Coordinate timing

Clinic leadership should define the exact time access ends. IT should not guess. For higher-risk departures, disable access promptly while preserving required business information.

Core IT steps

  • Block or disable primary accounts and revoke active sessions.
  • Remove MFA methods, application access, VPN, remote-support access, and shared passwords.
  • Recover computers, phones, keys, tokens, and other organization-owned equipment.
  • Preserve mailbox and files according to the clinic's retention and legal requirements.
  • Transfer ownership of shared documents, calendars, vendor portals, and administrative accounts.
  • Review forwarding rules and shared credentials.

Close the loop

Record what was completed, what was transferred, and which items remain open. Former-user access should never linger because nobody was sure who owned the final step.

Why timing matters

Offboarding protects patient information, clinic operations, and account ownership. A disabled mailbox alone does not end access if active sessions, mobile devices, application tokens, shared passwords, remote-support tools, or vendor portals remain available.

Planned departure versus immediate termination

For a planned departure, prepare ownership transfers and data preservation before the employee's final day, but schedule access changes for the approved time. For an immediate termination, management and IT should coordinate the exact cutoff so accounts, sessions, remote access, and physical devices are addressed together.

Disable first; preserve before deleting

Block sign-in and revoke active sessions before considering deletion. Preserve email, OneDrive or Drive files, calendars, forms, shared mailbox ownership, automation flows, and vendor records. Removing a license or deleting an account too early can complicate recovery.

Review mailbox forwarding rules, delegates, app passwords, MFA methods, registered devices, OAuth grants, VPN access, remote-support agents, and browser profiles. Rotate credentials only where a truly shared account still exists; preferably replace shared accounts with named access.

Example: departing office manager

An office manager may own the domain registrar login, copier portal, phone administration, payroll vendor access, website account, shared forms, and several cloud groups. The offboarding plan should transfer each organization asset to a clinic-owned administrator before the employee loses access.

Follow-up schedule

Within 24 hours, confirm sign-in is blocked, sessions are revoked, equipment is recovered, and urgent ownership transfers are complete. Within seven days, validate mail and file retention, remove unneeded licenses, and review shared credentials. Within 30 days, confirm no workflow still depends on the former employee's account and document final disposition.

Need help applying this to your clinic?

ClinicsIT can review the current setup and build a practical, documented process.

Request a consultation