Provisioning and offboarding are unglamorous, but they're where access control either holds or quietly fails. Orphaned accounts, lingering access after role changes, and slow terminations are common breach findings. The pattern shows up again and again in breach investigations: a former employee's account was never disabled, or a staff member who moved between departments kept accumulating permissions until they could see far more than their job required. A disciplined identity lifecycle — provision deliberately, change promptly, terminate immediately, and audit regularly — closes those gaps before they become incidents.
Provision by role, with verification
When a new user starts, grant access based on their defined role rather than cloning a colleague's permissions — copied accounts propagate excess access and quietly defeat least privilege. If you clone an experienced employee who happens to have accumulated extra rights over years, you hand every new hire those same rights from day one. Verify the request comes from an authorized approver, confirm the user's identity, and apply the standard role.
| Step | Control |
|---|---|
| Request | Authorized approver, documented |
| Identity | Verify the person before issuing credentials |
| Role | Assign standard role, not a copied account |
| Credentials | Unique account, strong auth, no sharing |
Enforce unique accounts
Manage role changes promptly
- When someone changes jobs, adjust access to the new role and remove the old — don't just add.
- Watch for privilege creep: access that accumulates across multiple role changes.
- Re-verify access after internal transfers as part of the change.
Internal transfers are the most overlooked risk in the whole lifecycle. A termination at least triggers an obvious event; a move from the front desk to billing often doesn't, so the person simply keeps their old access alongside the new. Treat every role change as a both-directions event — grant what the new job needs and explicitly remove what the old one did — and the slow accumulation of excess privilege never gets started.
Offboard immediately and completely
Termination is the highest-risk moment. Access should be disabled promptly — ideally as part of a coordinated process with HR — so a departing user can't access PHI after they leave. The danger is sharpest with involuntary terminations, where a disgruntled former employee with lingering access is a textbook insider threat. The single most effective safeguard is to tie EMR offboarding directly to the HR separation process, so that ending employment automatically triggers ending access rather than relying on someone to remember to file a request.
- Disable EMR access on the effective date; for involuntary terminations, coordinate timing tightly.
- Revoke related access too: e-prescribing/EPCS, remote access, email, and any connected systems.
- Reassign the departing user's in-basket, pending orders, and open tasks so nothing falls through.
- Document the offboarding as evidence the control operated.
Don't overlook the chart-continuity side of offboarding. A departing provider often leaves behind unsigned notes, pending results, and an in-basket full of patient messages; if those aren't reassigned to a covering clinician, a result can sit unreviewed for weeks. Offboarding is therefore both a security task and a patient-safety task, and the checklist should cover both.
Audit accounts regularly
Even good processes leak. Reconcile your EMR user list against your active workforce roster periodically to find accounts that should have been disabled. Look for dormant accounts, accounts without a clear owner, and any access that no longer matches a job. NIST's HIPAA Security Rule guidance treats workforce access management — including establishing, modifying, and terminating access — as a core administrative safeguard. A recurring account audit is the safety net that catches what day-to-day provisioning misses, and the documented results are exactly the kind of evidence that demonstrates the control is genuinely operating.