The holidays bring a familiar scramble in senior living: extra agency nurses, borrowed staff from sister facilities, administrators on vacation and a skeleton crew on nights and weekends. Under that pressure, shortcuts creep into IT. Someone shares a login because a new agency nurse has no account yet. A manager gives a password to a coworker "just for the weekend." Temporary permissions are never removed.
These shortcuts create risks that outlast the holiday, and they are easy to prevent with a bit of planning.
More temporary people. Agency and float staff need access quickly, so process gets skipped.
Fewer decision-makers. Approvals are delayed, so people improvise.
Reduced IT availability. Vendors and internal staff may be on limited schedules.
Distracted employees. Phishing and mistakes rise when people are tired and rushed.
Less monitoring. Fewer people notice odd activity.
Criminals also know this and often time attacks for holiday weekends.
A shared login hides who looked at which resident's chart, which undermines audit logs and accountability that HIPAA expects. Even a short-term worker should have a unique account with only the permissions needed.
When creating accounts for agency or temporary workers, set them to expire automatically at the end of the scheduled assignment. Extend only on request.
Prepare a limited access template for agency nurses and aides that grants only what is needed for bedside work. Do not copy permissions from a permanent employee.
Ask staffing agencies for names and schedules earlier, and set up accounts before the first shift. Give a short orientation covering confidentiality, passwords and where to get help.
Make sure agencies have signed confidentiality and, where appropriate, business associate agreements, and that workers have completed privacy training.
When a manager or key employee is away:
Do not share passwords. Instead, use delegation features, such as shared mailbox access or temporary permission assignments.
Name a backup approver for IT requests, payments and access changes.
Document who has authority to approve emergency requests, and share that with IT.
Use out-of-office messages carefully. Avoid revealing travel details or saying that no one is monitoring email, which is useful to scammers. Provide an alternate contact instead.
Expect fake requests that appear to come from executives who are away, such as urgent payments or gift cards. Make sure your business office knows that any unusual payment request must be verified by phone with a known number, regardless of apparent urgency. Remind all staff to report suspicious messages quickly.
Before the holidays begin:
Review active accounts. Disable any that belong to former employees or past agency workers.
Check administrator accounts and confirm only needed people have them.
Confirm MFA is working and that someone can reset it after hours.
Verify that emergency contacts are current, including after-hours IT support.
Review remote access. Make sure unused remote connections are turned off.
After the holidays:
Remove temporary accounts and permissions that were granted.
Review sign-in logs for unusual activity during the break.
Change any passwords that were shared in an emergency.
Note what went wrong and adjust the process for the next peak period.
People take shortcuts when the right way is slow. If an agency nurse can get an account within an hour, no one will borrow a login. Set a clear target for account creation, post it where managers can see it and make sure someone can act on weekends.
Every person who touches resident information uses their own account.
Passwords are never shared, for any reason.
Temporary access ends when the assignment ends.
Anyone who suspects a problem should report it right away.
UnityCare IT can help you set up rapid onboarding for temporary staff, automatic expirations and after-hours support so that holiday coverage does not create security gaps. If you want to review your account list before the break, reach out and we can walk through it with you.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172