The Employee Left. Did Their Access?
An employee turns in a badge, hands over keys, and leaves. Their access to resident communication should leave with them.
But offboarding rarely happens in one place. A former employee may have had access to scheduling tools, email, messaging platforms, shared accounts, vendor systems, and resident information. If each account isn’t reviewed and removed, access can outlive the job.
That isn’t only an IT issue. It’s an operational and compliance issue.
ACCESS SHOULD CHANGE WHEN THE JOB CHANGES
The HIPAA Security Rule requires covered entities to authorize access to electronic protected health information based on a person’s role and to prevent access by people who aren’t authorized.
That means access reviews shouldn’t happen only when someone leaves. Promotions, department changes, temporary assignments, leaves of absence, and vendor transitions can all change what a person needs to see.
The practical question is simple: Does every person with access today still need that access to do their current job?
SHARED LOGINS MAKE THE RECORD LESS RELIABLE
A shared login may feel efficient during a busy shift. It also makes it harder to know who viewed, changed, or shared information.
The Security Rule calls for unique user identification, authentication, and audit controls. Individual accounts support those safeguards because activity can be connected to a specific user. Shared credentials weaken that connection and make an investigation slower and less certain.
If your team still uses a generic username such as “frontdesk” or passes one password between shifts, put that workflow near the top of the review list.
OFFBOARDING IS A WORKFLOW, NOT AN IT TICKET
Disabling an email account isn’t the same as removing access everywhere.
A reliable offboarding process should name an owner, list every system that may contain resident information, and set a deadline for removing access. It should also cover organization-owned devices, shared passwords, physical keys, vendor portals, and any active sessions or tokens.
Human resources, operations, compliance, and IT each hold part of the picture. The process works only when those pieces connect.
RUN A 30-MINUTE ACCESS CHECK
You don’t need to wait for a full audit to find obvious gaps. Start with one platform that contains resident information and ask:
• Does every active user still work with us?
• Does each user’s access match their current role?
• Are any accounts shared by multiple people?
• Can we identify who accessed or changed information?
• Is there a documented process for removing access after a departure or role change?
Then repeat the check across the other systems your team uses to communicate about residents.
Document what you find, assign each correction to an owner, and set a date to review access again. HHS guidance calls for regular review of records that track information-system activity. An access review should be a recurring control, not a one-time cleanup.
WHAT BETTER CONTROL LOOKS LIKE
A stronger communication process gives each person an individual account, limits access to what their role requires, preserves a searchable history, and makes removal straightforward when responsibilities change.
Caily helps communities bring staff and family communication into one resident-linked platform. Instead of relying on shared accounts and scattered threads, organizations can manage approved access and keep communication connected to the resident.
Technology doesn’t replace your access policies or offboarding process. It gives those policies a clearer place to operate.
DON’T LET OLD ACCESS BECOME A CURRENT RISK
If you’re not sure who can still see resident communication, that uncertainty is the place to start.
Schedule a Caily demo to see how a secure, resident-linked communication platform can help your team manage access, preserve a reliable history, and keep important information under organizational control.
Source: HHS: HIPAA Security Rule
