A departing employee returns a laptop, the office manager updates the schedule, and the practice moves on. But has anyone checked the employee’s email sessions, EHR access, billing portal and shared folders?
For a Winter Garden medical office, a staff departure is both an administrative handoff and a technology change. The goal is straightforward: remove access that is no longer authorized while keeping the practice’s information and daily work available to the right people.
Use the checklist below with your practice manager, HR lead, IT provider and application vendors. It is an operational starting point—not a complete HIPAA assessment or legal advice.
1. Give the handoff one owner
Before the employee leaves, identify who authorizes the change, when access should end and who will confirm each action. Coordinate the timing with the person responsible for employment decisions. An IT provider should not have to guess whether a departure is immediate, scheduled or still confidential.
Create a simple record with five columns: system, responsible person, required action, completion time and verification. Include an escalation contact for anything that cannot be completed as planned.
A ticket marked “offboard employee” is less useful than a record showing exactly which systems were checked.
2. List accounts beyond the workstation
Start with the applications the person used during a normal workday:
- Email, calendars and collaboration tools.
- EHR and practice-management accounts.
- Billing, claims and payment-related portals.
- Shared files, document scanning and patient-communication tools.
- Remote-access services and any mobile work applications.
- Vendor portals or administrative accounts the employee managed.
Do not assume disabling the main network account disables every separate service. Ask each system owner how access is controlled. HHS’s audit protocol specifically examines procedures for ending access to electronic protected health information when employment or other arrangements end. HHS audit protocol
3. Separate access removal from record deletion
A former employee should not retain access simply because someone still needs their work. Equally, deleting an account too quickly can create an avoidable records or continuity problem.
Before deletion, determine what business information must remain available, who is authorized to receive it and whether a retention requirement or hold applies. Have the appropriate practice leader or adviser make that decision; do not use a generic retention period copied from a blog.
Microsoft’s offboarding guidance treats blocking access, preserving information and allowing authorized colleagues to access work content as distinct tasks. The correct steps depend on your setup. Have your administrator check the current instructions rather than assuming a password reset completes the process. Microsoft 365 offboarding overview
4. Close the device and credential handoff
Account for practice-owned laptops, phones, security keys, badges and other equipment. Record what was returned and what still needs attention. For personal devices used for work, follow the practice’s approved device policy and get IT guidance before taking action that could affect personal information.
Ask the administrator to check remaining sessions and access methods, not just the password. If the employee knew a shared credential, document where it is used and coordinate a change without interrupting essential services. Where practical, replace shared human logins with individually assigned accounts and appropriate permissions.
For a practice with staff working across offices or remotely, check every relevant system—not only equipment physically returned to one location.
5. Test the handoff without using the former employee’s identity
The replacement staff member should work through their own authorized account. Confirm they can reach the files, schedules and applications they need, with permissions appropriate to their role.
Have the system administrator verify that the departing user’s access is disabled as intended. Record unresolved vendor actions and follow them through to completion. Do not close the ticket merely because the laptop arrived at reception.
What to review this month
Choose one recent departure or role change and check the documentation. Can your team show who requested the change, which systems were covered, what happened to needed records and who verified the result?
If those answers are scattered across email threads, start with a consistent checklist. HHS describes risk analysis as a broader process covering risks to electronic protected health information; one offboarding checklist cannot replace it. HHS risk-analysis guidance
Get a clearer view of your practice’s IT responsibilities
CMIT Solutions West Orlando & Kissimmee can discuss your practice’s IT support needs and the areas you want reviewed. Explore our healthcare IT services in Winter Garden or contact the team to ask about the Free Vulnerability Report and its scope.
Please do not include patient information, passwords or sensitive records in your inquiry. A vulnerability report is not a complete HIPAA risk analysis or a guarantee of compliance.
