Set the Termination Time and Assign Owners

Record the person’s final authorized access time, then assign one coordinator, usually the Practice Administrator, HR leader, or security official. Assign each system to a responsible administrator: Microsoft 365 and devices to IT, the EHR and practice management system to the EHR administrator, billing and clearinghouse to revenue cycle, phones and electronic fax to the phone administrator, and badges and keys to the office manager.

Open one checklist or ticket tracking system, required action, assigned administrator, completion time, evidence, and any exception or unresolved issue. Require actual confirmation from each administrator. “Request sent” does not mean access has been removed.

Build the Complete Access Map

List every system the person used, administered, or could reach. This is the step most practices shortchange. Check for access to the EHR and practice management platform, electronic prescribing, patient portal administration, billing and clearinghouse systems, prior authorization and referral portals, lab and imaging portals, Microsoft 365, email, Teams, SharePoint and OneDrive, electronic fax, phones and voicemail, VPN and remote access tools, password managers, AI scribes or transcription apps, vendor support portals, and shared mailboxes or folders.

Identify administrative privileges, delegated access, saved sessions, and export permissions. Record any personal device approved to access practice information. And identify every shared password the person may know, since shared credentials must be changed even after the person’s own accounts are disabled.

Disable the Central Identity and Revoke Sessions

For Microsoft 365, the order matters. In the Microsoft 365 admin center, go to Users > Active users, select the person, and choose Reset password, generating a random password that is never shared with the departing user. Select the user again, and on the Account tab, choose Sign out of all sessions. Then select Block sign-in, choose Block this user from signing in, and save.

Microsoft recommends this exact order because blocking an account alone can take time to fully take effect, while an open session on a device can keep working until it is specifically revoked. Next, revoke Microsoft Entra sessions separately: sign in at entra.microsoft.com, open Entra ID > Users > All users, select the user, clear Account enabled under Account status, save, then return to the user’s Overview page and select Revoke sessions.

Some applications issue their own session tokens outside this flow and must be disabled separately. Do not delete the Microsoft account yet. Preserve required email, files, audit history, and business records first.

Disable Clinical and Vendor Accounts

Open the EHR’s user administration area, locate the individual, and disable or inactivate the account. Remove administrative roles, remote access, prescribing permissions, and delegated access, and terminate active sessions if the platform offers that option. Record the completion time and retain confirmation.

Repeat this for the practice management and billing system, electronic prescribing platform, patient portal, clearinghouse, prior authorization platforms, lab and imaging portals, electronic fax service, AI scribe or transcription service, and every other application on the access map. Look for settings named Users, User Administration, Security, Roles, Deactivate, Disable, Revoke Sessions, or Remove Access, exact menu paths vary by vendor. If a vendor must remove access on their end, keep the support ticket number and completion notice.

Secure Shared Access, Phones, and Devices

Disable the person’s phone system and voicemail login, and remove them from call queues, ring groups, auto attendants, and voicemail groups. Disable VPN, remote desktop, and other remote access tools. Remove the person from shared mailboxes, Teams groups, SharePoint sites, and shared folders.

Change shared credentials the person may know: shared front desk or billing accounts, vendor portals, workforce Wi-Fi, alarm or door systems, shared voicemail, and password manager collections. Collect all practice owned devices, badges, keys, and security tokens.

If a device is managed through Microsoft Intune, go to Intune admin center > Devices > All devices, select the device, and choose Retire (removes managed company data while generally preserving personal data) or Wipe (a full factory reset). The device has to check in before the action completes, so confirm it actually ran. Do not wipe a device until required information has been preserved. For other platforms, follow that vendor’s documented Retire, Selective Wipe, or Factory Reset procedure, since exact steps vary by product.

Preserve Business Information Without Preserving Access

Decide who receives the former employee’s unfinished work, patient messages, and business records. Review unread patient messages, pending referrals and prior authorizations, unfinished clinical documentation, scheduled tasks, billing or claim work queues, shared documents they owned, and voicemail.

Transfer ownership before deleting accounts or licenses. Do not forward the former employee’s email indefinitely, follow the practice’s actual privacy and retention policy instead. Record who received custody of each workflow or record. The goal is preserving the practice’s information, not the former employee’s access to it.

Verify and Document That Access Is Actually Closed

Review every checklist item and confirm each action is marked completed, not merely requested. Confirm Microsoft sign-in is blocked, active Microsoft sessions were revoked, EHR and clinical accounts are inactive, remote access is disabled, shared passwords were changed, devices and badges were recovered, and required business records were transferred.

Review Microsoft Entra sign-in logs and applicable vendor audit logs for activity after the termination time. Retain evidence: administrator confirmation, a configuration export, a screenshot showing inactive status, the completed vendor ticket, the device return receipt, the Intune action status, and the date and time of session revocation.

Have someone who did not perform the original work review the checklist, and escalate any unresolved access immediately. Leadership should be able to answer the former employee test with real evidence, not an assumption.