I was told by a vendor that there's new guidance effective in 2017 that mandates Multi-Factor Authentication for all systems that host PHI. They said that things like white-listing IP addresses was good enough to satisfy this requirement. Is this just a vendor trying to sell me something? Or is there really updated guidance on this issue?
HIPAA doesn't explicitly mandate MFA, but because of updates to NIST guidance (800-63), it would be very reasonable to argue that a solution without MFA is deficient to meet something like section 164.312d, and therefore does not meet HIPAA requirements.
That said, whitelisting IPs is a pretty mediocre security solution and is definitely not considered to be MFA.