Managing telehealth logins when clinicians and staff come and go

Every clinician and staff member who uses your telehealth platform and EHR should have their own login. Set it up before their first shift, and remove it when they stop working with you. HIPAA’s Security Rule calls the second step termination procedures, and they apply to per-diem and locum clinicians who work under your direction, as they do to employees. Keep one list of who should have access and check it against the logins in each system.

HIPAA rules for telehealth are the usual rules

HHS’s telehealth site says all telehealth services by covered providers must comply with the HIPAA Rules. Providers must use technology vendors that comply and will sign business associate agreements (BAAs). During the COVID-19 public health emergency, HHS’s Office for Civil Rights (OCR) relaxed enforcement for telehealth. Those notices expired on May 11, 2023, and the transition period ended on August 9, 2023.

So a telehealth platform is a system like any other that holds patient data. The Security Rule requires a unique name or number for each user, so the system can identify and track who did what (45 CFR 164.312(a)(2)(i), “Required”). It also requires records of activity in those systems (164.312(b)). A login that several clinicians share defeats both: the record names the login, not the person who used it.

Per-diem and locum clinicians are part of your workforce

HIPAA defines workforce in 45 CFR 160.103 as employees, volunteers, trainees and others whose work is “under the direct control” of your practice. It adds “whether or not they are paid” by you. A locum physician placed by an agency, or a per-diem nurse you schedule, is in your workforce if they work under your direction. In that case, your workforce security procedures (164.308(a)(3)) cover their access.

Those procedures make sure each workforce member has the access they need, and that people without it can’t get in. The workforce security and access specifications that follow are “Addressable”. You put each in place if it’s reasonable for your practice. If not, you document why and use an equivalent measure where one is reasonable (164.306(d)(3)).

Before the first shift

Access starts with a decision about who may use what. Your practice needs procedures for granting access (164.308(a)(4)(ii)(B)). It also needs procedures to set up, document, review and change each person’s access (164.308(a)(4)(ii)(C)). HHS’s 405(d) guide for small healthcare organizations recommends tailoring access to each person’s role. It also recommends giving each user their own account and telling users never to share passwords.

Timing matters for clinicians who start on short notice. If the login isn’t ready when the first shift begins, the quick fix is to use a colleague’s. From then on, the record shows the colleague, not the person who saw the patient. So make the login request part of the onboarding steps that happen before the shift is booked, with the same lead time as credentialing. If your platform supports MFA (multi-factor authentication: a second check after the password), turn it on as part of that setup. For how a second check works, see What is two-step verification?.

Between shifts

A clinician may work two days a month. HIPAA has no rule that says to switch off access between shifts. But your access procedures cover reviewing and changing each person’s access as their needs change (164.308(a)(4)(ii)(C)). A login that stays active for weeks with no work behind it is access the person doesn’t need during that time. Decide by role: someone who is on call may need standing access, and someone booked once a quarter may not.

Check whether your platform lets an admin suspend a user and restore them later, or only delete the user. If it only deletes, you set the person up again before each stretch of work. Ask the vendor before you pick an approach.

When the arrangement ends

The termination procedures specification (164.308(a)(3)(ii)(C)) covers ending a person’s access “when the employment of, or other arrangement with, a workforce member ends”. The words “other arrangement” reach contract and per-diem work. HHS’s voluntary Cybersecurity Performance Goals for the health sector list revoking departing workers’ access as an essential goal. The goal names contractors, affiliates and volunteers along with employees, and says to remove access promptly.

The 405(d) guide says to end access immediately when someone leaves. It calls this especially important for cloud systems, where access depends on a login and not on being at a particular computer. Telehealth platforms are that kind of system. The guide also says to update any shared or generic accounts the person used.

In January 2025, HHS proposed amending the Security Rule. The proposal would require ending a departing workforce member’s access within one hour. That rule has not been finalized, so it is not a current requirement. For every login to close when someone leaves, see Which accounts to close when someone leaves a medical practice, and how fast.

Keep one list and compare it with the logins

The 405(d) guide recommends a periodic review of everyone’s access. For a practice with rotating clinicians, keep one list of who should have access: your schedule or credentialing roster. Then compare it with the users in the telehealth platform and the EHR. A login with no matching person on the roster is one to remove.

Do the comparison on a fixed schedule, such as at the end of each month. When a clinician leaves in the middle of a month, the roster change should trigger the removal right away rather than waiting for the review.