---
title: How to Adopt the NIST SP 800-63-B Digital Identity Guidelines and Still Be HIPAA Compliant
description: In his latest blog post, Onliner Adam Kehler discusses how you can adopt the new NIST SP 800-63-B Digital Identity Guidelines and still remain HIPAA compliant.
image: https://info.obsglobal.com/hubfs/daniel-frank-201417.jpg
---

[![Online Business Systems](https://info.obsglobal.com/hubfs/OBS%20+%20CGI%20LOGO%203.png)](https://www.obsglobal.com)

Toggle navigation

About

![](https://info.obsglobal.com/hubfs/About-Our_Approach.png)

###### Our Company

![](https://info.obsglobal.com/hubfs/Our-Community-Icon.png)

###### Our Community

![](https://info.obsglobal.com/hubfs/Executive-Team-Icon.png)

###### Executive team

![](https://info.obsglobal.com/hubfs/About-Partners.png)

###### Partners & Clients

![](https://info.obsglobal.com/hubfs/Imported%20sitepage%20images/About-News.png)

###### News

![](https://info.obsglobal.com/hubfs/Imported%20sitepage%20images/About-Events.png)

###### Events

Services

### [DIGITAL TRANSFORMATION](https://www.obsglobal.com/digital-transformation/digital-advisory-services)

![Digital Advisory Services](https://info.obsglobal.com/hubfs/dig-trans-cons-1.png)

##### [Digital Advisory Services](https://www.obsglobal.com/digital-transformation/digital-advisory-services)

[Assessment,](https://www.obsglobal.com/digital-transformation/digital-advisory-services/#assessment) [Strategy & Roadmap,](https://www.obsglobal.com/digital-transformation/digital-advisory-services/strategy-roadmap) <https://www.obsglobal.com/digital-transformation/digital-advisory-services/strategy-roadmap>[Enterprise Performance Management,](https://www.obsglobal.com/digital-transformation/digital-advisory-services/#enterprise_results_management) [Change Management](https://www.obsglobal.com/digital-transformation/change-management)

![Digital Studio Products](https://info.obsglobal.com/hubfs/dig-prod-dev.png)

##### [Digital Studio](https://www.obsglobal.com/digital-transformation/digital-studio)

[Custom Software Development,](https://www.obsglobal.com/digital-transformation/digital-studio/custom-software-development/) [Product Vision,](https://www.obsglobal.com/digital-transformation/digital-studio/product-vision) [Product Delivery,](https://www.obsglobal.com/digital-transformation/digital-studio/digital-product-delivery/) [Product Operations](https://www.obsglobal.com/digital-transformation/digital-studio)

![Salesforce](https://info.obsglobal.com/hubfs/salesforce-1.png)

##### [Salesforce](https://www.obsglobal.com/digital-transformation/salesforce)

[Sales Cloud,](https://www.obsglobal.com/digital-transformation/salesforce/#sales_cloud) [Marketing Cloud,](https://www.obsglobal.com/salesforce-marketing-cloud/) [Service Cloud,](https://www.obsglobal.com/digital-transformation/salesforce) <https://www.obsglobal.com/digital-transformation/salesforce/#lightening_enablement>[Agentforce,](https://www.obsglobal.com/digital-transformation/salesforce/salesforce-agentforce/) [Salesforce Consulting](https://www.obsglobal.com/salesforce-consulting)<https://www.obsglobal.com/digital-transformation/salesforce/#mulesoft_integration>

![Service Management](https://info.obsglobal.com/hubfs/2020-02-26-16_37_21-Clipboard.png)

##### [Service Management](https://www.obsglobal.com/digital-transformation/service-management)

[IT Service Management,](https://www.obsglobal.com/digital-transformation/service-management#it_service_management) [Enterprise Service Management](https://www.obsglobal.com/digital-transformation/service-management/enterprise-sm)

![Customer Engagement](https://info.obsglobal.com/hubfs/dig-adv.png)

##### [Customer Engagement](https://www.obsglobal.com/digital-transformation/customer-engagement)

[Contact Center Consulting,](https://www.obsglobal.com/digital-transformation/customer-engagement/contact-center-consulting) [Five9,](https://www.obsglobal.com/partners-and-clients/five9/) [Contact Center as a Service (CCaaS),](https://www.obsglobal.com/contact-center-as-a-service-ccaas/) [Conversational AI](https://www.obsglobal.com/digital-transformation/customer-engagement/conversational-ai)

