By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Authentication
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
Authentication is the process of confirming that someone or something is genuine before granting access. When a person logs in, authentication proves the person is the account holder. When systems exchange messages, authentication proves the message came from the claimed sender and was not altered.
The HIMSS Dictionary describes authentication in two ways. First, it is a security measure, such as a digital signature, that confirms a transmission, message, or sender is valid, or that verifies a person is authorized to receive certain categories of information. Second, it is how a person or system demonstrates that it really is the identity it presents. The Dictionary notes that authentication guards against fraudulent use of a system and fraudulent transmission of information.
Authentication relies on factors, which fall into three categories:
| Factor Type | Description | Healthcare Examples |
|---|---|---|
| Something You Know | Information only the user should know | Password, PIN, answers to security questions |
| Something You Have | A physical or digital object the user possesses | Proximity badge, security key, smartphone authenticator app, smart card |
| Something You Are | A biological characteristic | Fingerprint, palm vein pattern, facial recognition |
Multifactor authentication (MFA) combines two or more different factor types, such as a password plus a code from a phone. Using two passwords is not MFA, because both are something the user knows.
⚠️ Exam Alert: Authentication answers “Who are you?” Authorization answers “What are you allowed to do?” Identification is the claim of identity, such as typing a username; authentication proves it. Identity proofing verifies a person’s real-world identity before an account is issued. Non-repudiation, often supported by digital signatures, means a sender cannot credibly deny having sent a message.
🌐 Why It Matters: Real-World Healthcare IT Context
Stolen or weak credentials are among the most common ways attackers get into healthcare systems. A password captured through a phishing email can open email, remote access, and sometimes the EHR. Strong authentication makes stolen passwords far less useful, which is why multifactor authentication has become a baseline expectation for remote access, email, privileged accounts, and cloud applications.
The HIPAA Security Rule includes a person or entity authentication standard, requiring covered entities and business associates to implement procedures that verify a person or entity seeking access to electronic protected health information is the one claimed. HIPAA does not prescribe specific technologies, so organizations choose methods based on their risk analysis.
NIST’s Digital Identity Guidelines, SP 800-63-4, finalized in July 2025, describe authenticator assurance levels that indicate how much confidence an authentication process provides. Higher levels require multifactor authentication and, at the top level, hardware-based authenticators that resist phishing. Phishing-resistant methods, such as security keys and passkeys based on public key cryptography, cannot be tricked into working on a fake website the way a typed code can.
Some clinical actions require stronger authentication by regulation. DEA rules for electronic prescribing of controlled substances require two-factor authentication when a prescriber signs those prescriptions.
Recovery processes are part of authentication too. When a user forgets a password or loses a phone, the reset process must verify identity at least as strongly as the original login, or attackers will simply target the reset. Attackers have repeatedly called help desks pretending to be employees, so many organizations now require callback verification, manager confirmation, or in-person identity checks before resetting credentials for privileged accounts.
Authentication also applies to systems. Interfaces, APIs, and devices authenticate to one another using certificates, tokens, and keys, and those machine credentials need the same care as human passwords.
Common authentication weaknesses:
- Password-only access to email, VPN, or cloud systems
- Shared accounts on clinical workstations
- MFA methods that can be bypassed by repeated push notifications or phishing pages
- Help desk resets that do not verify identity carefully
- Service accounts with old passwords that never change
- Badges lent, lost, or left in unattended workstations
Characteristics of strong authentication programs:
- MFA on all remote, email, cloud, and privileged access
- Phishing-resistant authenticators for high-risk roles
- Fast badge-plus-PIN or biometric login on shared clinical workstations
- Rigorous identity verification for password resets and new devices
- Monitoring for unusual sign-ins and repeated failures
- Inventory and rotation of system and service credentials
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses authenticate more often than almost anyone in the hospital, so the design of authentication has a real effect on time and safety.
At the Bedside
A nurse may log into workstations, medication cabinets, scanners, and mobile devices dozens of times in a shift. Fast methods such as badge tap with a short PIN, or a fingerprint at a medication cabinet, make it realistic to log in and lock screens consistently. Slow or awkward methods push people toward leaving sessions open or sharing logins, which undermines both security and the accuracy of the record.
Authentication is also documentation integrity. When a nurse signs a medication administration or co-signs a high-alert medication, the system records that specific person. Logging in as someone else, or letting someone else document under a nurse’s login, attributes actions to the wrong clinician.
In Clinical Workflow
Re-authentication prompts are intentional for certain actions. A system may ask for a password again before overriding an alert, witnessing a medication waste, or accessing a restricted record. These steps provide stronger evidence of who performed a sensitive action.
Multifactor prompts outside the hospital deserve attention. An unexpected request to approve a login on a phone, especially at an unusual time, may mean someone else has the nurse’s password. Denying the request and reporting it to the help desk quickly can stop an attack.
In EHR Implementation (Go-Live Perspective)
During an Epic Go-Live, authentication is often part of the first-day experience: new credentials, badge enrollment, MFA setup, and new expectations for signing. At-the-elbow support analysts help users through enrollment and lockouts but never ask for passwords or log in on a user’s behalf.
Testing authentication paths before Go-Live prevents many problems. Badge readers, biometric devices, and re-authentication prompts should be tested on every workstation type and in every clinical area, including procedural and emergency settings where speed matters most.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Authentication appears throughout security and identity questions:
| CAHIMS Domain | How Authentication Appears |
|---|---|
| Healthcare & Technology Environments | HIPAA Security Rule; NIST digital identity guidelines; DEA two-factor requirements |
| Clinical Informatics | Re-authentication for sensitive actions; signatures; documentation integrity |
| Healthcare Information & Systems Management | MFA, badges, biometrics, certificates, single sign-on, identity providers |
| Management & Leadership | Identity strategy, help desk procedures, risk analysis, workforce training |
Key Terms to Know Alongside Authentication
- Authorization — determining what an authenticated user or system is permitted to access or do
- Multifactor Authentication (MFA) — verification using two or more different types of factors
- Authenticator Assurance Level (AAL) — NIST’s measure of confidence in an authentication process
- Digital Signature — a cryptographic method that verifies the sender and integrity of a message or document
- Identity Proofing — verifying a person’s real-world identity before issuing credentials
- Phishing-Resistant Authentication — methods, such as security keys and passkeys, that cannot be reused on fraudulent sites
HIMSS Organizational Position
HIMSS addresses authentication through its cybersecurity and identity work. Its Healthcare Cybersecurity Community shares practices for MFA and identity management, and HIMSS supports approaches that strengthen security without adding unnecessary burden to clinicians. Members can find related education and research through the HIMSS Resource Center.
🔗 Explore Further: External References
- NIST — SP 800-63-4, Digital Identity Guidelines https://csrc.nist.gov/pubs/sp/800/63/4/final
- NIST — SP 800-63B, Authentication and Authenticator Management https://pages.nist.gov/800-63-4/sp800-63b.html
- NIST — Glossary: Authentication https://csrc.nist.gov/glossary/term/authentication
- eCFR — 45 CFR 164.312, HIPAA Technical Safeguards https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312
- HHS 405(d) Program — Health Industry Cybersecurity Practices https://405d.hhs.gov/
- HIMSS — Healthcare Cybersecurity Community https://www.himss.org/networking/communities/healthcare-cybersecurity/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply