What Belongs in a Clinic Password Vault—and What Does Not

A password vault should protect organization-owned access and recovery information. It should not become an uncontrolled spreadsheet of employee passwords.

Store organization-owned access

• Domain registrar, DNS, website, Microsoft 365, Google Workspace, backup, network, phone, copier, and vendor portal credentials.
• Emergency access accounts, recovery codes, encryption keys, API keys, license records, and device-management credentials.
• Ownership notes, account numbers, support contacts, renewal dates, and recovery procedures.

Do not store routine employee passwords

• Employees should create and control their own passwords under clinic policy.
• IT staff should reset passwords through administrative tools rather than retrieve a copied password.
• Never place passwords in unencrypted documents, tickets, email, or shared chat.

Protect the vault

• Use clinic-owned billing and primary ownership.
• Require MFA, least-privilege sharing, access logs, and prompt removal of former staff or vendors.
• Maintain a documented break-glass method and periodically test it.

Related ClinicsIT guidance

• Small clinic IT documentation checklist
• Clinic-owned vs. vendor-owned accounts

Practical note: Technology, licensing, vendor capabilities, and regulatory obligations vary. Confirm the clinic’s current configuration before making changes.