An employee offboarding access checklist for clinics can help prevent former staff from retaining access to patient information, work accounts, or clinic spaces. The process should cover more than the main EHR login: email, remote access, cloud applications, shared devices, and physical entry all matter.
Plan access changes around the departure and the clinic’s approved procedures. A planned departure may allow time to prepare, while an involuntary separation may call for a coordinated change as the employment relationship ends. There is no single timing rule that should be assumed to fit every situation. Assign an owner, follow the practice’s policies, and coordinate with the appropriate clinical, privacy, and IT leads.
Prepare before the employee’s last day
Start with a list of the person’s access and clinic property. Ask the employee’s manager, IT contact, and relevant application owners to identify systems they use, including less obvious accounts for scheduling, billing, messaging, document storage, or vendors. Confirm who will approve each change and who will verify it.
- Confirm the departure date and whether access changes need to be coordinated with the employee’s final work activities.
- Identify the employee’s role, the systems they use, and any elevated or administrative permissions.
- Assign an owner for each account, device, badge, key, and access code that needs attention.
- Arrange for continued, authorized access to work records and patient information after the employee leaves.
- Decide how to handle work email, voicemail, scheduled tasks, and messages that need a new owner.
For remote connections, make sure the checklist covers the clinic’s VPN or other remote access methods, not only office-based sign-ins. Zevonix’s guidance on medical practice remote access can help practices consider those entry points as part of their overall access plan.
Disable accounts across the clinic’s systems
On the agreed schedule, disable the departing employee’s individual sign-in and check each system on the inventory. Avoid assuming that disabling one account automatically removes access everywhere. Depending on how systems are set up, access may be managed separately by the clinic, an application vendor, or a service provider.
Identity, email, and communication tools
Disable the person’s primary work account and review linked email, calendar, messaging, and collaboration tools. Decide whether business messages need to be retained or routed to an authorized colleague under clinic policy. Remove access to stored credentials, shared mailboxes, and any recovery methods tied to the former employee. For email-related safeguards, see Zevonix’s article on doctor office email security.
EHR and practice-management systems
Revoke the employee’s individual EHR and practice-management access, including any separate accounts for scheduling, billing, patient communications, or records workflows. Review assigned roles and permissions rather than simply changing a password. Confirm that records, tasks, and messages can still be handled by authorized staff, and avoid deleting information the practice needs to retain.
Remote access, cloud apps, and vendor accounts
Disable remote access and review cloud storage, file-sharing, telehealth, e-prescribing, imaging, and other services the employee could reach. Check whether a vendor has its own user directory or support portal. If the departing employee had administrative access, confirm that another authorized person can manage the system and that the former employee’s credentials no longer work.
For broader context on clinic technology support and access safeguards, see HIPAA IT support for doctors.
Review shared and generic accounts
Shared accounts can make it harder to know who accessed a system and whether access has been removed. When a departing employee knew a shared password, ask the system owner whether it should be changed and who needs the updated credential. Review generic accounts, service accounts, administrator accounts, and saved passwords on shared workstations. Do not disable an account that a device or service depends on until an authorized owner has checked its purpose and arranged a safe alternative.
Where a system supports individual accounts, use them so staff access can be assigned and removed person by person. A checklist should record who approved any exception and who is responsible for correcting it.
Secure devices and physical access
Collect clinic-owned laptops, phones, tablets, storage devices, keys, and access badges. Confirm that clinic equipment is returned or otherwise secured, and remove the employee’s access to building systems, door codes, and shared work areas as appropriate. Consider shared workstations too: sign out of accounts, remove saved credentials, and check whether the device has unattended sessions.
If the employee used a personal device for work, follow the clinic’s established process before removing data or wiping the device. First determine whether clinic information, including ePHI, may be present and how authorized records will be preserved. Coordinate with the privacy or security lead and IT support. Avoid an unplanned wipe that could remove information the clinic needs or affect the employee’s personal data.
Verify and document completion
Do not treat a request to disable access as proof that access is gone. Have the assigned owner confirm the status of each account and access method, including any vendor-managed systems. Document what was reviewed, who completed the work, any exceptions, and how each outstanding item will be resolved. Keep the record in the location and format specified by clinic policy.
The CISA Cross-Sector Cybersecurity Performance Goals Checklist is a reference for organizations reviewing practical cybersecurity actions. For a clinic, the useful habit is to make access changes verifiable and assign responsibility rather than relying on an informal handoff.
Florida Statutes § 456.057 addresses ownership and control of patient records and disclosure of information; practices can review the Florida statute on patient records with their compliance or legal contacts to understand how it applies to their circumstances. This is distinct from determining the practice’s HIPAA obligations. For HIPAA-related questions, consult the practice’s privacy or security lead and qualified compliance guidance. This checklist is operational guidance, not a legal determination.
Frequently asked questions
When should a clinic disable a departing employee’s access?
Use a documented process coordinated with the departure and the person’s final work activities. Planned and involuntary departures may require different coordination; do not assume one universal deadline applies to every case.
Which accounts should be disabled?
Review the employee’s individual identity and email accounts, EHR and practice-management access, remote access, cloud applications, vendor portals, and any accounts with elevated permissions. Also check shared credentials and devices where sign-ins may remain active.
What should the clinic do about shared logins?
Identify which systems use shared credentials and whether the former employee knew them. Have the system owner decide whether to rotate credentials, preserve necessary service access, and move staff toward individually assigned accounts where available.
Should the clinic collect badges, keys, and devices?
Yes, include clinic property and physical entry in the offboarding process. For personal devices that may contain ePHI, follow clinic policy and coordinate before removing data or wiping anything.
How can the practice show access was removed?
Keep a completion record showing the system or access method, the person responsible, the result, and any follow-up needed. Include verification rather than recording only that a request was submitted.
Make offboarding a repeatable clinic process
A reliable offboarding process accounts for digital access, devices, shared credentials, and physical entry, then confirms that each action is complete. Review the checklist with the people responsible for staffing, privacy, and IT, and update it when systems or workflows change. If your clinic would like help reviewing its IT access process, contact Zevonix to discuss support for medical practices across Florida.