![Business and Technical Consulting](https://info.obsglobal.com/hubfs/2020-02-26-16_37_40-Clipboard.png)

##### [Business and Technical Consulting](https://www.obsglobal.com/digital-transformation/business-and-technical-consulting)

[Project Management,](https://www.obsglobal.com/digital-transformation/business-technical-consulting/) [Quality Assurance  Development & AMS,](https://www.obsglobal.com/digital-transformation/business-technical-consulting/) [Systems Integration,](https://www.obsglobal.com/digital-transformation/business-technical-consulting/) [Cloud Deployment,](https://www.obsglobal.com/digital-transformation/business-technical-consulting/) [Infrastructure Managed Services](https://www.obsglobal.com/digital-transformation/business-technical-consulting/infrastructure-managed-services/)

![Data Services](https://info.obsglobal.com/hubfs/DataServices-icon.png)

##### [Data Services](https://www.obsglobal.com/digital-transformation/data-services/)

[Data Engineering & Architecture,](https://www.obsglobal.com/digital-transformation/data-services/)[Data Management & Governance,](https://www.obsglobal.com/digital-transformation/data-services/)[Data Analytics & Reporting](https://www.obsglobal.com/digital-transformation/data-services/)

![ai-sparkle](https://info.obsglobal.com/hubfs/ai-sparkle.png)

##### [Artificial Intelligence](https://www.obsglobal.com)

[GenAI](https://www.obsglobal.com/gen-ai), [GenAI Workshops,](https://info.obsglobal.com/gen-ai-workshop-registration) [Document Intelligence](https://www.obsglobal.com/innovation-lab/document-intelligence)<https://www.obsglobal.com/digital-transformation/digital-advisory-services/#enterprise_results_management>

### [CYBERSECURITY](https://www.obsglobal.com/cybersecurity)

![2020-02-26-16_38_37-Clipboard](https://info.obsglobal.com/hubfs/2020-02-26-16_38_37-Clipboard.png)

##### [Security Advisory Services](https://www.obsglobal.com/cybersecurity/security-advisory-services)

[CISO Services](https://www.obsglobal.com/cybersecurity/security-advisory-services/vciso/) [Security Program Management](http://obsglobal.com/cybersecurity/security-advisory-services/security-program-management/)                                            [Digital Forensics & Incident Response (DFIR)](https://info.obsglobal.com/digital-forensics-incident-response)<http://obsglobal.com/cybersecurity/security-advisory-services/security-program-management/>

![2020-02-26-16_38_23-Clipboard](https://info.obsglobal.com/hubfs/2020-02-26-16_38_23-Clipboard.png)

##### [Assessment Services](https://www.obsglobal.com/cybersecurity/assessment-services)

[PCI Compliance and Assessment](https://www.obsglobal.com/compliance-assessment-pci) Third-Party Risk Assurance [Risk & Privacy Readiness Assessment and Remediation](https://www.obsglobal.com/cybersecurity/assessment-services) Compliance and Assessments: ISO, NIST, SOC, GDPR

![2020-02-26-16_38_09-Clipboard](https://info.obsglobal.com/hubfs/2020-02-26-16_38_09-Clipboard.png)

##### [Offensive Security Services](https://www.obsglobal.com/cybersecurity/offensive-security-services)

[Penetration Testing – Network](https://www.obsglobal.com/cybersecurity/offensive-security-services/penetration-testing) [Wireless](https://www.obsglobal.com/cybersecurity/offensive-security-services/penetration-testing) [Web & App](https://www.obsglobal.com/cybersecurity/offensive-security-services/penetration-testing) [Red Teaming](https://www.obsglobal.com/cybersecurity/offensive-security-services/penetration-testing) [Social Engineering](https://www.obsglobal.com/cybersecurity/offensive-security-services#social_engineering) [Secure Code Analysis & Review](https://www.obsglobal.com/cybersecurity/offensive-security-services#secure_code_analysis_and_review) [Vulnerability Assessment](https://www.obsglobal.com/cybersecurity/offensive-security-services/vulnerability-assessment/) [Autonomous & Continuous Testing](https://info.obsglobal.com/autonomous-continuous-testing)<https://www.obsglobal.com/cybersecurity/offensive-security-services#secure_code_analysis_and_review>

