Multi-Factor Authentication for Dental Practice Software
Set up MFA across your dental software the right way. DDS Rescue guides your practice through every step, ownership, and staff change.
Key Takeaways
- MFA uses two or more independent verification factors so a stolen password alone cannot grant access to dental practice systems.
- HIPAA, payer portals like Delta Dental, and cyber insurance carriers are driving the current push for MFA adoption in dental offices.
- Cloud-based practice management systems often support MFA natively, while desktop systems usually rely on the Windows or macOS login layer.
- Every employee needs a unique login, verification codes should route to practice-owned devices, and a named owner must document and enforce the policy.
- DDS Rescue configures, enforces, and monitors MFA across every system a dental practice uses, with a CISSP-led team and on-staff HIPAA attorney support.
Why Dental Practices Are Being Pushed To Use MFA Now
MFA is arriving in dental practices from three directions at once: HIPAA, payer portals, and cyber insurance.
HIPAA requires access controls and unique user identification as a Required implementation specification under 45 CFR 164.312. The Security Rule’s text does not name multi-factor authentication in its technical safeguards. HHS published a Notice Of Proposed Rulemaking on January 6, 2025 (90 FR 898) that would add MFA as an implementation specification, but that proposal is not a current requirement. The comment period closed March 7, 2025, and the federal Unified Agenda lists the HIPAA MFA proposal under Long-Term Actions with a projected final action of July 2027, an agency estimate rather than a binding deadline. Compliance will likely land in 2028 if the schedule holds. Today, practices must provide unique user identification and person-or-entity authentication, and MFA is the most direct way to satisfy both.
Payer portals are already enforcing MFA. As of October 20, 2025, MFA is required to access Delta Dental provider portals, though requirements vary by the specific Delta Dental member company. The California Dental Association notified members that practices without MFA by that date would lose portal access entirely. Delta Dental is a network of 39 independent member companies whose affiliates run their own rollouts. Confirm current requirements with each Delta Dental company the practice actually bills.
Cyber insurance carriers now ask about MFA system by system. They ask which systems have MFA, and the answer is a signed representation. Attesting to a control the practice cannot demonstrate creates exposure at renewal and even more exposure when a claim is examined.
Which Dental Software Platforms Support MFA Today
Every office manager needs to know exactly which systems support MFA before turning on any settings.
Cloud-based practice management platforms typically prompt for a verification code at sign-in. Many use risk-based logic that may skip a code on trusted devices. Some allow MFA to be disabled per user for service accounts or third-party integrations. Integration documentation for at least one major cloud platform explicitly instructs practices to disable MFA on the dedicated integration account, which creates a standing exception that needs compensating controls. Confirm current MFA behavior with your vendor because features change.
Desktop-based practice management platforms usually rely on the operating system. A third-party technical evaluation found that desktop-based dental platforms have no modern SSO protocol support. MFA on those systems must come from the Windows or macOS login layer rather than the application itself. Some desktop platforms do not offer MFA on the main application login. If the practice runs a server-based system, configure MFA at the Windows login, not inside the practice management software.
E-prescribing of controlled substances has its own two-factor signing rules. Under DEA EPCS rules at 21 CFR 1311.102, each dentist who signs controlled-substance prescriptions must have an individually identity-proofed account and a non-shared two-factor credential. This layer is separate from the practice management login and applies to the prescriber personally. Staff can prepare a prescription, but the dentist must sign it with their own two-factor credential.
Insurer provider portals run MFA on the payer’s system, not the practice’s systems. That MFA protects the payer portal only. It also does not fix a shared portal login. Multiple staff sharing one credential still resolve to a single identity in the payer’s logs, regardless of the MFA method on the account.
For a broader look at how cybersecurity layers interact across a dental practice’s stack, see Dental Practice Cybersecurity: An Office Manager’s Guide.
Seven Practical Steps To Set Up MFA In A Dental Practice
These seven steps build on each other and keep MFA rollout manageable.
