Employee turnover is a normal part of running a healthcare or dental practice. People change jobs, move to new opportunities, retire, or leave unexpectedly.
But when an employee leaves, your IT team has one more important question to answer:
Did their access leave with them?
A former employee’s email account, practice management login, remote access credentials, or saved passwords can create a serious security risk if they remain active after the employee is gone. For healthcare and dental practices, this is more than an IT oversight. It can become a HIPAA compliance risk.
The good news is that employee offboarding is one of the simplest areas to improve. A consistent offboarding process can help protect patient information, reduce unauthorized access, and close security gaps before they become bigger problems.
Why Employee Offboarding Matters for HIPAA Compliance
Healthcare practices handle protected health information (PHI) every day. Employees may have access to electronic health records, billing systems, email accounts, imaging software, patient portals, and other systems containing sensitive information.
When an employee leaves, their access should be reviewed and removed based on the practice’s policies and security procedures.
The problem is that employee departures can happen quickly.
A hygienist may give notice on Friday and leave that same day. An office administrator may suddenly resign. A temporary employee may finish an assignment without anyone notifying the person responsible for IT.
When communication breaks down, accounts can remain active.
A former employee may still be able to log into email, access cloud applications, connect remotely, or view information they no longer need.
That creates an unnecessary risk.
The Hidden Security Gap: Lingering Access
One of the biggest problems with employee turnover is not necessarily a sophisticated cyberattack.
Sometimes, the problem is an account that was simply never disabled.
Imagine a former dental office administrator still has access to the practice management system weeks after leaving. Or a former employee’s Microsoft 365 account continues forwarding messages to a personal email address.
These situations can expose sensitive information without anyone realizing it.
Lingering access can happen through:
- Email accounts
- Electronic health record systems
- Practice management software
- Imaging systems
- Cloud applications
- VPN accounts
- Remote desktop access
- File-sharing platforms
- Wi-Fi credentials
- Administrative accounts
- Password managers
The more systems an employee uses, the more important a structured offboarding process becomes.
What Can Happen If Former Employees Keep Their Access?
Not every former employee will misuse their access. Most will not.
The issue is that healthcare organizations should not rely on trust alone to protect patient information.
An active account can be compromised by someone else. A former employee’s password may be reused elsewhere, stolen through phishing, or stored on an old device.
If attackers gain access to that account, they may be able to enter systems that still trust the user’s credentials.
There is also the risk of accidental access. A former employee may receive an email containing patient information simply because their account was never properly closed.
From a security perspective, the safest approach is simple:
When someone no longer needs access, their access should be removed.
A Healthcare Employee Offboarding Checklist
A strong offboarding process should be consistent every time an employee leaves, whether they are a doctor, hygienist, receptionist, billing specialist, or temporary worker.
Here are the key steps practices should consider.
1. Disable User Accounts
The first step is to disable the employee’s accounts.
This can include:
- EHR or practice management software
- Cloud applications
- VPN access
- Remote desktop access
- File-sharing platforms
- Communication tools
Ideally, account access should be removed as close as possible to the employee’s departure time.
For sensitive roles, practices may want access disabled immediately when employment ends.
2. Remove Access to Healthcare Systems
Not every employee has access to the same systems.
A former hygienist may have access to clinical records and imaging software. An administrator may have access to billing and financial systems.
Offboarding should account for every application and system the employee used.
This is where a detailed access inventory can help.
If your practice does not know which systems an employee can access, it becomes much harder to make sure their access is fully removed.
3. Reset Shared and Administrative Passwords
Some practices still use shared passwords for certain systems.
This creates an additional challenge when someone leaves.
If a departing employee knows a shared password, changing that password may be necessary to prevent continued access.
Administrative credentials deserve particular attention. A former employee who knows an administrator password could potentially access systems far beyond their previous role.
Where possible, practices should avoid shared accounts and use individual credentials instead.
4. Recover Company Devices
Employee offboarding should also include physical devices.
This may include:
- Laptops
- Tablets
- Smartphones
- USB drives
- Security tokens
- Other company-owned equipment
Simply collecting a device is not always enough.
If the device contains patient information or saved credentials, it should be handled securely. Access should be removed, credentials should be reviewed, and the device should be managed according to the practice’s security policies.
