A healthcare IT offboarding checklist should cover more than disabling an employee’s EHR login. Staff may also have access to email, remote connections, cloud services, vendor portals, shared devices, and physical areas. Missed accounts can leave patient information exposed or create confusion for the team taking over the work.
Start by coordinating with the employee’s manager, HR, and whoever administers your systems. Set the effective time for access changes, assign an owner to each task, and record how completion will be confirmed. The NIST guide to implementing the HIPAA Security Rule provides an additional reference for organizations developing security procedures. HIPAA applicability can differ by organization, so practices should confirm which requirements apply to them.
Before the departure: prepare the handoff
As soon as a departure or role change is confirmed, identify what the person can access and what work needs to continue. Do not rely on memory or a list that only covers centrally managed accounts. Ask the manager and employee, where appropriate, to identify clinical systems, shared resources, vendor tools, and any applications used outside the usual sign-in process.
- Set the effective time. Coordinate the access-change time with HR and the manager. For an unplanned or urgent departure, follow the organization’s established response process.
- Assign an owner. Name a responsible person for each system or access category, including systems administered by a vendor.
- List accounts and dependencies. Include named accounts, shared accounts, single sign-on connections, remote-support tools, application integrations, and credentials the employee may know.
- Plan the clinical handoff. Identify pending results, messages, prescriptions, appointments, referrals, and other assigned work. Reassign each item through authorized accounts and workflows.
- Protect records and files. Determine what work information needs to be retained and who should receive access to it. Follow the practice’s records and retention procedures.
Keep care continuity separate from access continuity: transferring a person’s work does not require keeping their login active. If a change of EHR access or records ownership raises questions, see this guide to accessing records after an EHR change.
Access to remove or update
EHR and clinical systems
Disable the departing employee’s individual EHR account at the agreed effective time. Check other clinical applications the person used, such as scheduling, prescribing, laboratory, imaging, billing, patient communication, or telemedicine systems. The exact systems will depend on the practice.
- Remove the user’s sign-in and any elevated privileges.
- End active sessions where the system supports it.
- Review assigned tasks and route them to the appropriate staff member.
- Check whether the account has access through a separate application or a vendor-managed system.
Avoid transferring the departing employee’s credentials to a colleague. Assign work to an authorized user and make sure the new user has the right access for their role.
Email and collaboration
Disable the employee’s email and collaboration sign-in according to the planned timing. Review access to shared mailboxes, calendars, document libraries, chat, and file-sharing spaces. If the practice needs to preserve messages or files, use an authorized administrative process and grant access to the appropriate replacement or manager.
Do not leave an account active simply to forward messages without reviewing the implications. Decide who will handle incoming patient or business communications, how the change will be communicated internally, and how records will be retained under practice procedures.
Remote access and identity accounts
Revoke access to the identity provider and any remote access used to reach clinic systems. This may include VPN, remote desktop, cloud consoles, remote-support tools, and multifactor authentication methods tied to the person’s account or device.
- Disable the user’s identity account and remove relevant group memberships.
- Revoke active sessions, tokens, and remembered devices where those controls are available.
- Remove access to remote work tools, including support portals that may be managed separately.
- Check for alternate or local accounts that do not rely on central sign-in.
For broader guidance on managing remote support in a clinical environment, review the practice’s remote IT support procedures.
Connected apps, vendor portals, and credentials
Build an inventory beyond the main EHR and email. Connected apps may use single sign-on, a separate username and password, an integration account, or a vendor-managed portal. Include tools for billing, patient engagement, document storage, communications, and device management when the employee had access.
- Remove the person’s individual access from each application and vendor portal.
- Ask vendors to confirm removal when the practice cannot administer the account directly.
- Review shared credentials, API credentials, and secrets the departing employee could access. Rotate them when appropriate under your security process.
- Check integrations and service accounts carefully so that removing a person does not unintentionally interrupt a clinical connection.
Keep a record of who contacted each vendor and what confirmation was received. If an access change could affect an integration, coordinate its timing with the system owner before making the change.
Devices and physical access
Collect practice-owned computers, phones, tablets, storage devices, badges, keys, and access cards. Record what was returned and route devices through the organization’s approved process for securing or preparing them for reassignment.
Disable badge and door access at the appropriate time, including access to restricted areas. If a device is missing or cannot be returned, follow the practice’s incident and device-management procedures. Do not assume that collecting a device also disables its accounts or sessions.
Confirm and document completion
Use a checklist or ticket that shows the system, assigned owner, effective time, action taken, and confirmation method. Mark an item complete only after checking the system or receiving confirmation from the responsible administrator or vendor.
- Test sign-in denial for key accounts when it can be done safely.
- Verify that remote access and active sessions are revoked, not just that a password was changed.
- Check that email, files, clinical tasks, and shared resources have an authorized new owner.
- Record unresolved access, the person responsible for follow-up, and the next action.
- Retain the completed record according to the practice’s policies.
For help reviewing access controls and related procedures, Zevonix provides healthcare IT and compliance support to providers in Jacksonville and Northeast Florida. Its guidance on preparing for a healthcare compliance review can help practices consider how their processes are documented.
When an employee changes roles
A transfer calls for an access review rather than a simple account shutdown. Remove permissions the employee no longer needs, add only the access required for the new role, and update group memberships, remote access, and application assignments. Check whether the change affects clinical responsibilities or approvals, then document who authorized and completed the updates.
Frequently asked questions
When should a departing employee’s EHR access be disabled?
Set the effective time with the appropriate practice leaders and coordinate the change with the employee’s departure plan. Ensure clinical work is reassigned, then confirm the account is disabled at the agreed time. Follow your organization’s established process for urgent departures.
How can a practice confirm all access has been removed?
Work from an inventory that includes separate vendor and connected-app accounts, not only centrally managed logins. Assign an owner to each item, verify the change in the system or with the vendor, and record the result and any follow-up.
What should happen to the departing employee’s email and files?
Preserve relevant work information through an authorized administrative process. Assign a new owner for needed communications and files, and follow the practice’s retention and access procedures.
Should a clinic deactivate an account when someone transfers roles?
Review and adjust the person’s permissions for the new responsibilities. Remove access that is no longer needed, grant only approved access, and document the change rather than leaving old permissions in place.
Make offboarding repeatable
A reliable healthcare IT offboarding checklist ties every access change to a responsible owner, a clear effective time, and a confirmation. Pair that process with a clinical handoff so patient-related work continues through authorized accounts. If your practice needs help reviewing its offboarding process, contact Zevonix at (904) 658-0777.