A clinic employee offboarding IT access checklist should cover more than email and the electronic health record (EHR). Staff may also have access to prescribing tools, billing platforms, external portals, remote connections, shared devices, and the building itself. A consistent process helps the clinic end access when it is no longer appropriate while keeping patient-care work and business records available to authorized staff.
Coordinate the offboarding with the employee’s manager and the people responsible for IT, human resources, and clinic operations. Confirm the departure timing and role, identify systems the employee used, and make clear who will take over any open work. The aim is to remove the departing person’s access, not to erase records the clinic may need to retain.
Before the last day: identify access and continuity needs
Start with the employee’s role and actual access, rather than relying on a general list of applications. Check account directories, access requests, device records, vendor portals, and information from the employee’s manager. Include systems that are administered separately from the clinic’s main sign-in process.
- List the accounts and systems: Include email, identity and single sign-on, EHR and practice-management software, scheduling, billing, file storage, messaging, telehealth, patient portals, and any role-specific applications.
- Ask about specialty workflows: Depending on the role and setting, check surgical scheduling and documentation, behavioral health platforms, home health tools, urgent care systems, prescribing applications, and multi-location resources.
- Find separately managed access: Look for vendor and external portals, local accounts, administrative accounts, remote support tools, and any systems that do not use the clinic’s central login.
- Assign work ownership: Identify who will manage pending tasks, shared files, team resources, mailbox needs, and patient-care follow-up. Keep access limited to the staff who need it.
If the employee supports remote work, include the connections and devices used outside the clinic. The guidance on remote working solutions for healthcare organizations can help frame that part of the review.
On the last day: revoke access across systems
When employment ends, disable the employee’s access according to the clinic’s policies and coordinated offboarding plan. Do not assume that disabling one central account automatically closes access everywhere. For systems managed by a vendor or another team, send a clear request and track confirmation.
Identity, email, and collaboration
- Disable the employee’s main account and any separate user or administrator accounts.
- Remove access to email, calendars, messaging, shared drives, document platforms, and collaboration tools.
- Review group memberships, shared mailboxes, forwarding rules, delegated access, and application permissions. Transfer needed work resources to an authorized owner rather than leaving the former employee’s access active.
EHR, clinical, and prescribing systems
- Revoke access to the EHR, practice-management system, scheduling, patient portals, telehealth platforms, and clinical messaging tools.
- Include prescribing systems and other clinical applications that may use separate credentials or authentication.
- Check for saved sessions on shared workstations and devices, and confirm that the employee cannot use an alternate account or access path.
For prescribing tools, follow the system’s own account and credential procedures, as well as the clinic’s policies. Avoid treating a general account shutdown as confirmation that every clinical application has been addressed.
Billing, external portals, and vendors
- Review billing, claims, payment, laboratory, imaging, referral, insurance, and other external portals used for the employee’s work.
- Remove the person from vendor accounts, contact lists, and shared credentials where applicable. Change shared credentials when the departing employee knew them, and provide new credentials only to authorized staff.
- Ask system owners or vendors to confirm access removal when the clinic cannot administer the account directly.
Remote access, active sessions, and authentication
- Revoke remote desktop, virtual private network, cloud, and other remote access permissions.
- End active sessions and revoke remembered or trusted sessions where the system offers those controls.
- Remove the employee’s registered multifactor authentication methods, recovery options, tokens, and trusted devices from affected accounts.
- Review privileged access and credentials the employee could use to manage other accounts, systems, or devices. Make sure an authorized person remains responsible for any necessary service or administrative account.
These checks matter because an account can appear disabled in one place while a separate session, authentication method, or vendor-managed login remains available.
Collect devices and physical access items
Make a record of clinic property and access items issued to the employee, and document what is returned or remains outstanding. Depending on the role, this may include computers, phones, tablets, storage media, security tokens, badges, keys, and access cards. Remove building or restricted-area access through the appropriate facilities process.
If a personal device was used for work, follow the clinic’s established process for removing work access and protecting clinic information. Avoid deleting personal content. If a device is missing, cannot be returned, or may still hold work data, escalate it through the clinic’s security process rather than treating the offboarding as complete.
Preserve records and verify completion
Disabling an account is different from deleting its contents. Preserve clinical and business information according to the clinic’s retention and records-handling procedures. Arrange authorized access to work files, mailbox items, and active patient-care records when needed, while keeping access appropriately limited. Retain relevant system logs and evidence of the offboarding steps according to clinic policy.
Use a checklist or ticket to record the system, action taken, person responsible, and confirmation. Mark items that depend on vendors or other teams as pending until they confirm completion. Then verify the result by reviewing account status and access lists, checking remote access and active sessions, and confirming that the employee’s authentication methods and physical credentials are no longer usable.
A healthcare IT compliance audit checklist can help clinics think through how to document access controls and review evidence. For staff-facing processes, see the guidance on HIPAA training for staff.
Frequently asked questions
When should a clinic disable a departing employee’s accounts?
Coordinate account changes with the employee’s departure and the clinic’s established process. Make sure the timing is clear to the responsible teams, and confirm that access is disabled when the employee’s authorization to use clinic systems ends.
Does HIPAA require clinics to terminate access to ePHI when employment ends?
Clinics should manage access to protected health information according to their policies and applicable requirements. The exact steps depend on the clinic’s circumstances and systems, so involve the appropriate compliance or privacy lead when questions arise.
Should a clinic revoke active sessions and MFA methods, too?
Yes, include them in the review. Check for active sessions, remote connections, remembered devices, recovery options, and authentication methods that could provide a route back into an account.
Should the clinic delete the departing employee’s files and mailbox?
Not automatically. Preserve records the clinic needs under its established procedures, transfer ownership of work resources to authorized staff, and remove the former employee’s ability to access them.
Make offboarding a repeatable clinic process
Reliable offboarding covers identities, clinical and business applications, external services, remote access, authentication, devices, and physical entry. Pair each access change with a continuity step and a record of verification. For help reviewing healthcare technology access and offboarding controls, contact Zevonix about its free IT assessment.