Multi-Factor Authentication (MFA) — Supported Use Cases

ONC Certification Criterion 170.315(d)(13) — Multi-Factor Authentication

This document describes the multi-factor authentication capabilities of EMR Bear and the use cases in which the product authenticates a user's identity through multiple elements using industry-recognized standards. It is provided in support of the product's 170.315(d)(13) attestation and is published on the product's CHPL listing.

---

1. Industry-Recognized Standards Supported

EMR Bear implements multi-factor authentication using the following recognized standards:

• RFC 6238 — Time-Based One-Time Password (TOTP) — used for interactive user login. Time-based one-time passcodes are generated by a user-enrolled authenticator application.
• RFC 4226 — HMAC-Based One-Time Password (HOTP) — the underlying one-time-password algorithm on which TOTP is built.
• otpauth:// Key URI format — used to provision the TOTP shared secret to standard authenticator apps (Microsoft Authenticator, Google Authenticator, Authy, and compatible applications) via QR code.
• SaaSPass multi-factor authentication service — used as the second factor for Electronic Prescribing of Controlled Substances (EPCS), consistent with DEA EPCS two-factor requirements.

2. Authentication Elements (Factors)

Authentication requires two independent elements:

• Knowledge factor — the user's account credentials (username and password).
• Possession factor — one of:
  • A time-based one-time passcode (TOTP) from the user's enrolled authenticator application;
  • A one-time passcode delivered to the user's registered email address (alternate delivery);
  • For EPCS, a one-time passcode from the prescriber's registered SaaSPass device.

3. Supported Use Cases

Use Case 1 — Interactive Application Login

After a user submits valid account credentials, the product requires a valid one-time passcode before the session is established. This applies to interactive login for all user roles. MFA may be enrolled per user, and an organization administrator can require MFA for all users via a configuration setting ("Force all users to enable two-factor authentication"). Enrollment is performed by scanning a QR code (otpauth:// provisioning URI) with a standard authenticator application; users may alternatively receive one-time passcodes by email.

Use Case 2 — Electronic Prescribing of Controlled Substances (EPCS)

Before a controlled-substance prescription may be signed and transmitted, the prescriber must complete a SaaSPass two-factor verification. Authorization is granted only upon successful validation of the one-time passcode, satisfying the two-factor identity requirement for EPCS.

4. Security Properties

• Shared secrets encrypted at rest — each user's TOTP secret is stored encrypted with a random initialization vector.
• Single-use / replay protection — one-time passcodes are accepted only within a limited time-drift window, and the most recently used code is tracked to prevent reuse.
• Administrative controls with audit — administrator-initiated MFA unenrollment requires a recorded reason, and any temporary MFA-bypass window is logged.

---

Document owner: Security team. Last reviewed: July 24, 2026. Published at: https://help.emrbear.com/emrbear/help/manual/article/504.