A new nurse arrives on Monday morning, ready to work. Her login is not ready, the badge is not programmed, and she shares a coworker's account for the first week because nobody had time to fix it. This is common, and it creates security and compliance problems: no accountability for who accessed which chart, and potentially access that outlasts the employee's stay.
A repeatable onboarding process avoids both delay and risk. This checklist is built for care settings with many roles and shifts.
HIPAA requires workforce access to PHI to be appropriate to the role, with procedures for authorizing and supervising access. Giving people exactly the access they need, when they need it, with their own accounts, is also good practice for audit trails. Good onboarding also sets expectations from day one, which is the best time to teach security habits.
Start the process as soon as an offer is accepted. HR or the hiring manager should send IT a request that includes:
Full name and start date
Job title and department
Supervisor
Work schedule and shift
Location, if multiple sites
Systems needed, based on role
Equipment needed
Define standard access packages for common roles, such as RN, LPN, CNA, therapist, dietary, business office, activities and administrator. A template lists the systems and permissions each role receives. This prevents guesswork and over-granting, and speeds up setup.
Create a unique user account. Never share or recycle accounts.
Create the email account and distribution lists as appropriate.
Assign EHR roles and permissions according to the template.
Prepare any equipment, such as a laptop or phone, with encryption and standard software.
Program badge or door access for the correct areas and hours.
Prepare temporary credentials, to be delivered securely, not by email to a personal address.
Verify identity and hand over credentials in person or through a secure process.
Set the password and enroll in MFA with the employee present, so any problem is resolved immediately.
Have the employee sign the acceptable use policy and confidentiality agreement.
Run a short security orientation: about 15 minutes covering passwords, locking screens, phishing, reporting, personal phones and resident privacy.
Show how to get help: the helpdesk number, how to submit a ticket and what counts as urgent.
Walk through the main systems at their workstation, including how to sign out properly.
Provide a one-page quick reference with key phone numbers and rules.
Check shared workstations, badge tap or fast sign-in options, and auto-lock behavior.
Document training and acknowledgments for HIPAA records.
Confirm the employee can perform key tasks and fix permission gaps through a ticket, not workarounds.
Follow up on any missed training.
Check that the new hire completed MFA and password setup.
Encourage questions and remind them how to report suspicious messages.
Have the supervisor review access to confirm it matches duties.
Agency nurses, contract therapists, students and volunteers often need limited access. Avoid sharing generic logins.
Create named accounts with an expiration date.
Limit access to what they need for their placement.
Require confidentiality acknowledgments and brief training.
Make sure the agency or school has appropriate agreements.
Disable accounts automatically when assignments end.
When employees change roles, update access and remove permissions that no longer apply. People who move from one department to another often collect permissions over time, a pattern known as access creep. A quarterly access review catches it.
The same discipline applies on the way out. Prepare a termination checklist for HR and IT:
Disable accounts on the last day, or immediately for involuntary terminations
Revoke remote access and MFA registrations
Collect devices, badges and keys
Remove from shared mailboxes and groups
Reassign files and email
Review shared credentials the employee knew and change them
Update the device and access inventory
Track the time from offer to ready account, the number of onboarding-related tickets in the first week and the percentage of accounts created from templates. Fewer first-week problems mean the process is working.
UnityCare IT helps healthcare employers build onboarding and offboarding procedures, role-based access templates and training for new staff. If your new hires regularly wait for access or borrow a coworker's login, we can help you fix the process.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172