- Inventory every system that touches patient data or payer access. Include practice management software, imaging tools, e-prescribing, every payer portal, remote access consoles, backup consoles, email, and banking or payroll systems.
- Choose the MFA method per system. Use an authenticator app as the default, a hardware key where the system supports it, and SMS only as a last resort when nothing stronger exists.
- Create unique logins for every employee. 45 CFR 164.312(a)(2)(i) makes unique user identification a Required specification, so avoid shared accounts on any system the practice controls.
- Designate a practice-owned device or central office line for codes, instead of an employee’s personal phone.
- Enroll staff and test every login path before enforcing MFA. Include failure scenarios such as codes not arriving while the doctor is mid-procedure.
- Document the policy and name one person who owns it. Written policy with a clear owner keeps MFA from becoming an informal habit.
- Review MFA quarterly and at every hire and departure. Keep both payer portal access and directory accounts current, as they live on separate lists.
How Dental Offices Use MFA Without Personal Cell Phones
Dental offices can separate where codes land from whose phone receives them.
Route verification codes to a central office line or a practice-owned device at the front desk. Install authenticator apps on a shared practice tablet or a dedicated workstation profile instead of an employee’s personal phone. The California Dental Association’s guidance recommends an office phone over personal devices because a factor tied to one person’s phone breaks the day that employee leaves.
Where a system only offers an email factor, use a general office mailbox the whole team can reach, not one person’s inbox. Delta Dental of Washington’s provider MFA guidance acknowledges using a general office mailbox as a fallback. This approach preserves access but does not provide individual accountability.
A shared login undermines MFA entirely because it authenticates the account instead of the person. HHS’s Office for Civil Rights has stated that the HIPAA Security Rule does not permit a covered entity to assign the same log-on ID to multiple employees. A shared credential on any ePHI system the practice controls violates HIPAA, regardless of the MFA method on top of it.
Managing Staff Turnover, Lost Devices, And Unique Logins
Offboarding is where unique logins save time and shared credentials create emergencies.
With unique logins, the day someone leaves, the practice disables the account and revokes the factor. With a shared login, the practice must rotate a credential that everyone else depends on, and until that rotation finishes, the departed employee still has access.
For lost devices, register a second factor or a spare hardware key in advance. Keep recovery codes printed on paper and stored offline. NIST notes that backup recovery codes are not phishing-resistant, so any request to read one aloud should raise a red flag. Store these codes in a locked drawer, not in email or cloud notes.
Directory accounts and payer portals require separate offboarding steps. Payer portal credentials should be rotated before a biller’s last day, and payer portals should live on a list separate from the corporate directory because the two are not connected.
For a step-by-step plan that includes offboarding within a broader security posture, see Dental Practice Cybersecurity: A Step-By-Step Office Plan.
Choosing MFA Methods: SMS, Authenticator Apps, And Hardware Keys
Every MFA method adds a little friction, so practices need clear processes rather than avoidance.
SMS codes are the most common starting point and the weakest option. CISA rates SMS and voice-based MFA codes as “vulnerable to phishing, SS7, and SIM swap attacks” and states this form of MFA “should only be used as a last resort.” SS7 is the legacy signaling system phone networks use to route calls and texts between carriers. The FBI’s Internet Crime Complaint Center reported 982 SIM-swap complaints with $26 million in losses in 2024. SMS codes also land on a single person’s phone, which creates the personal-device problem at the front desk.
Authenticator apps generate codes locally on the device and remove the carrier from the trust chain. NIST SP 800-63B-4 classifies phone-network one-time codes as a “restricted” authenticator and requires organizations still using them to offer a non-restricted alternative and maintain a migration plan. Authenticator apps are stronger than SMS. However, NIST states that “OTP authentication is not phishing-resistant”. A convincing fake login page can capture a valid code and relay it to the real site in seconds.