![RSP Health-Color Thin](https://info.obsglobal.com/hubfs/RSP%20Health-Color%20Thin.png)

##### [Healthcare Cybersecurity](https://www.obsglobal.com/cybersecurity/rsp-health/)

[Risk Management Program](https://www.obsglobal.com/cybersecurity/health-cybersecurity/) [HITRUST Readiness](https://www.obsglobal.com/cybersecurity/health-cybersecurity/) [HIPAA Compliance](https://www.obsglobal.com/cybersecurity/health-cybersecurity/)<https://www.obsglobal.com/cybersecurity/rsp-health/>

![CloudSecurity_icon_WP-jm](https://info.obsglobal.com/hubfs/CloudSecurity_icon_WP-jm.png)

##### [Cloud Security Services](https://www.obsglobal.com/cybersecurity/cloud-security-services/)

[Cloud Security Advisory](https://www.obsglobal.com/cybersecurity/cloud-security-services) [Cloud Security Engineering](https://www.obsglobal.com/cybersecurity/cloud-security-services) [Cloud Security Assessment (FedRAMP/StateRAMP)](https://www.obsglobal.com/cybersecurity/cloud-security-services)

Innovation

![](https://info.obsglobal.com/hubfs/Bulb_Brain.png)

###### Innovation Lab

Careers

![](https://info.obsglobal.com/hubfs/Careers-Available_Positions.png)

###### CURRENT OPENINGS

![](https://info.obsglobal.com/hubfs/Careers_Working_At-Online.png)

###### OUR CULTURE

![](https://info.obsglobal.com/hubfs/Our-Benefits1.png)

###### OUR BENEFITS

![](https://info.obsglobal.com/hubfs/Address.png)

###### CULTURE CREDO

Insights

![](https://info.obsglobal.com/hubfs/BLOGS-icon-5ed95c0032155.png)

###### Blog

![](https://info.obsglobal.com/hubfs/CX%20Solutions%20Icon.png)

###### Customer Experience

![](https://info.obsglobal.com/hubfs/Agile%20Transformation%20Mega%20Menu%20Icon.png)

###### Agile Transformation

![](https://info.obsglobal.com/hubfs/b2b%20ecommerce%20icon.png)

###### B2B eCommerce

![](https://info.obsglobal.com/hubfs/Financial-Services-Icon.png)

###### Financial Services

Contact

![](https://info.obsglobal.com/hubfs/ContactUs_Contact-Us-Form.png)

###### Contact Us

![](https://info.obsglobal.com/hubfs/ContactUs-Locations.png)

###### Locations

About

![](https://info.obsglobal.com/hubfs/About-Our_Approach.png)

###### Our Company

![](https://info.obsglobal.com/hubfs/Our-Community-Icon.png)

###### Our Community

![](https://info.obsglobal.com/hubfs/Executive-Team-Icon.png)

###### Executive team

![](https://info.obsglobal.com/hubfs/About-Partners.png)

###### Partners & Clients

![](https://info.obsglobal.com/hubfs/Imported%20sitepage%20images/About-News.png)

###### News

![](https://info.obsglobal.com/hubfs/Imported%20sitepage%20images/About-Events.png)

###### Events

Services

### [DIGITAL TRANSFORMATION](https://www.obsglobal.com/digital-transformation/digital-advisory-services)

![Digital Advisory Services](https://info.obsglobal.com/hubfs/dig-trans-cons-1.png)

##### [Digital Advisory Services](https://www.obsglobal.com/digital-transformation/digital-advisory-services)

[Assessment,](https://www.obsglobal.com/digital-transformation/digital-advisory-services/#assessment) [Strategy & Roadmap,](https://www.obsglobal.com/digital-transformation/digital-advisory-services/strategy-roadmap) <https://www.obsglobal.com/digital-transformation/digital-advisory-services/strategy-roadmap>[Enterprise Performance Management,](https://www.obsglobal.com/digital-transformation/digital-advisory-services/#enterprise_results_management) [Change Management](https://www.obsglobal.com/digital-transformation/change-management)

![Digital Studio Products](https://info.obsglobal.com/hubfs/dig-prod-dev.png)

##### [Digital Studio](https://www.obsglobal.com/digital-transformation/digital-studio)

[Custom Software Development,](https://www.obsglobal.com/digital-transformation/digital-studio/custom-software-development/) [Product Vision,](https://www.obsglobal.com/digital-transformation/digital-studio/product-vision) [Product Delivery,](https://www.obsglobal.com/digital-transformation/digital-studio/digital-product-delivery/) [Product Operations](https://www.obsglobal.com/digital-transformation/digital-studio)

