A healthcare employee IT onboarding and offboarding checklist helps a practice coordinate access to patient-care systems, devices, and facilities when someone joins, changes roles, or leaves. Without a clear handoff, an account can be missed, a departing worker may retain access, or a new team member may not have the tools needed for their duties.
Use the checklist below as a practical workflow, not a substitute for your organization’s policies. Assign an owner to each task, record its completion, and coordinate with the people responsible for HR, clinical operations, IT, and facility access. NIST’s HIPAA Security Rule implementation guidance and HHS’s cybersecurity practices for small healthcare organizations offer additional guidance for shaping your organization’s security practices.
Start with a clear owner and trigger
HR or the hiring manager should notify IT when a start date, departure, or role change is confirmed. The notice should include the worker’s name, role, location, manager, relevant dates, and the systems or equipment they are expected to use. Share only the information needed to coordinate the work, and use your approved internal process.
Give each checklist item a responsible owner, such as IT, the manager, HR, or facilities. Include a completion field and a way to flag a task that does not apply. This makes it easier to spot unfinished items instead of relying on informal messages.
New employee IT setup checklist
Confirm the role and access needed
- Manager: Describe the employee’s job duties, work location, team, and systems needed for those duties.
- Clinical or system owner: Review requested access to the EHR, e-prescribing, imaging, patient messaging, scheduling, billing, and other clinical or administrative systems.
- IT: Create an individual account for each system where the worker needs access. Avoid shared logins that make it difficult to identify which person performed an action.
- Manager and system owner: Check that permissions fit the employee’s responsibilities. Do not assume that a person needs the same access as a colleague with a similar job title.
- IT: Set up the organization’s approved sign-in protections, including multifactor authentication where supported and required by policy.
For EHR access, start with the work the employee will perform. A clinician, front-desk worker, billing specialist, and temporary staff member may have different needs. Have the appropriate manager or system owner approve access, then confirm that the employee can complete assigned tasks without receiving unnecessary permissions. Review access again if duties change.
Prepare accounts, devices, and communication tools
- Create the employee’s work email and identity-provider account, if used by the practice, and add them to appropriate work groups.
- Set up access to messaging, scheduling, billing, imaging, cloud services, and vendor-managed applications that are part of the role.
- Prepare approved equipment, such as a workstation, laptop, mobile device, or peripherals. Record what is issued and who received it.
- Configure required security settings and approved remote-access tools before the employee begins using the device.
- Arrange any access card, key, badge, or other facility access item through the appropriate owner.
- Provide instructions for support requests, account recovery, and reporting a suspected security issue.
When systems are managed by outside vendors, include the vendor account or support contact in the setup process. A central network account alone may not provide access to, or control over, every application a practice uses. For help thinking through connections between clinical tools, see this guide to clinical system integration.
Confirm setup before marking it complete
Ask the employee to sign in to the systems needed for their work and confirm that access is appropriate. The manager or designated system owner should verify that required tasks can be completed. Record approvals, account creation, equipment issued, and any follow-up work. Do not put passwords in the checklist; use approved secure methods for account setup.
Role-change checklist
A transfer, promotion, change in duties, or temporary assignment is an access change, even when the person remains employed. Treat it as both a removal and an addition: close access that is no longer needed, then approve and grant what the new role requires.
- Have the manager identify the new duties and the date the change takes effect.
- Ask system owners to review access across the EHR, email, remote access, messaging, billing, imaging, cloud services, and vendor portals.
- Remove permissions tied to former duties, rather than simply adding new access on top of old permissions.
- Update distribution groups, device assignments, and facility access where needed.
- Record the approval and verify the revised access with the employee’s manager.
Employee departure IT offboarding checklist
Coordinate timing and disable access
HR or the manager should notify IT as soon as a departure is known and confirm when access should end, following the organization’s policies and the circumstances of the departure. For planned departures, coordinate the timing so accounts are disabled when access is no longer appropriate. For an unexpected departure or an urgent security concern, escalate promptly through the practice’s established process.
IT and system owners should work through a complete account inventory, not just the main network login. Review and disable the former worker’s access to:
- Email, identity-provider accounts, and work applications.
- EHR, e-prescribing, scheduling, patient messaging, imaging, and billing systems.
- Remote access, virtual private network tools, cloud services, and work mobile applications.
- Vendor-managed accounts, shared mailboxes, work groups, and administrative tools.
- Facility entry systems and any other access controlled by a separate team.
Check whether the person had elevated or administrative permissions, recovery methods, or access tokens that require separate action. If the practice cannot confirm the status of a vendor-managed account, assign someone to contact the vendor and record the response. Make sure remote and cloud access are specifically addressed rather than assuming they were removed with other accounts.
Collect equipment and protect continuity
- Collect practice-owned computers, phones, storage devices, keys, badges, and other access items, or record the return plan and responsible person.
- Follow internal procedures for preserving work records and assigning business communications or files to an appropriate owner.
- Review any assigned devices for the next approved step, such as secure storage, reassignment, or preparation for another user.
- Tell relevant team members who will handle work that had been assigned to the departing employee, without sharing unnecessary personal information.
Do not delete an account or its data without considering the organization’s recordkeeping, operational, and security procedures. A controlled closeout can remove access while allowing the practice to manage business records and ongoing work appropriately.
Closeout record: confirm every handoff
Keep a closeout record showing who requested the change, who approved it, and who completed each action. Include the systems reviewed, account status, equipment and access items returned or still outstanding, vendor follow-up, and any exception that needs attention. The responsible manager or IT lead should review the record and confirm that remote, cloud, clinical, and facility access were addressed.
For a manageable access review process, connect the checklist to your broader IT and compliance procedures. Zevonix offers healthcare IT services that include HIPAA, HITECH, and regulatory compliance support, along with managed IT and support. Its HIPAA compliance overview can help readers explore related operational considerations.
Frequently asked questions
What IT accounts should a new healthcare employee receive?
Only accounts needed for the employee’s duties. Review clinical, administrative, communication, cloud, remote-access, and vendor-managed systems with the relevant manager or system owner.
How quickly should a former employee’s access be removed?
Coordinate account changes with the confirmed departure timing and your organization’s policies. Escalate promptly when a departure is unexpected or presents an urgent access concern, and verify each relevant system rather than relying on one account change.
What should a practice collect when a healthcare worker leaves?
Check for practice-owned computers, phones, storage devices, badges, keys, and other access items. Record anything not returned and assign someone to follow up.
Should healthcare employees use individual accounts instead of shared logins?
Individual accounts make it easier to manage access by person and review who used a system. Use the organization’s approved account practices and avoid sharing credentials.
Make access changes a routine handoff
A reliable checklist connects each access decision to an owner, a system, and a confirmation. Review your process for onboarding, departures, and role changes, then contact Zevonix at (904) 658-0777 if you would like to discuss healthcare IT support.