Staff onboarding and offboarding

Offboarding is where practices get hurt. A departed employee with live email, EHR access or a door code is both a security risk and a HIPAA finding — and it happens because nobody was working from a list. So write the list.

Before day one

1. Decide the access profile first

   Base it on the role, not the person. “Front desk”, “clinical”, “billing”, “provider” — each with a defined set of systems and permission level. Copying an existing user’s access is how permissions quietly accumulate across a practice.

2. Create individual accounts

   Email, EHR, practice management, password manager. Never a shared login — your audit trail depends on knowing who did what.

3. Apply minimum necessary

   HIPAA expects access limited to what the role requires. A receptionist does not need full clinical records; a clinician does not need payroll.

4. Enrol MFA at setup

   Do it while you have them in the room, and store the recovery codes in the practice password manager — see Password managers and MFA.

5. Record what you issued

   Laptop, phone, badge, keys, door codes, parking fob. This list is what you work backwards through later, and you will not remember it otherwise.

First week

• HIPAA and security training, completed and documented. Required, and the documentation is what an auditor asks for.
• Acceptable use and confidentiality agreements signed.
• Photo and bio consent if they will appear on the website — see Adding staff bios and photos.
• Phishing awareness, with real examples aimed at practices — see Spotting phishing at the front desk.
• Who to call when something looks wrong, made explicit and blame-free.

The offboarding list

Work in this order — email first, because it is the reset path to everything else.

1. Email

   Disable the account and force sign-out of all sessions. Do not simply change the password — active sessions on a phone can survive that. Set forwarding or an auto-reply as the role requires, and preserve the mailbox rather than deleting it.

2. Check for rules they left behind

   Look for auto-forwarding to a personal address. This is both a common exfiltration route and a genuine breach if patient information flowed through it.

3. Clinical and business systems

   EHR, practice management, billing, clearinghouse, lab portals, e-prescribing, imaging. Disable rather than delete, so the audit history stays attached to a real identity.

4. Remote access

   VPN, remote desktop, any vendor support tool. Revoke certificates and tokens, not just passwords.

5. Shared credentials

   Anything they knew that is shared must be changed — the practice social accounts, the alarm code, the Wi-Fi if it protects clinical systems. Remove them from shared vaults.

6. Physical

   Keys, badges, door codes, alarm codes, parking. Collect devices and confirm practice data is removed before reissue.

7. Third parties

   Your bank, insurer, EHR vendor and any service where they were a named administrator or authorised contact. Frequently missed, occasionally expensive.

8. Public-facing

   Website team page, online booking, Google Business Profile, voicemail greetings, printed material.

9. Sign and date the list

   Who did each step and when. This document is your evidence that access was terminated promptly.

Reviewing the middle

People change roles and accumulate permissions they no longer need — the receptionist who covered billing for three months and kept the access. Review who has access to what twice a year, and after any role change. Auditors ask for evidence of this review, and it is usually the fastest way to find dormant accounts nobody remembered.

FAQ