![Salesforce](https://info.obsglobal.com/hubfs/salesforce-1.png)

##### [Salesforce](https://www.obsglobal.com/digital-transformation/salesforce)

[Sales Cloud,](https://www.obsglobal.com/digital-transformation/salesforce/#sales_cloud) [Marketing Cloud,](https://www.obsglobal.com/salesforce-marketing-cloud/) [Service Cloud,](https://www.obsglobal.com/digital-transformation/salesforce) <https://www.obsglobal.com/digital-transformation/salesforce/#lightening_enablement>[Agentforce,](https://www.obsglobal.com/digital-transformation/salesforce/salesforce-agentforce/) [Salesforce Consulting](https://www.obsglobal.com/salesforce-consulting)<https://www.obsglobal.com/digital-transformation/salesforce/#mulesoft_integration>

![Service Management](https://info.obsglobal.com/hubfs/2020-02-26-16_37_21-Clipboard.png)

##### [Service Management](https://www.obsglobal.com/digital-transformation/service-management)

[IT Service Management,](https://www.obsglobal.com/digital-transformation/service-management#it_service_management) [Enterprise Service Management](https://www.obsglobal.com/digital-transformation/service-management/enterprise-sm)

![Customer Engagement](https://info.obsglobal.com/hubfs/dig-adv.png)

##### [Customer Engagement](https://www.obsglobal.com/digital-transformation/customer-engagement)

[Contact Center Consulting,](https://www.obsglobal.com/digital-transformation/customer-engagement/contact-center-consulting) [Five9,](https://www.obsglobal.com/partners-and-clients/five9/) [Contact Center as a Service (CCaaS),](https://www.obsglobal.com/contact-center-as-a-service-ccaas/) [Conversational AI](https://www.obsglobal.com/digital-transformation/customer-engagement/conversational-ai)

![Business and Technical Consulting](https://info.obsglobal.com/hubfs/2020-02-26-16_37_40-Clipboard.png)

##### [Business and Technical Consulting](https://www.obsglobal.com/digital-transformation/business-and-technical-consulting)

[Project Management,](https://www.obsglobal.com/digital-transformation/business-technical-consulting/) [Quality Assurance  Development & AMS,](https://www.obsglobal.com/digital-transformation/business-technical-consulting/) [Systems Integration,](https://www.obsglobal.com/digital-transformation/business-technical-consulting/) [Cloud Deployment,](https://www.obsglobal.com/digital-transformation/business-technical-consulting/) [Infrastructure Managed Services](https://www.obsglobal.com/digital-transformation/business-technical-consulting/infrastructure-managed-services/)

![Data Services](https://info.obsglobal.com/hubfs/DataServices-icon.png)

##### [Data Services](https://www.obsglobal.com/digital-transformation/data-services/)

[Data Engineering & Architecture,](https://www.obsglobal.com/digital-transformation/data-services/)[Data Management & Governance,](https://www.obsglobal.com/digital-transformation/data-services/)[Data Analytics & Reporting](https://www.obsglobal.com/digital-transformation/data-services/)

![ai-sparkle](https://info.obsglobal.com/hubfs/ai-sparkle.png)

##### [Artificial Intelligence](https://www.obsglobal.com)

[GenAI](https://www.obsglobal.com/gen-ai), [GenAI Workshops,](https://info.obsglobal.com/gen-ai-workshop-registration) [Document Intelligence](https://www.obsglobal.com/innovation-lab/document-intelligence)<https://www.obsglobal.com/digital-transformation/digital-advisory-services/#enterprise_results_management>

### [CYBERSECURITY](https://www.obsglobal.com/cybersecurity)

![2020-02-26-16_38_37-Clipboard](https://info.obsglobal.com/hubfs/2020-02-26-16_38_37-Clipboard.png)

##### [Security Advisory Services](https://www.obsglobal.com/cybersecurity/security-advisory-services)

[CISO Services](https://www.obsglobal.com/cybersecurity/security-advisory-services/vciso/) [Security Program Management](http://obsglobal.com/cybersecurity/security-advisory-services/security-program-management/)                                            [Digital Forensics & Incident Response (DFIR)](https://info.obsglobal.com/digital-forensics-incident-response)<http://obsglobal.com/cybersecurity/security-advisory-services/security-program-management/>

