Turnover in healthcare and senior living is a fact of life. Nurses, aides, dietary staff, agency workers and contractors come and go, sometimes within a week. Each arrival needs access to the right systems quickly so they can work, and each departure needs access removed just as quickly. When this process is informal, new hires wait days for logins and former employees keep access for months.
A simple, written checklist fixes both problems. Here is one you can adapt.
The HIPAA Security Rule requires procedures for authorizing and supervising workforce access, for ensuring access is appropriate to the role and for terminating access when employment ends. Beyond compliance, old accounts are a favorite target for attackers because nobody notices when they are misused.
HR or the department head submits a request that includes name, role, department, manager, start date and whether the person is an employee, agency worker or contractor.
The request specifies which systems the person needs. Use role-based templates, such as nurse, CNA, business office or dietary, so access is consistent and follows least privilege.
IT creates the accounts, with a unique username for each system. No sharing, no borrowing a coworker's login.
Hardware is prepared if needed: laptop, badge, phone or tablet, with encryption and security software installed.
Provide credentials securely, in person or via a manager, never by posting in a group chat.
Have the employee set up multi-factor authentication.
Complete required training: HIPAA privacy and security basics, phishing awareness and the acceptable use policy. Record completion.
Have the employee sign the acceptable use and confidentiality agreements.
Walk through how to reach the helpdesk and how to report a security concern.
Manager confirms access is correct and nothing is missing or excessive.
Remove any temporary or elevated access that is no longer needed.
Promotions and transfers are often overlooked. When someone changes department, the new access should be added and the old access removed. Otherwise, people accumulate permissions over the years.
HR notifies IT as soon as notice is given, with the last day and time.
Collect equipment: laptop, badge, keys, phone, tokens and any documents containing patient information.
Disable accounts at the end of the last shift, not at the end of the week. This includes email, EHR, VPN, cloud applications and vendor portals.
Remove the employee's phone from mobile device management, or wipe work data if personal devices were used.
Forward email as needed, then convert or remove the mailbox following your retention policy.
Reassign ownership of files, shared mailboxes and scheduled tasks.
Change any shared passwords the person knew, which is another reason to avoid shared passwords.
Remove physical access: door codes, key cards and keys.
When someone is terminated for cause, coordinate with HR so access is disabled before or at the moment the person is notified. Preserve their mailbox and files in case of investigation.
Create accounts with an end date that expires automatically.
Limit access to what the assignment requires.
Require the agency to notify you when a worker is reassigned.
Onboarding and offboarding checklists fail when they depend on memory. Add a quarterly review:
Compare the HR list of active employees to the list of active accounts in each system.
Review accounts that have not signed in for 60 to 90 days.
Check admin accounts and shared accounts for owners and purposes.
Verify that former employees no longer appear in vendor portals.
HR and IT not sharing information in a timely way.
Disabling email but forgetting the EHR or vendor portals.
Keeping accounts alive for convenience after someone leaves, such as for a covered shift.
Giving new hires the same access as the person they replace, including permissions the old employee accumulated.
Use a single form or ticket for both processes, assign clear responsibilities and measure how long it takes. For multi-site operators, a common standard across buildings reduces gaps.
UnityCare IT helps healthcare employers build onboarding and offboarding workflows, role templates and quarterly access reviews. If your current process lives in someone's head, we can help put it on paper.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172