Which accounts to close when someone leaves a medical practice, and how fast

When someone leaves, close every login they could use to reach patient data. That covers the EHR and the practice management system, and also cloud services outside your building, such as payer portals and telehealth platforms. Logins several people share can’t be closed for one person, so change their passwords. When someone changes roles instead, keep their account and change what it can reach. HIPAA’s Security Rule asks for termination procedures but sets no deadline, so your practice decides how fast and who acts. The rule’s structure is covered in What is the HIPAA Security Rule?

What HIPAA asks for when someone leaves

The requirement sits under workforce security in 45 CFR 164.308(a)(3). Its termination procedures specification is 164.308(a)(3)(ii)(C). It reads: “Implement procedures for terminating access to electronic protected health information when the employment of, or other arrangement with, a workforce member ends …” Electronic protected health information (ePHI) is patient health information kept or sent electronically.

The specification is labeled addressable. That doesn’t make it optional. Under 164.306(d)(3), you assess whether it’s reasonable and appropriate for your practice. If it is, you implement it. If not, you write down why and put an equivalent measure in place where that is reasonable and appropriate.

“Workforce” is broader than payroll. In 45 CFR 160.103 it means employees, volunteers, trainees and others whose work for you is under your direct control. They count “whether or not they are paid.” So per-diem clinicians who work under your direction, and volunteers, are covered. A related specification, 164.308(a)(4)(ii)(C), covers reviewing and changing a person’s access rights, which includes a job change.

HHS’s Office for Civil Rights (OCR) enforces HIPAA. Its audit protocol lists what an auditor may look at for termination procedures. It includes taking back badges and keys, turning off system access, and ending contractors’ access. It also covers access changes after a job change, and “Time frames to terminate access to ePHI.” Auditors then ask for proof that access ended on time and as your policy says.

Which accounts to check

Start from a list of every system the person could sign in to. HICP is a set of recommended practices for health care that HHS publishes with industry through its 405(d) program. Its volume for medium and large organizations warns about cloud systems you can reach from outside your network. If they aren’t tied to single sign-on (one login that opens many apps), they stay open until someone closes them by hand.

NIST’s HIPAA resource guide suggests a standard checklist for every departure. It also asks whether other organizations must be told to close accounts the person used for your work. A payer portal run by an outside company is one example.

For prescribers, DEA rules add a firm date. Under 21 CFR 1311.125(d), certain events end a prescriber’s permission to sign controlled-substance prescriptions. It must be revoked “on the date the occurrence is discovered.” One listed occurrence is a prescriber who is no longer authorized to use the application, such as one who leaves the practice.

How fast to close access

The current Security Rule gives no number of hours or days. HHS’s voluntary Cybersecurity Performance Goals list revoking credentials for departing workforce as an essential goal. It covers employees, contractors, affiliates and volunteers, and asks you to remove access promptly. HICP’s volume for small practices says to end system access immediately when an employee or contractor leaves. It notes that cloud systems matter most here, because anyone with the login can use them from anywhere.

In January 2025, HHS proposed amendments to the Security Rule (90 FR 898). Proposed 164.308(a)(9)(ii)(C)(2) would require ending access within one hour after a person’s employment or other arrangement ends. The proposal hasn’t been finalized. The federal regulatory agenda lists it as a long-term action with a projected final action date of July 2027. Until a final rule appears, the deadline is the one you set.

When you set it, separate the two kinds of departure. NIST’s resource guide asks whether you have different procedures for voluntary and involuntary departures. HICP’s volume for larger organizations recommends an urgent process for sensitive cases such as a firing. It also says to sign the person out of anything they’re still signed in to, since a phone may stay signed in to email after they’re gone.

When someone changes roles

A role change isn’t a departure, so the account stays. What it can reach should change. HICP’s small-practice volume says to remove access from the old role before you grant the new one. Otherwise the person keeps both sets of rights. Under 164.308(a)(4)(ii)(C), your procedures should cover reviewing and changing access rights when this happens.

Who does what

HICP describes the HR system as the usual starting point for a departure. So decide how HR, or whoever handles hiring at a small practice, tells the person who closes accounts. Settle the channel and the timing in advance.

Every practice needs a security official. Section 164.308(a)(2) requires you to name the person responsible for your security policies and procedures. That person owns the termination procedure. The steps themselves are done by whoever administers each system, your own staff or a vendor. If a billing company or other vendor uses your systems, agree on how it tells you when one of its staff leaves. OCR’s audit protocol covers ending contractors’ access too.

Keep a record of each departure: the date, which accounts were closed, and who closed them. That record is what an auditor asks for, and it lets your periodic access review catch anything missed. HICP recommends reviewing all users’ access on a set schedule.

Shared logins and people who know the password

A shared login stays in use after one person leaves, so you can’t disable it. The person who left still knows the password. To cut them off, you change it and give the new one only to the people who stay. HICP’s small-practice volume says to avoid shared or generic accounts, and to update any that are in use when someone leaves. It warns that the work of changing a shared password for many users can leave a compromised one active for a long time. The limits of this approach are in The limits of changing shared passwords every time someone leaves.

The Security Rule’s unique user identification specification, 164.312(a)(2)(i), is labeled required. It asks you to give each user a unique name or number so you can track who did what. A shared login can’t do that. List the shared logins you keep, record who knows each password, and note the date it last changed. Why shared logins persist at practices is covered in Can staff share an EHR login?