![2020-02-26-16_38_23-Clipboard](https://info.obsglobal.com/hubfs/2020-02-26-16_38_23-Clipboard.png)

##### [Assessment Services](https://www.obsglobal.com/cybersecurity/assessment-services)

[PCI Compliance and Assessment](https://www.obsglobal.com/compliance-assessment-pci) Third-Party Risk Assurance [Risk & Privacy Readiness Assessment and Remediation](https://www.obsglobal.com/cybersecurity/assessment-services) Compliance and Assessments: ISO, NIST, SOC, GDPR

![2020-02-26-16_38_09-Clipboard](https://info.obsglobal.com/hubfs/2020-02-26-16_38_09-Clipboard.png)

##### [Offensive Security Services](https://www.obsglobal.com/cybersecurity/offensive-security-services)

[Penetration Testing – Network](https://www.obsglobal.com/cybersecurity/offensive-security-services/penetration-testing) [Wireless](https://www.obsglobal.com/cybersecurity/offensive-security-services/penetration-testing) [Web & App](https://www.obsglobal.com/cybersecurity/offensive-security-services/penetration-testing) [Red Teaming](https://www.obsglobal.com/cybersecurity/offensive-security-services/penetration-testing) [Social Engineering](https://www.obsglobal.com/cybersecurity/offensive-security-services#social_engineering) [Secure Code Analysis & Review](https://www.obsglobal.com/cybersecurity/offensive-security-services#secure_code_analysis_and_review) [Vulnerability Assessment](https://www.obsglobal.com/cybersecurity/offensive-security-services/vulnerability-assessment/) [Autonomous & Continuous Testing](https://info.obsglobal.com/autonomous-continuous-testing)<https://www.obsglobal.com/cybersecurity/offensive-security-services#secure_code_analysis_and_review>

![RSP Health-Color Thin](https://info.obsglobal.com/hubfs/RSP%20Health-Color%20Thin.png)

##### [Healthcare Cybersecurity](https://www.obsglobal.com/cybersecurity/rsp-health/)

[Risk Management Program](https://www.obsglobal.com/cybersecurity/health-cybersecurity/) [HITRUST Readiness](https://www.obsglobal.com/cybersecurity/health-cybersecurity/) [HIPAA Compliance](https://www.obsglobal.com/cybersecurity/health-cybersecurity/)<https://www.obsglobal.com/cybersecurity/rsp-health/>

![CloudSecurity_icon_WP-jm](https://info.obsglobal.com/hubfs/CloudSecurity_icon_WP-jm.png)

##### [Cloud Security Services](https://www.obsglobal.com/cybersecurity/cloud-security-services/)

[Cloud Security Advisory](https://www.obsglobal.com/cybersecurity/cloud-security-services) [Cloud Security Engineering](https://www.obsglobal.com/cybersecurity/cloud-security-services) [Cloud Security Assessment (FedRAMP/StateRAMP)](https://www.obsglobal.com/cybersecurity/cloud-security-services)

Innovation

![](https://info.obsglobal.com/hubfs/Bulb_Brain.png)

###### Innovation Lab

Careers

![](https://info.obsglobal.com/hubfs/Careers-Available_Positions.png)

###### CURRENT OPENINGS

![](https://info.obsglobal.com/hubfs/Careers_Working_At-Online.png)

###### OUR CULTURE

![](https://info.obsglobal.com/hubfs/Our-Benefits1.png)

###### OUR BENEFITS

![](https://info.obsglobal.com/hubfs/Address.png)

###### CULTURE CREDO

Insights

![](https://info.obsglobal.com/hubfs/BLOGS-icon-5ed95c0032155.png)

###### Blog

![](https://info.obsglobal.com/hubfs/CX%20Solutions%20Icon.png)

###### Customer Experience

![](https://info.obsglobal.com/hubfs/Agile%20Transformation%20Mega%20Menu%20Icon.png)

###### Agile Transformation

![](https://info.obsglobal.com/hubfs/b2b%20ecommerce%20icon.png)

###### B2B eCommerce

![](https://info.obsglobal.com/hubfs/Financial-Services-Icon.png)

###### Financial Services

Contact

![](https://info.obsglobal.com/hubfs/ContactUs_Contact-Us-Form.png)

