Employee access changes constantly. A new hygienist joins. A billing specialist moves into a supervisory role. A temporary contractor finishes an engagement. A practice manager leaves unexpectedly. Each event changes who should be able to reach ePHI, business systems, facilities, and devices.
The HIPAA Security Rule’s workforce-security provisions require regulated entities to implement policies and procedures so workforce members have appropriate access to ePHI and to establish procedures for terminating that access when employment or another arrangement ends—or when a role change requires less access. A repeatable operational workflow turns those requirements into evidence.
Start with role-based access
Define access profiles for common roles before a new employee arrives. Front-desk staff, providers, hygienists, assistants, billers, managers, and IT administrators should not receive the same access. Profiles should specify the systems, data, privilege level, locations, devices, and physical areas required for each role.
Use least privilege: grant the minimum access needed to perform assigned duties. Exceptions should be approved, time-limited where practical, and recorded. This approach makes onboarding faster and gives reviewers a baseline for detecting unnecessary access later.
A secure onboarding workflow
1. Submit one authoritative request
The hiring manager should submit the worker’s legal name, start date, job role, location, employment type, manager, systems required, and any approved exceptions. IT should not create access from informal texts or hallway requests.
2. Create unique identities
Create a unique account for the worker in the organization’s identity system and in applications that cannot use centralized sign-on. Avoid shared logins. A unique identity supports accountability, access reviews, audit logs, and timely termination.
3. Apply the approved access profile
Grant group memberships and application roles from the approved profile. Separate ordinary user access from administrative access. Record the approver and completion time, particularly for systems containing ePHI, cloud administration, remote access, and physical access controls.
4. Enroll strong authentication
Require a password change at first use, enroll MFA before enabling remote or sensitive access, and issue recovery methods through an approved process. Do not send long-lived passwords through ordinary email or leave credentials on a desk.
5. Configure and record devices
Issue managed devices with supported software, encryption, endpoint protection, screen-lock settings, patch management, and remote-management controls. Record serial numbers, assigned user, accessories, issue date, and expected return condition.
6. Complete training before independent access
Training should cover privacy and security responsibilities, phishing reporting, approved communication methods, device handling, incident reporting, physical security, and role-specific workflows. Retain completion records and reinforce the organization’s sanctions policy.
7. Verify readiness
Before the employee independently handles ePHI, confirm that accounts work, access matches the approved role, MFA is active, the device reports to management tools, and required training is complete. Close the onboarding ticket with evidence rather than assuming the process finished.
Handle job changes as controlled access events
Promotions, transfers, leave, location changes, and responsibility changes can create more risk than initial hiring because old access often remains while new access is added. Treat every role change as both an addition and a removal exercise.
- Compare the old and new role profiles.
- Remove access no longer justified before or when new duties begin.
- Review elevated privileges and application-specific roles.
- Update physical access, equipment ownership, and remote-access permissions.
- Provide new training when responsibilities or data access materially change.
- Record approvals and completion.
A secure offboarding workflow
The timing and sequence should reflect the circumstances. For an involuntary separation or elevated-risk departure, coordinate access termination with HR and management so it occurs at the authorized time—not hours later. For planned departures, prepare the work transfer without leaving accounts active beyond the end of the arrangement.
1. Establish the termination time and owner
Use one offboarding record that identifies the person, effective time, manager, systems, devices, physical credentials, vendors, and responsible owners. Avoid relying on memory or a generic email distribution list.
2. Disable sign-in and active sessions
Disable the primary identity, revoke active sessions and authentication tokens, remove remote access, and block application accounts that are not centrally controlled. Address email, EHR and imaging systems, practice-management tools, cloud services, VPN, remote support, password managers, scheduling, file sharing, and any vendor portals.
3. Protect business information
Preserve email, files, and records according to policy. Transfer ownership of shared resources, automation, calendars, service credentials, and vendor relationships. Do not simply delete the account before required business and compliance information is retained.
4. Recover devices and physical access
Collect laptops, mobile devices, removable media, keys, badges, tokens, and other access-control devices. Confirm return against the asset record. If a managed device cannot be recovered, use the organization’s lost-device and incident procedures rather than treating it as an ordinary inventory discrepancy.
5. Change shared secrets that still exist
Shared accounts should be eliminated where possible. Until then, change any password, door code, alarm code, vendor credential, or recovery secret the departing worker knew. Review service accounts and automation they managed so a password change does not unintentionally interrupt operations.
6. Verify and document completion
Run a final check across the identity provider, applications, devices, remote-access tools, physical controls, and vendor systems. Record completion times and exceptions. Periodic access reviews can catch missed accounts, but they are not a substitute for timely termination.
Do not forget non-employees
The workforce can include people whose access is easy to overlook: contractors, students, temporary staff, volunteers, and others under the organization’s direct control. Vendors and business associates may also have remote access, administrator identities, API credentials, or support accounts.
Every non-employee identity should have a sponsor, defined purpose, approved access, review date, and end date. Disable access when the purpose ends, even if the underlying vendor contract remains active.
Evidence worth retaining
- Approved onboarding, role-change, and termination requests.
- Role profiles and documented access exceptions.
- Account creation, privilege assignment, and disablement records.
- Training completion and policy acknowledgement.
- Device assignment and return records.
- Periodic access-review findings and corrective actions.
- Exceptions, incidents, and unresolved access items with named owners.
Authoritative resources
- HHS OCR HIPAA Audit Protocol: Workforce Security and Termination Procedures
- HHS: Summary of the HIPAA Security Rule
- NIST SP 800-66 Rev. 2
This article is educational and is not legal advice. Organizations should tailor workforce procedures to their size, systems, agreements, risk analysis, and applicable requirements.
Related resources
HIPAA Risk Analysis for Dental Practices
Learn More about HIPAA risk analysis for dental practices
Ransomware Readiness for Healthcare
Learn More about ransomware readiness for healthcare