Staff turnover is a fact of life in long-term care, and every departure creates a small security question: does this person still have access to systems and resident records? In many organizations, the honest answer is yes, for longer than anyone would like. Accounts linger for weeks or months, passwords stay unchanged and badges are never returned.
Offboarding is the mirror image of onboarding, and it matters just as much. HIPAA's Security Rule includes a workforce clearance and termination procedures standard, which calls for procedures to end access when employment ends or when access is no longer appropriate.
Privacy: Former staff should not be able to view resident information.
Security: Dormant accounts are easy targets for attackers because nobody notices unusual activity.
Disgruntled departures: In rare cases, an employee leaving on bad terms could delete data or steal information.
Audit and compliance: Regulators and auditors expect evidence that access is removed on time.
Cost: Unused software licenses continue to be billed.
The most common failure is that IT never hears about the departure. Fix this first:
HR or the supervisor submits a termination notice through a shared form as soon as the date is known.
For involuntary terminations, IT receives notice in time to disable access at the moment of separation, not afterward.
Include the employee's name, department, last day, a manager contact and any special instructions.
Make a weekly reconciliation: compare the list of active accounts against the current payroll roster.
Disable the network or directory account, and block sign-in to email and cloud tools
Revoke access to the EHR and other clinical applications
Remove the person from VPN, remote access and any third-party portals
Disable the badge or key card and collect keys, fobs and tokens
End mobile device access and remotely wipe work data from any managed or personal device enrolled
Reset shared passwords the person knew, such as for departmental accounts or equipment
Collect laptops, tablets, phones and other equipment, and record serial numbers
Set an automatic reply or forward email to the supervisor for a defined period
Preserve mailbox and files according to your retention policy before deleting anything
Transfer ownership of shared files, documents and calendar items
Convert the mailbox to a shared mailbox temporarily if needed, then archive
Reassign the extension and voicemail
Remove the person from distribution lists and group messaging channels
Update call forwarding and nurse call or paging assignments
Record who disabled which accounts and when
Keep the signed termination notice and return-of-equipment form
Confirm that the exit checklist was completed by the manager and by IT
Coordinate timing with HR. Disable access immediately when the meeting begins, and make sure the person cannot remain logged in on a device.
Give these accounts an expiration date at creation. Review any outside vendor accounts quarterly, and remove those no longer needed.
When someone changes roles, update access to match the new job, and remove old permissions. Accumulated access is a hidden risk.
Consider suspending access for extended leave and reactivating on return.
Once a month, run a report of accounts with no sign-in for 30 or 60 days. Contact supervisors to confirm whether they should remain active. This catches people who left without a notice.
Only disabling email but leaving EHR access
Forgetting vendor portals, cloud tools and social media accounts
Not changing shared passwords
Deleting a mailbox before retention requirements are checked
No record that anything was done
Like onboarding, offboarding becomes easy with a checklist, a notification form and an owner. UnityCare IT can implement these processes for healthcare clients, including account reconciliation reports and dormant account reviews. If you suspect old accounts are still active in your systems, we can run a quick review and help you clean them up.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172