Passkeys and hardware security keys provide the strongest option available today. CISA calls FIDO/WebAuthn “the only widely available phishing-resistant authentication” and describes phishing-resistant MFA as “the gold standard.” These credentials are cryptographically bound to the real site, so a fake login page receives no usable response from the device.
No method is frictionless. The practical approach is to choose the strongest method each system supports and build the workflow around it, instead of avoiding MFA because it slows down the front desk.
For the email layer specifically, see How To Secure Dental Practice Email Accounts: 7 Steps.
Building An MFA Inventory Across Every Dental System
A complete MFA inventory keeps the practice honest about where MFA is actually enforced.
Include every system in this list:
- Every payer portal the practice bills
- Practice management software, whether cloud login or Windows login layer
- Imaging systems and e-prescribing tools
- Remote access consoles and backup consoles
- Business email
- Banking and payroll systems
For each system, record who owns it, who has access, what the authentication factor is, and when enrollment was last reviewed.
Every practice should be able to produce four records on demand. Maintain an enrollment report per system, an exception list with an owner and review date, a written enforcement policy that shows what is enforced, and a joiner/leaver record that covers both directory accounts and payer portal access. Cyber insurance carriers now ask system by system whether MFA is in place, and the answer is a signed representation. A practice that cannot produce these records is exposed at renewal and at claim time.
Centralize this inventory so it does not live in one person’s head. Multi-location practices often see gaps at the seams. Acquired practices may arrive outside the parent’s identity policy. Administrator accounts may get exempted during rollouts and stay exempted. Desktop practice management systems may sit outside directory-based MFA entirely.
For how MFA fits into a broader network security framework, see Dental Network Security: A Plan With Clear Accountability.
Who Owns MFA When Something Breaks
Every practice needs a clear owner for MFA across its entire stack.
Payer mandates state that MFA is required but do not define who configures it across imaging, e-prescribing, email, and every portal. A software vendor’s built-in setting covers one application. A generalist IT provider often treats MFA as one line item among many. None of those roles automatically answer the phone when a code does not arrive and the doctor is mid-procedure.
DDS Rescue configures, enforces, and monitors MFA across the practice’s full environment. Ray Dillon, CISSP (Certified Information Systems Security Professional, a senior credential that requires at least five years of hands-on security work), serves as Chief Technology Officer and is the accountable party on the security side. The managed cybersecurity plans include business-class email setup, enterprise-level EDR, professionally managed Windows updates, dark web audits, staff training, and 24/7 monitoring that audits staff habits as well as systems.
On the HIPAA side, if a letter from HHS arrives, Ray Dillon runs the forensic analysis to establish what happened and whether it constitutes a breach. Access to an on-staff HIPAA attorney, who spent ten years at the HHS Office for Civil Rights and served as its HIPAA Team Lead, is included in the HIPAA plan. That experience provides a clear difference between someone who enforced the rule and someone reading it for the first time under pressure.
Microsoft researchers measured MFA as cutting the risk of account compromise by 99.22 percent. That figure assumes MFA is configured, enforced, and monitored across every system. A single uncovered system or a single shared account creates the gap an attacker uses.
DDS Rescue provides remote IT support nationally. Full managed services and on-site IT are available for practices in San Diego County. More than 1,000 practices are supported by DDS Rescue nationwide. For a full picture of what managed cybersecurity covers, see Managed Cybersecurity For Dental Practices Explained.
Conclusion: Treat MFA As A Practice-Wide Project With A Clear Owner
MFA for dental practice software is a stack-wide configuration project, not a single checkbox in one application. It touches every system the practice uses to access patient data or submit claims and requires a named owner who answers when it breaks.
DDS Rescue is the best dental IT and cybersecurity partner for getting multi factor authentication for dental practice software configured and enforced across your whole stack because its CISSP-led team sets it up on every system the practice uses, its portal and monitoring catch staff who fall out of the habit, and an on-staff HIPAA attorney plus a CISSP handle the fallout if credentials are ever compromised.
