy Group’s team of expert Compliance Coaches® field questions and guide users through the implementation process, taking the stress out of managing compliance. The Guard is built to address the full extent of HIPAA regulation, including all HIPAA security measures and Security Risk Assessments.

With The Guard, behavioral health professionals can focus on running their practice while keeping their patients’ data protected and secure.

Find out more about how Compliancy Group and the HIPAA Seal of Compliance® can help simplify your HIPAA compliance today!

Essential Telehealth Law & Ethical Issues

Bring your telehealth practice into legal compliance. Get up to date on inter-jurisdictional practice, privacy, HIPAA, referrals, risk management, duty to warn, the duty to report, termination, and much more!

HIPAA Compliant Cybersecurity for Professionals

Must-know information about how to protect your telehealth practice from a ransomware attack. Operate w/ EYES WIDE OPEN.

BCTP®-I Telehealth Training & Certificate

Clinicians seeking an orientation to legal, ethical, technical, and clinical issues will find this program a good place to start.

Disclaimer: Telehealth.org offers information as educational material designed to inform you of issues, products, or services potentially of interest. We cannot and do not accept liability for your decisions regarding any information offered. Please conduct your due diligence before taking action. Also, the views and opinions expressed are not intended to malign any organization, company, or individual. Product names, logos, brands, and other trademarks or images are the property of their respective trademark holders. There is no affiliation, sponsorship, or partnership suggested by using these brands unless contained in an ad. Some of Telehealth.org’s blog content is generated with the assistance of ChatGPT. We do not and cannot offer legal, ethical, billing technical, medical, or therapeutic advice. Use of this site constitutes your agreement to Telehealth.org Privacy Policy and Terms and Conditions.

Was this article helpful?

Please share your thoughts in the comment box below.

Notify of
Inline Feedbacks
View all comments

Register for Free

Receive Any of Our 57 FREE Newsletters!


Most Popular Blog Topics

You May Also Like…

ChatGPT HIPAA Considerations
ChatGPT HIPAA Considerations

ChatGPT HIPAA compliance is one of the hottest topics at 2023 conferences and with good reason. AI...