###### Contact Us

![](https://info.obsglobal.com/hubfs/ContactUs-Locations.png)

###### Locations

×

# How to Adopt the NIST SP 800-63-B Digital Identity Guidelines and Still Be HIPAA Compliant

 By [Adam Kehler](https://info.obsglobal.com/blog/author/adam-kehler) on December 7, 2017 (Last Updated on February 25, 2022 ) 

![](https://info.obsglobal.com/hubfs/daniel-frank-201417.jpg)

### Get latest articles directly in your inbox, stay up to date

 Subscribe to our blog

### Topics

- Select a Topic

### Stay up to date

 Subscribe to our blog

### Subscribe Here!

[Back to main Blog](https://info.obsglobal.com/blog)

![](https://info.obsglobal.com/hs-fs/hubfs/Adam%20Kehler%20(2)-2.jpg?height=100&name=Adam%20Kehler%20(2)-2.jpg)

###### Adam Kehler

 Adam is Online’s Director of Healthcare Cybersecurity Services. He has over 20 years’ experience in technology, including ten years performing consulting services in Healthcare Information Privacy and Security. Adam is experienced in conducting Health Information Assessment and HIPAA compliance gap analysis. This builds on his experience as a Software Developer, Systems Administrator, Business Analyst, Project Manager, and Operations Manager. 

<https://www.linkedin.com/in/adamkehler/> [mailto:akehler@obsglobal.com](mailto:akehler@obsglobal.com)

I was recently asked the following question: *“Can Health Centers adopt the less stringent![daniel-frank-201417.jpg](https://info.obsglobal.com/hs-fs/hubfs/daniel-frank-201417.jpg?width=320&name=daniel-frank-201417.jpg) password measures recently updated in \[*[NIST Special Publication (SP) 800-63-B](https://pages.nist.gov/800-63-3/sp800-63b.html)*\] and still be compliant under the HIPAA Security Rule?”* This is a great question that isn’t quite as simple as it may seem. It requires an understanding of what the NIST Digital Identity Guidelines are, their place in enforcement, and how to interpret HIPAA requirements as they relate to authentication.

**What are the HIPAA Security Rule requirements for Authentication?**

First, let’s cover HIPAA; more specifically the HIPAA Security Rule requirements for Authentication. Below is the HIPAA Requirement for Authentication:

**[Standard 164.312(d): Person or Entity Authentication](https://www.law.cornell.edu/cfr/text/45/164.312)**  
*“Implement procedures to verify that a person or entity seeking access to electronic protected health information \[ePHI\] is the one claimed.”*

That’s it. Not a lot of information there on password length, complexity, change, reminders, storage, etc. This is because the HIPAA Security Rule is not prescriptive. Rather, it is up to the organization to conduct a Security Risk Analysis and, based on their determination of risk, select reasonable and appropriate authenticators. This is what makes HIPAA Compliance hard. How does one know if their authenticators are “reasonable and appropriate”?

That’s where standards become useful. Following an industry standard will not itself guarantee compliance, but it can help demonstrate that an organization is implementing “reasonable and appropriate” controls. Furthermore, the HHS Office for Civil Rights (OCR), the organization responsible for enforcing the HIPAA Privacy and Security Rules, issued [guidance](https://www.hhs.gov/sites/default/files/november-2016-cyber-newsletter.pdf?language=es) in October 2016 that actually references the NIST SP 800-63B Standards. This does not imply that OCR requires these standards, but certainly indicates that following them would align with OCR’s expectations.

**NIST SP 800-63B Digital Identity Guidelines**

That brings us to the NIST 800-63-B Digital Identity Guidelines. Now, it should be understood that these guidelines are:

- NOT enforceable outside of the federal government
- NOT one-size fits all requirements
- Risk-Based guidelines that encompass Identification and Authentication

The guidelines outline three Assurance Levels depending on the level of risk presented by the information in question. These calculations are outside the scope of this article other than to say that when accessing ePHI, the calculation will generally result in Assurance Levels which will require Multi-Factor Authentication. However, this article is about passwords, so we’ll focus there.

