Care organizations have high turnover and heavy use of part-time, agency and float staff. That makes account management hard. New nurses start a shift without a working login, while a person who left months ago may still have access to email and the electronic health record. Both situations hurt: one slows care, the other creates a security and compliance risk.
The fix is not complicated. It is a shared checklist between human resources, department managers and IT, with clear timing and clear ownership.
The HIPAA Security Rule requires procedures for authorizing access to electronic PHI, for supervising workforce members and for terminating access when employment ends. Beyond compliance, stale accounts are a favorite target for attackers because nobody notices unusual activity on them.
HR should notify IT as soon as a hire is confirmed, with:
Full name, role, department and location.
Start date and manager.
Whether the person is full-time, part-time, agency or a contractor.
Any special access needs, such as supervisor rights, billing access or pharmacy modules.
IT can then prepare accounts, devices and training so the person is ready on arrival.
Instead of guessing access for each new hire, define standard packages by role. A certified nursing assistant needs different access than a business office manager. Templates make access consistent and follow the principle of minimum necessary, a core HIPAA concept.
Create the user account with a unique login. Never share logins.
Set up email and enroll the person in multi-factor authentication.
Assign EHR role and any application access.
Provide a device or workstation login, if applicable.
Complete privacy and security training and record the date.
Have the employee sign acceptable use and confidentiality policies.
Add the person to relevant distribution lists and phone directories.
Confirm that the manager has verified the access is correct.
Promotions and transfers are often forgotten. When someone changes roles, their old access should be reviewed and removed, not just added to. Otherwise, people accumulate permissions over time.
For voluntary departures, schedule access removal for the end of the last shift. For involuntary terminations, coordinate with HR so access is disabled at the time of notification. Make sure managers know to call IT right away, not after the exit paperwork is done.
Disable the main account and block sign-in.
Revoke access to the EHR, remote access and cloud applications.
Reset passwords on any shared or service accounts the person knew.
Remove the person from multi-factor authentication and recover any hardware keys.
Retrieve laptops, phones, badges, keys and any removable media.
Wipe or reassign mobile devices, including those enrolled for work email.
Forward or preserve email according to your retention policy, then remove the license when appropriate.
Remove access to door systems and phone voicemail.
Document completion with dates and the technician's name.
Even with good processes, drift happens. Every quarter, ask department managers to review a list of who has access to what and confirm that it is correct. Compare the list of active accounts to current HR records. Investigate accounts with no recent logins.
Agency nurses and contractors need access too, but it should be limited and time-bound. Set an automatic expiration date on their accounts and require the agency to notify you when an assignment ends.
Simple measures reveal problems quickly:
How many new hires had working access on day one?
How long does it take to disable accounts after departure?
How many active accounts belong to people who no longer work here?
Relying on managers to remember to email IT.
Sharing a generic login because a new hire is waiting.
Disabling the email account but forgetting the EHR or remote access.
Neglecting service accounts and personal cloud tools.
UnityCare IT supports onboarding and offboarding for healthcare and senior-living clients, including checklists, templates and access reviews. If you would like help tightening your process, we are glad to help.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172