A departing employee returns a laptop, the office manager updates the schedule, and the practice moves on. But has anyone checked the employee\u2019s email sessions, EHR access, billing portal and shared folders?<\/p>\n
For a Winter Garden medical office, a staff departure is both an administrative handoff and a technology change. The goal is straightforward: remove access that is no longer authorized while keeping the practice\u2019s information and daily work available to the right people.<\/p>\n
Use the checklist below with your practice manager, HR lead, IT provider and application vendors. It is an operational starting point\u2014not a complete HIPAA assessment or legal advice.<\/p>\n
Before the employee leaves, identify who authorizes the change, when access should end and who will confirm each action. Coordinate the timing with the person responsible for employment decisions. An IT provider should not have to guess whether a departure is immediate, scheduled or still confidential.<\/p>\n
Create a simple record with five columns: system, responsible person, required action, completion time and verification. Include an escalation contact for anything that cannot be completed as planned.<\/p>\n
A ticket marked \u201coffboard employee\u201d is less useful than a record showing exactly which systems were checked.<\/p>\n
Start with the applications the person used during a normal workday:<\/p>\n
Do not assume disabling the main network account disables every separate service. Ask each system owner how access is controlled. HHS\u2019s audit protocol specifically examines procedures for ending access to electronic protected health information when employment or other arrangements end. HHS audit protocol<\/a><\/p>\n A former employee should not retain access simply because someone still needs their work. Equally, deleting an account too quickly can create an avoidable records or continuity problem.<\/p>\n Before deletion, determine what business information must remain available, who is authorized to receive it and whether a retention requirement or hold applies. Have the appropriate practice leader or adviser make that decision; do not use a generic retention period copied from a blog.<\/p>\n Microsoft\u2019s offboarding guidance treats blocking access, preserving information and allowing authorized colleagues to access work content as distinct tasks. The correct steps depend on your setup. Have your administrator check the current instructions rather than assuming a password reset completes the process. Microsoft 365 offboarding overview<\/a><\/p>\n Account for practice-owned laptops, phones, security keys, badges and other equipment. Record what was returned and what still needs attention. For personal devices used for work, follow the practice\u2019s approved device policy and get IT guidance before taking action that could affect personal information.<\/p>\n Ask the administrator to check remaining sessions and access methods, not just the password. If the employee knew a shared credential, document where it is used and coordinate a change without interrupting essential services. Where practical, replace shared human logins with individually assigned accounts and appropriate permissions.<\/p>\n For a practice with staff working across offices or remotely, check every relevant system\u2014not only equipment physically returned to one location.<\/p>\n The replacement staff member should work through their own authorized account. Confirm they can reach the files, schedules and applications they need, with permissions appropriate to their role.<\/p>\n Have the system administrator verify that the departing user\u2019s access is disabled as intended. Record unresolved vendor actions and follow them through to completion. Do not close the ticket merely because the laptop arrived at reception.<\/p>\n Choose one recent departure or role change and check the documentation. Can your team show who requested the change, which systems were covered, what happened to needed records and who verified the result?<\/p>\n If those answers are scattered across email threads, start with a consistent checklist. HHS describes risk analysis as a broader process covering risks to electronic protected health information; one offboarding checklist cannot replace it. HHS risk-analysis guidance<\/a><\/p>\n CMIT Solutions West Orlando & Kissimmee can discuss your practice\u2019s IT support needs and the areas you want reviewed. Explore our healthcare IT services in Winter Garden<\/a> or contact the team<\/a> to ask about the Free Vulnerability Report and its scope.<\/p>\n Please do not include patient information, passwords or sensitive records in your inquiry. A vulnerability report is not a complete HIPAA risk analysis or a guarantee of compliance.<\/p>\n","protected":false},"excerpt":{"rendered":" A departing employee returns a laptop, the office manager updates the schedule,…<\/p>\n","protected":false},"author":1144,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-773","post","type-post","status-publish","format-standard","hentry","category-local-it"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t3. Separate access removal from record deletion<\/h2>\n
4. Close the device and credential handoff<\/h2>\n
5. Test the handoff without using the former employee\u2019s identity<\/h2>\n
What to review this month<\/h2>\n
Get a clearer view of your practice\u2019s IT responsibilities<\/h2>\n