**NIST Guidelines - NIST SP 800-63B Appendix A – Strength of Memorized Secrets**

Assume, based on your assessment of risk, that you have determined that a password is appropriate as either the sole identifier or as one factor in a two-factor authentication system. What do the guidelines recommend for the password? This is where *[NIST SP 800-63B Appendix A – Strength of Memorized Secrets](https://pages.nist.gov/800-63-3/sp800-63b.html#appA)* comes into play. These are the standards you will most often hear quoted and where the “less stringent password measures” statement comes from. Again, Appendix A starts with the words “This Appendix is informative” (i.e. these are not enforceable standards).

Now, what does Appendix A say?

**Complexity**

- “Research has shown … that users respond in very predictable ways to the requirements imposed by composition rules”. For example, “Password1!” as a complex password. Therefore, complexity rules typically do not increase password strength.
- “Users should also be able to include space characters to allow the use of phrases”. This increases usability and encourages the use of passphrases.
- “\[I\]t is recommended that passwords chosen by users be compared against a “black list” of unacceptable passwords. This list should include passwords from previous breach corpuses, dictionary words, and specific words (such as the name of the service itself) that users are likely to choose.”

**Length**

- “Password length has been found to be a primary factor in characterizing password strength”.
- “The minimum password length that should be required depends to a large extent on the threat model being addressed”.
- “Online attacks where the attacker attempts to log in by guessing the password can be mitigated by limiting the rate of login attempts permitted”.
- “Passwords are salted with a random value and hashed, preferably using a computationally expensive algorithm” – Work with your software vendor to make sure passwords are hashed using an appropriate algorithm (examples include PBKDF2 and BCrypt)
- “Users should be encouraged to make their passwords as lengthy as they want, within reason” – Allow at least 64 characters.

**Usability**

NIST SP 800-63B also includes recommendations for usability (this is for the developers):

- Support Copy and Paste into password fields
- Support Password Managers
- “Clearly communicate information on how to create and change \[passwords\]”
- “Clearly communicate \[password\] requirements”
- “Do not impose other composition rules (e.g. mixtures of different character types) on \[passwords\]”
- Do not require that memorized secrets be changed arbitrarily (e.g., periodically) unless there is a user request or evidence of authenticator compromise
- “Provide clear, meaningful, and actionable feedback when chosen passwords are rejected (e.g., when it appears on a “black list” of unacceptable passwords or has been used previously).”

The guidance to NOT impose composition rules and NOT require periodic password changes are the areas where readers tend to find these new rules to be “less strict”. However, viewing them as a part of the larger picture shows that there are actually other controls to put in place that compensate for the loosening of these restrictions.

**Conclusion**  
 In answer to the question: “Can Health Centers adopt the less stringent password measures recently updated in NIST SP 800-63B and still be compliant under the HIPAA Security Rule?”, the short answer is “Yes, HIPAA does not actually prescribe a specific standard or set of rules for passwords, so these new measures won’t directly affect compliancy”.

With that being said, organizations should take a risk-based approach to their password rules, and a standard such as NIST SP 800-63-B can certainly be used to demonstrate that their choices are “reasonable and appropriate.” In order to do so, however, the areas where the standard is less stringent (i.e. password changes and composition rules) cannot be taken in isolation. The new guidelines are meant to be followed in their entirety as they are complimentary to each other and were designed to work together.

Online’s Risk, Security, and Privacy practice has worked with hundreds of organizations to assess their current security controls - including authentication strategies - and help design solutions that meet their unique compliance and security requirements. Online believes that a quality security program is not always about implementing the strictest controls, but rather finding a solution that is efficient, user-friendly, and right-sized fhealth  centor your organization.

Is your organization unsure of how to work with the new NIST AP 800-63B Digital Identity Guidelines? Feel free to leave a comment below with any questions, or reach out to me directly, I’d be glad to help.

 

Share this article

[Previous Post](https://info.obsglobal.com/blog/roadmap-to-digital-customer-touchpoints)

[Next Post](https://info.obsglobal.com/blog/why-benefits-should-direct-your-project-planning-and-delivery)

### Suggested Reading

[![](https://info.obsglobal.com/hubfs/US-Based-Tech-vCISO-Banner-Image-1.jpg)](https://info.obsglobal.com/blog/vciso-for-a-technology-company-a-case-study)

 tags

[Security](https://info.obsglobal.com/blog/topic/security) [Cybersecurity](https://info.obsglobal.com/blog/topic/cybersecurity)

##### [US-Based Tech Company Hires vCISO: A Case Study](https://info.obsglobal.com/blog/vciso-for-a-technology-company-a-case-study)

