Former Employees and Excessive Access: A Hidden HIPAA Risk

This illustrative scenario is fictional. The organization and people described are invented.

The situation

Riverbend Family Counseling is a small behavioral health practice with eleven staff and two locations. Dana, a front-desk coordinator, left on good terms in the spring. Her manager collected her keys and badge, and the office manager removed her from payroll. Everyone assumed that was the end of it.

It was not. Dana's Microsoft 365 account was never disabled, because nobody told the outside IT provider she had left. Her login to the practice's scheduling and billing portal, which the practice manages itself, was also still active. And because the front desk shared one login to the electronic health record on busy days, nobody knew exactly which accounts Dana had used.

How it came to light

Months later, the practice manager noticed an email reply from Dana's old mailbox to a patient's family member. The message was harmless. A mail rule set up long before had sent an automatic reply. But it raised a hard question: who else could still get into Dana's account, and what could they see?

When the practice looked more closely, it found a pattern that is common in small organizations:

• Accounts for two other former employees were still active.
• Several current staff had more access than their roles needed, because permissions were copied from a colleague when they were hired.
• No one reviewed sign-in records, so the practice could not quickly say whether any of the old accounts had been used.

Why it matters

Nothing in this scenario requires a sophisticated attacker. An active account belonging to someone who has left is an open door. If the former employee's password was reused elsewhere and exposed, anyone holding it could sign in. Without regular review, the practice may not notice for a long time.

The HIPAA Security Rule expects organizations to control who can access electronic patient information. That includes procedures for ending access when someone leaves, giving people only the access their jobs require, assigning each person a unique login, and keeping records that show who did what. Shared logins make that last point especially difficult. If an investigation ever asks who viewed a record, "the front desk" is not an answer.

The practice also had to work out whether any patient information was viewed through the old accounts, which can raise breach notification questions.

What Riverbend changed

1. One offboarding checklist that covers every system, including those managed by outside vendors, signed off by the manager and the IT provider.
2. Unique logins for everyone, with shared accounts removed from the health record and portal.
3. A quarterly access review, in which each manager confirms who on their team should have access to what.
4. Sign-in monitoring, with alerts for unusual activity on dormant accounts.

Questions for your organization

• When someone leaves, how quickly is every account disabled, including vendor-managed systems?
• Does anyone share a login to a system that holds patient information?
• When did someone last confirm that each person's access matches their current role?

Take the next step

Our free HIPAA security assessment helps you spot gaps like these quickly and privately. It shows where to focus first; a limited assessment like this cannot establish complete HIPAA compliance.

Related reading

• Who Has Administrator Access to Your Microsoft 365 Environment?
• When a practice laptop goes missing
• 7 HIPAA Security Gaps Healthcare Organizations Commonly Miss