Passwords That Work in a Real Clinic

The password problems every clinic has

Walk into almost any small clinic and you will find the same three problems: one shared login everyone uses, passwords on sticky notes under keyboards, and the same password reused across the EHR, email, and billing. None of this is malice — it is people trying to get through a busy day. But each one is a hole, and HIPAA’s Security Rule specifically requires unique user identification for a reason: when something goes wrong, you must be able to tell who did what.

What actually works in a real clinic

• One login per person. No exceptions. Shared accounts mean shared blame — when six people use “frontdesk,” an audit log is useless and a terminated employee’s access never really ends. Individual accounts with fast user switching cost seconds, not minutes.
• Use a password manager. This is the single change that fixes the sticky-note problem. Staff remember one strong master password; the manager creates and fills long, unique passwords for everything else. Pick one with business features — shared vaults for role accounts, and the ability to revoke access when someone leaves.
• Role accounts get vaulted, not memorized. Some shared access is legitimate — the billing login, the supply ordering account. Those credentials live in the password manager’s shared vault, never on a note taped to the monitor, and the vault password changes when staff turns over.
• Length beats complexity. A long passphrase staff can actually remember — four or five random words — beats a short cryptic password they write down. Fourteen characters minimum is the modern baseline.
• Never reuse across systems. The EHR password, the email password, and the personal Facebook password must all be different. Breaches of one site fuel attacks on the others — attackers count on reuse.

Making it stick with non-technical staff

The day someone leaves: the offboarding checklist

Every departure — friendly or not — runs the same checklist, the same day. Disable their user accounts across the EHR, email, and billing systems. Remove them from shared password vaults. Change any shared or role passwords they knew. Collect hardware keys, badges, and building keys. Remove their MFA enrollments and their phone from any device management. Confirm their email is forwarded or archived per your retention policy, not silently deleted. Print the checklist, initial each line, file it. For involuntary terminations, run the technical steps before the conversation, not after — accounts disabled first, meeting second. “We’ll get to it next week” is how a former employee’s login stays live for six months — and under HIPAA, every day of that is your liability, not theirs.

What to do Monday morning

Count the shared accounts. List every login in the clinic that more than one person uses, and note which systems they reach. That list is your conversion plan — each one becomes individual accounts plus a vaulted role credential. Start with the EHR and email; finish the rest within the month.

Run the checklist backwards as an audit: pick three former employees and verify every item was actually done. If you find a live account for someone who left months ago, disable it now and treat the gap as a finding in your next risk assessment — that is exactly what the assessment is for. Then make the checklist part of the exit process itself — IT items alongside the final paperwork, so nothing depends on remembering next week.

Frequently asked questions