[Continue Reading](https://info.obsglobal.com/blog/vciso-for-a-technology-company-a-case-study)

[![](https://info.obsglobal.com/hubfs/HIMSS20ConferenceBlog.jpg)](https://info.obsglobal.com/blog/a-security-and-compliance-guide-to-himss20)

 tags

[Security](https://info.obsglobal.com/blog/topic/security) [Healthcare](https://info.obsglobal.com/blog/topic/healthcare)

##### [A Security and Compliance Guide to HIMSS20: A candid approach from RSP Director Adam Kehler](https://info.obsglobal.com/blog/a-security-and-compliance-guide-to-himss20)

[Continue Reading](https://info.obsglobal.com/blog/a-security-and-compliance-guide-to-himss20)

[![](https://info.obsglobal.com/hubfs/Top5-Signs-you-Need-a-vCISO-blog-banner.jpg)](https://info.obsglobal.com/blog/top-5-signs-you-need-a-virtual-ciso)

 tags

[Security](https://info.obsglobal.com/blog/topic/security) [Cybersecurity](https://info.obsglobal.com/blog/topic/cybersecurity)

##### [Top 5 Signs you Need a Virtual CISO](https://info.obsglobal.com/blog/top-5-signs-you-need-a-virtual-ciso)

[Continue Reading](https://info.obsglobal.com/blog/top-5-signs-you-need-a-virtual-ciso)

#### Submit a Comment

### Get latest articles directly in your inbox, stay up to date

 Subscribe to our blog

- [Our Company](https://www.obsglobal.com/our-company)
- [Our Executive Team](https://www.obsglobal.com/executive-team)
- [Partners & Clients](https://www.obsglobal.com/partners-and-clients)
- [Events](https://www.obsglobal.com/events-2)
- [News](https://www.obsglobal.com/blog-2)
- [Blog](https://info.obsglobal.com/blog)
- [Working at Online](https://www.obsglobal.com/working-at-online)
- [Available Positions](https://www.obsglobal.com/job-openings)
- [Locations](https://www.obsglobal.com/locations)
- [Contact Us](https://www.obsglobal.com/contact-us)

[![](https://info.obsglobal.com/hs-fs/hubfs/Hubspot%20footer%20social%20media%20icons/glassdoor%20hubspot%20footer%20icon.png?width=16&name=glassdoor%20hubspot%20footer%20icon.png)](https://www.glassdoor.ca/Overview/Working-at-Online-Business-Systems-EI_IE373050.11,34.htm)[![](https://info.obsglobal.com/hs-fs/hubfs/youtube-icon.png?width=16&name=youtube-icon.png)](https://www.youtube.com/channel/UCpB4PnAD2VGv9mb0jwaSl-Q) [![](https://info.obsglobal.com/hs-fs/hubfs/Hubspot%20footer%20social%20media%20icons/facebook%20hubspot%20footer%20icon.png?width=16&name=facebook%20hubspot%20footer%20icon.png)](https://www.facebook.com/Online-Business-Systems-Explore-Innovate-Lead-113440482070083/) [![](https://info.obsglobal.com/hs-fs/hubfs/Hubspot%20footer%20social%20media%20icons/linkedin%20hubspot%20footer%20icon.png?width=16&name=linkedin%20hubspot%20footer%20icon.png)](https://www.linkedin.com/company/online-business-systems) [![twitter final](https://info.obsglobal.com/hs-fs/hubfs/twitter%20final.png?width=19&height=19&name=twitter%20final.png)](https://x.com/obs_global)[![](https://info.obsglobal.com/hs-fs/hubfs/Hubspot%20footer%20social%20media%20icons/insta%20hubspot%20footer%20icon.png?width=16&name=insta%20hubspot%20footer%20icon.png)](http://www.instagram.com/obs_global/)<https://www.glassdoor.ca/Overview/Working-at-Online-Business-Systems-EI_IE373050.11,34.htm>

Copyright © 2025 Online Business Systems

- [Privacy Policy](https://www.obsglobal.com/privacy-policy/) - [Accessibility Policy](https://www.obsglobal.com/accessibility-policy/)

![](https://px.ads.linkedin.com/collect/?pid=650121&fmt=gif) ![](https://px.ads.linkedin.com/collect/?pid=650121&fmt=gif) ![](https://ws.zoominfo.com/pixel/ZKv0AacyinojUGYlbFCd)