Staff turnover is a fact of life in healthcare. Every hire creates IT work, and every departure creates risk. New employees who cannot log in on their first shift are frustrated and unproductive. Former employees whose accounts remain active are a quiet security and compliance problem. A repeatable process handles both.
HIPAA requires procedures for authorizing and supervising access to electronic protected health information, and for terminating access when employment ends. In practice, that means HR, department heads and IT need to talk to each other on a predictable schedule, not through hallway conversations.
HR notifies IT as soon as a start date is confirmed, ideally a week ahead.
The manager specifies the role, the department and which systems the person needs.
Use role-based access rather than copying another employee's accounts. A new aide should not inherit a former director's permissions.
Create the user account with a unique username. No shared logins.
Prepare equipment if needed: a laptop, badge, or access to a shared workstation.
Create the email account and add the person to the right distribution lists.
Request EHR access, such as in PointClickCare, according to the role and the facility's policy.
Confirm any required training or competency checks come first.
Document who approved each level of access.
Provide a short orientation on passwords, multi-factor authentication and phishing.
Have the employee sign the acceptable use and confidentiality policies.
Help them set up MFA in person.
Show them how to reach the helpdesk and what to include in a request.
Test that they can log in to each system before they need it with a resident.
Check in with the manager about missing access or confusing steps.
Confirm training completion is recorded.
HR notifies IT of a planned departure as early as possible. For involuntary terminations, coordinate timing so access is removed at the moment of notification.
Identify who needs access to the departing employee's files and email.
Disable accounts for email, EHR, VPN, remote access, cloud applications and any vendor portals.
Reset passwords on any shared accounts the person knew, such as a shared mailbox, alarm panel code or Wi-Fi credential.
Collect laptops, phones, tablets, badges, keys and tokens. Record serial numbers.
Remove the person from multi-factor authentication systems and mobile device management.
Forward email or grant a manager access for a defined time, then delete according to your retention policy.
Remove them from distribution lists and group chats.
Confirm that returned devices are wiped and prepared for reuse.
Review access logs for unusual activity, especially after a contentious departure.
Update your asset list.
Close any third-party accounts, such as payer or pharmacy portals, set up under that person's name.
Contractors and agency staff: They often get accounts quickly and lose them slowly. Set expiration dates when accounts are created.
Transfers between departments: A move is both an offboarding and an onboarding. Remove old access that is no longer needed.
Personal devices: If staff use personal phones for email or MFA, make sure you can remove work data when they leave.
Shared credentials: If a departed employee knew a shared password, change it.
Forgotten accounts: Periodically compare the active user list to the HR roster.
Track a few simple numbers: how long new hires wait for access, how long it takes to disable accounts after departure, and how many active accounts do not match an employee. Review them quarterly with administration.
Use a standard form or ticket template for both processes, with checkboxes for each system and a field for the approver. It saves time, creates an audit trail and reduces mistakes.
UnityCare IT provides onboarding and offboarding as part of its helpdesk services for healthcare organizations, including templates, account audits and coordination with HR. If you are not sure all former employees have lost access, we can run a review and give you a list.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172