When an employee leaves, most practices know to disable their logins. When an IT provider leaves, that step is often skipped, and the provider's access quietly stays open for months or years.
An IT provider with access to systems holding patient data is a business associate. When the relationship ends, the same termination procedure the Security Rule expects for a departing employee should run. If nobody performed it deliberately, the access very likely still exists.
It gets overlooked because it feels historical. It isn't. Every day a credential stays active is current exposure, and it reads badly in an investigation because the fix was obvious and cheap.
Where old access hides
- Network equipment: cloud management dashboards and who owns the account, admin users and API keys, local accounts and SSH keys on firewalls, switches and access points
- Remote-access tools: TeamViewer, Splashtop, ScreenConnect, AnyDesk or a monitoring agent. Check every workstation, not just the server.
- Clinical systems: EHR admin accounts, and vendor-side support accounts they arranged
- Microsoft 365 or Google Workspace: global admins, app registrations, delegated mailbox access, forwarding rules
- Accounts and identity: your domain registrar and DNS, cloud accounts, vendor portals opened under their email instead of yours, local administrator accounts on workstations
Work from the actual account lists. Don't rely on memory.
Disabling accounts isn't enough
Rotate what they knew, not only what they held. Shared passwords, Wi-Fi keys, service account credentials, and anything written in documentation they produced. Disabling a named account does nothing about a password someone still remembers.
Reclaim ownership, not only access. Registrars, cloud tenants and vendor portals are often registered to the provider's email. An account you can't recover is a live dependency on someone you no longer work with.
Record that you checked, even when you find nothing. A check that wasn't written down can't be told apart from one that never happened. Two lines are enough: the date, what you examined, and what you found.
If there was never a BAA
Write it down plainly rather than leaving it out: which systems the provider could reach, between which dates, that no agreement has been located, and the date their access was reviewed and revoked. Never backdate a document to fill the gap.
A gap you found, documented and closed is evidence of a working compliance program. A gap an investigator finds that you never recorded is something else, and the fact that a previous adviser created it doesn't transfer the obligation. It was always the practice's.