Remote management tools can be especially helpful when employees work outside the office.
5. Review Email Forwarding and Delegation
Email accounts deserve special attention during offboarding.
A former employee’s mailbox may contain patient communications, billing information, appointment details, and other sensitive data.
Practices should review:
- Automatic forwarding rules
- Mailbox delegation
- Shared mailbox access
- Mobile device access
- Connected applications
Email forwarding is particularly important.
A former employee’s messages should not automatically be sent to a personal email account or another unauthorized destination.
Your IT provider can help identify forwarding rules and other settings that may create security risks.
6. Revoke Remote Access
Remote work has made this step even more important.
Employees may have access to a practice’s systems from home through VPNs, remote desktop tools, or cloud applications.
If those connections remain active after someone leaves, the practice may have an unnecessary entry point into its network.
All remote access should be reviewed and disabled as part of the offboarding process.
This is especially important for employees who previously had access to administrative systems or sensitive patient information.
7. Review Audit Logs
Closing an account is important, but reviewing activity can provide additional protection.
Audit logs can help practices understand what happened before an employee left and identify unusual activity.
Depending on the systems used, logs may show:
- Login attempts
- File access
- Account changes
- Data downloads
- Remote connections
- Other system activity
This does not mean every employee departure requires an extensive investigation.
However, if there are concerns about unusual activity or unauthorized access, audit logs can provide valuable information.
They can also help demonstrate that the practice has security monitoring and access controls in place.
8. Document the Offboarding Process
A completed offboarding process should be documented.
This can include recording:
- The employee’s departure date
- When accounts were disabled
- Devices that were returned
- Systems where access was removed
- Passwords that were changed
- Other relevant security actions
Documentation creates accountability.
It also makes it easier to identify missing steps and demonstrate that your practice has established security procedures.
For HIPAA-covered organizations, having clear policies and documentation is an important part of maintaining a strong compliance program.
Offboarding Should Start Before the Employee Leaves
One of the easiest ways to improve employee offboarding is to make it part of the hiring and termination process from the beginning.
When a new employee joins the practice, document what systems they receive access to.
Then, when they leave, you already have a list of the accounts and devices that need to be reviewed.
This creates a simple lifecycle:
Employee starts → Access is granted → Role changes → Employee leaves → Access is removed
Without this process, access can accumulate over time.
An employee may change roles, gain access to new applications, or receive additional permissions without anyone reviewing their old access.
This can create unnecessary security exposure even before they leave.
What About Employees Who Leave Suddenly?
Not every departure will come with two weeks’ notice. Healthcare practices should have a process for unexpected departures. For immediate terminations, access removal should be coordinated with management and IT before or at the time the employee leaves.
This may include disabling accounts, revoking remote access, recovering devices, and changing relevant shared credentials.
The goal is not to make the process complicated.
The goal is to make sure that security actions happen quickly and consistently.
How Managed IT Services Can Help
Employee offboarding can become difficult when a practice uses dozens of different systems.
Your IT provider may manage your network and computers, while another company manages your practice management software and another handles your imaging systems.
Without coordination, it can be easy to miss an account.
A managed IT provider can help create a standardized offboarding process and maintain an inventory of systems, devices, and user accounts.
TDI Networks helps healthcare and dental practices in the Chicagoland area take a proactive approach to IT security.
Our team can help practices review access controls, manage user accounts, secure devices, monitor systems, and support HIPAA-focused IT practices.
The goal is simple: when an employee leaves, their access should not remain behind.
A Small Process That Can Make a Big Difference
Cybersecurity does not always require a complicated new technology.
Sometimes, the biggest improvement comes from fixing a simple process.
Employee offboarding is one of those areas.
Disabling accounts, removing system access, recovering devices, changing shared credentials, reviewing audit logs, and documenting the process can significantly reduce unnecessary exposure.
For healthcare and dental practices, these steps also support a broader HIPAA compliance strategy.
Your employees need access to patient information to do their jobs. Former employees do not.
Make sure your access controls reflect that difference.
If your practice does not have a consistent employee offboarding process, TDI Networks can help you identify gaps and build a more secure approach.
Contact TDI Networks to learn how proactive IT management can help your practice protect patient information, strengthen cybersecurity, and support HIPAA compliance.
