Giving company accounts to employees, contractors and temps

Give everyone who works in your company’s accounts their own login, whether they are an employee, a temp or an independent contractor. None of the rules covered here makes an exception by status. What status changes is which rules reach the person, what paperwork you need, and who tells you when the work ends. Employees, and temps who work under your direct control, count as your own workforce rather than as a vendor. They follow your own security policies and training. Independent contractors who handle your customers’ or patients’ data as an outside business are vendors, and any vendor oversight rule that covers you applies to them.

Status follows the relationship, not the label

For tax purposes, the IRS says whether someone is an employee or an independent contractor depends on evidence of control and independence, and no single factor settles it. It groups that evidence into three kinds: behavioral control, financial control and the type of relationship. Calling someone a contractor doesn’t settle it. You report an employee’s pay on Form W-2 and an independent contractor’s on Form 1099-NEC once payments reach the reporting threshold. That’s where “W-2 employee” and “1099 contractor” come from.

Privacy and security rules use their own terms, and they don’t line up exactly with the tax forms. HIPAA’s “workforce” means employees, volunteers, trainees and other persons whose work for you is under your direct control, “whether or not they are paid” by you (45 CFR 160.103). A business associate is someone who handles health information for you “other than in the capacity of a member of the workforce”. So under HIPAA, the question is direct control. A 1099 contractor who works under your direct control can be workforce, and an outside firm handling claims for you is a business associate.

The California Consumer Privacy Act (CCPA) uses “contractor” as a defined term. It means a person you give consumers’ personal information to for a business purpose under a written contract with specific terms (Civil Code 1798.140(j)). That is narrower than the everyday word. The FTC Safeguards Rule counts employees, contractors and agents alike as “authorized users” of your systems (16 CFR 314.2).

How each status maps to the rules

Employees, including part-time and seasonal staff

Part-time and seasonal employees are employees. HIPAA’s Security Rule requires a security awareness and training program “for all members of its workforce” (45 CFR 164.308(a)(5)(i)). Its workforce security standard requires policies and procedures so that every workforce member has appropriate access to electronic health information, and those who shouldn’t have access don’t get it (164.308(a)(3)(i)). Neither depends on hours worked.

The login is the same for everyone. HIPAA lists “Unique user identification” as required: a unique name or number for identifying and tracking each user (164.312(a)(2)(i)). If part-time staff share one login, your records show the login and not the person.

When an employee leaves, NIST SP 800-53 control PS-4 asks you to disable their system access within a time you set. It also asks you to revoke their passwords and other sign-in methods. The departure goes through you, so you know the last day.

Temps from a staffing agency

The staffing agency employs the temp. But when the temp’s work for you is under your direct control, HIPAA’s workforce definition fits, whether you or the agency pays them. Then the same training and access rules apply as for your employees.

Create a user for each temp in your own systems. Don’t let temps work under a login issued to the agency. With one agency login, your records show the agency, and finding out who did what depends on the agency’s roster.

The end of an assignment is easy to miss. The agency may reassign a temp without telling you right away. HIPAA’s termination procedures, which are addressable, cover ending access to health information “when the employment of, or other arrangement with, a workforce member ends” (164.308(a)(3)(ii)(C)). NIST SP 800-53 control PS-7 asks you to require outside providers to report transfers and departures of their people who hold your logins, within a set time. Put that duty in the agency contract.

Independent contractors and freelancers

A freelancer who handles your customers’ or patients’ data as an outside business is a vendor, even when the vendor is one person. Under HIPAA, a contractor outside your direct control who handles health information for you is a business associate, and you need a business associate agreement. A covered financial institution must oversee its “service providers” (16 CFR 314.4(f)). The FTC rule defines them as anyone permitted access to customer information through services provided directly to you (314.2). What that oversight involves is in What is vendor oversight?

Give the contractor their own user where the app allows it, with only the permissions the work needs. If the app has one login that staff already share, the contractor joins that group, and you’re handing a vendor a shared login. The checks for that case are in What to check when a vendor says its team uses one shared login.

The contract end date is when access ends. Disable the contractor’s user. If they used a shared login, change the password and give the new one only to the staff who stay. Ask the contractor to delete saved passwords and your data from their devices and confirm it in writing. The full list is in the checklist for taking back access when a vendor contract ends.

Contractors with other clients, and returning employees

A contractor may work for several clients at once. Your contract should say that your data and logins are used only for your work, and should name the devices they use for it. If the contractor brings in help of their own, that is subcontracting, covered in What is subcontracting?

When a former employee comes back as a consultant, their old user should already be disabled. Create a new one under the new arrangement, so your records show when each one began and ended.