A departing employee may have accounts in the EHR, email, remote access tools, billing portals, cloud storage, and more. This healthcare employee account deactivation checklist gives practice managers a practical way to prioritize access removal while protecting patient information and keeping work covered.
Start with the employee’s identity and most powerful access, then check systems that may not be connected to central sign-on. Coordinate with the appropriate practice and IT leads, and treat access removal and work continuity as related tasks.
Start with central sign-on and privileged access
If your practice uses a central identity or single sign-on account, disable the departing employee’s account as part of the first actions. This can block access to connected services, but it does not prove that every application account has been turned off.
Check for administrator or other elevated access as well. If the employee could manage user accounts, security settings, servers, or network equipment, remove those permissions and review any accounts or credentials they controlled. For shared passwords or administrator credentials the employee knew, change them and update the authorized users who need access.
Use the account and access practices in the HHS cybersecurity practices guide for small healthcare organizations as a reference when reviewing your process.
Disable access in a practical priority order
The right sequence depends on the employee’s role and how your systems are configured. For an urgent departure, coordinate with the responsible practice manager and IT support so access can be removed promptly without losing control of essential clinical or administrative work.
- EHR and practice-management systems. Disable the user account and check for separate access to scheduling, patient messaging, clinical documentation, and administrative functions. Remove permissions that are no longer needed, and confirm that the account cannot sign in.
- Email and collaboration tools. Disable the employee’s sign-in, including connected calendars, messaging, and file-sharing access. Arrange authorized coverage for business correspondence and upcoming work before removing access, where practical.
- Remote access. Revoke VPN, remote desktop, virtual desktop, and other ways to connect to practice systems from outside the office. Check whether access was saved on a practice-managed or personal device and take appropriate steps to end active sessions or remove access.
- Billing and external portals. Review billing systems, payer portals, payment tools, laboratories, pharmacies, and other third-party services the employee used. These may have separate usernames and may not be controlled by your main sign-on account.
- Cloud and other applications. Check shared storage, backup consoles, telehealth platforms, patient communication systems, document tools, and any other service used for practice work. Revoke access to shared files and folders as well as the individual account.
For each system, record who completed the action and when. Keep a list of systems checked, accounts disabled, credentials changed, and any access that still needs follow-up. The NIST security and privacy controls include broader access-control guidance that can help inform an organization’s procedures.
Do not assume one sign-in controls everything
Disabling a central sign-on account may stop access to connected applications, but some systems use separate credentials or local accounts. EHR access, billing portals, cloud applications, and vendor services can each require a separate check.
Ask your IT support contact or system administrator which services are linked to central sign-on and which are independent. Verify the result by reviewing the account status in each relevant system or using an authorized test process. If a system is managed by a vendor, confirm that the vendor has removed the user’s access too.
This distinction is especially important for EHR access removal. A disabled email account does not necessarily disable a separate EHR login, and removing a user from one application does not automatically remove access to every connected service. For help planning EHR access and support processes, see Zevonix’s page on EHR support for Daytona Beach practices.
Preserve records and hand off unfinished work
Access removal should not erase organizational records or leave patient-related tasks without an authorized owner. Before disabling accounts, identify work that needs coverage, such as incoming messages, appointments, open documentation, referrals, billing follow-up, and administrative requests.
Use your organization’s approved process to retain business records and assign an authorized person to manage the work. Do not keep a former employee’s sign-in active just to preserve access to their inbox or files. Instead, use administrative controls, mailbox delegation, shared work queues, or another approved method that keeps access attributable to the person doing the work.
For clinical tasks, follow the practice’s established procedures for review and completion. If a system’s account closure could affect records or workflow, coordinate with the system administrator before making changes, while still addressing any immediate access risk.
Include contractors and vendors
The same review applies when a contractor, temporary worker, or vendor stops working with the practice. Identify the accounts, remote connections, shared folders, devices, and support tools they used. Ask the relevant vendor or account owner to confirm that access has ended, and update shared credentials they may have known.
A vendor list and documented access owner can make this easier. Zevonix’s guide to healthcare IT vendor management offers related considerations for keeping third-party relationships and responsibilities organized.
Frequently asked questions
Which accounts should a medical practice disable first?
Begin with central sign-on and any administrator or privileged access, then check the EHR, email, remote access, billing and payer portals, cloud storage, and other work applications. The employee’s role and your system setup determine which accounts need immediate attention.
Does disabling email or single sign-on also disable EHR access?
Not necessarily. Some EHRs are connected to central sign-on, while others use separate accounts. Verify the EHR account directly and check other applications for separate credentials.
How quickly should access be revoked?
Coordinate access removal with the effective departure and the employee’s role. If there is an urgent security concern, involve your practice leadership and IT support promptly. Do not rely on a later review as a substitute for addressing immediate access.
What should we do about shared passwords or unfinished work?
Change shared credentials the person knew and provide updated access only to authorized users. Assign an authorized colleague to manage pending work and retained organizational records through approved administrative access, not by keeping the former employee’s account active.
Make offboarding a repeatable process
A clear healthcare employee offboarding process checks central sign-on, privileged accounts, EHR access, email, remote connections, and each relevant application, then verifies and documents the changes. Pair that checklist with a plan for records and unfinished work. For support with healthcare IT access and security processes in Daytona Beach and Central Florida, contact Zevonix at (386) 260-0777.