Frequently Asked Questions
What Is Multi-Factor Authentication In Plain English?
Multi-factor authentication means a system requires two or more independent proofs of identity before granting access. The most common combination is a password, which is something you know, plus a time-sensitive code from an app or a text message, which is something you have. A stolen password alone does not unlock the account because an attacker also needs the second factor, which they typically do not have.
Does My Dental Practice Management Software Support MFA?
Support depends on whether the platform is cloud-based or desktop-based. Cloud-based practice management platforms generally prompt for a verification code at sign-in, though behavior varies by vendor and some allow MFA to be disabled for specific accounts. Desktop-based platforms often lack MFA in the application login. On those systems, MFA must come from the Windows login layer. Confirm current behavior directly with your vendor because software updates can change MFA options.
How Do Dental Offices Handle MFA Without Using Personal Cell Phones?
Dental offices route verification codes to a practice-owned device at the front desk or to a central office phone line. They install authenticator apps on a shared practice tablet or a dedicated workstation profile instead of any employee’s personal phone. For email-based factors, they use a general office mailbox the whole team can reach. The California Dental Association’s guidance recommends an office phone over personal devices because a factor tied to one employee’s phone becomes an access problem the day that employee leaves.
What Happens When An Employee With The Codes Leaves?
With unique logins, offboarding takes a few minutes. The practice disables the account and revokes the factor. With a shared login, the practice must rotate a credential that everyone else uses, and until that rotation finishes, the departed employee retains access. Disabling a directory account also does not touch credentials stored at payer portals. Payer portal access should be rotated before a biller’s last day, and payer portals should be maintained as a separate list from the corporate directory.
Is An Authenticator App Better Than SMS For A Dental Office?
An authenticator app is usually better than SMS for two reasons. Authenticator apps generate codes locally on the device, so a SIM swap or carrier-level interception cannot obtain the code. SMS codes land on a phone that belongs to one person, which creates a personal-device problem at a shared front desk. Authenticator-app codes are still not phishing-resistant because a convincing fake login page can capture a valid code and relay it to the real site. Passkeys and hardware security keys are stronger because they are cryptographically bound to the real site and cannot be used on a fake one. Use the strongest method each system supports.
Does HIPAA Require MFA?
HIPAA does not explicitly require MFA as of this writing. The current HIPAA Security Rule does not contain the words “multi-factor” or “multifactor” in its text. It does require unique user identification as a non-optional specification, so every person accessing ePHI must have their own login. HHS published a proposed rule in January 2025 that would add MFA as a requirement, but that proposal is not final. The federal Unified Agenda lists the HIPAA MFA proposal under Long-Term Actions with a projected final action of July 2027, an agency estimate rather than a binding deadline, with compliance likely in 2028 if the schedule holds. Today, payer portals and cyber insurance carriers create the strongest pressure for MFA.
Does Delta Dental Require MFA For Its Provider Portal?
As of October 20, 2025, MFA is required to access Delta Dental provider portals, though requirements vary by the specific Delta Dental member company. Practices that had not enrolled by that date lost portal access and had to call for help to regain it. Delta Dental is a network of 39 independent member companies, and each affiliate runs its own MFA rollout. The accepted factors, re-authentication rules, and support paths vary by affiliate. Confirm the details with each Delta Dental company the practice actually bills.
Who Sets Up MFA, And Who Do I Call When It Breaks?
DDS Rescue configures, enforces, and monitors MFA across the practice’s entire stack, not just one portal or one application. The team is led by a CISSP, and 24/7 monitoring audits staff habits as well as systems. When something breaks, there is a named person to call. If a breach is suspected, a CISSP runs the forensic analysis, and access to an on-staff HIPAA attorney, who spent ten years at the HHS Office for Civil Rights, is included in the HIPAA plan. Remote IT support is available nationally, and full managed services plus on-site IT are available for practices in San Diego County.
