Two-factor authentication is becoming less secure over time. I would argue everything becomes less secure over time, and therefore you need to make security an active part of your healthcare business.
Active means investing time and resources regularly in security adaptations, processes, training, and system upgrades. You'll be a harder to hit moving target, and you'll satisfy the best efforts to keep your patients' data secure.