Make onboarding and offboarding visible across HR and IT
For HR head / nursing administration / department manager · Plan implementation
TL;DR — what you’ll learn
- Drive IT and facility access changes from authoritative HR Joiner, Mover and Leaver (JML) events rather than ad-hoc chat requests.
- Separate employment appointment from clinical privilege grants and role-based system permissions.
- When a staff member transfers departments or branches (Mover), explicitly revoke prior-role permissions alongside issuing new ones.
- Require positive revocation confirmation across HIS, ERP, PACS, email and third-party vendor portals before closing an offboarding checklist.
Illustrative hospital administrative and operations coordination desk; not a client facility.
During a quarterly access audit covering 75 Joiner, Mover and Leaver events (JML-ACC-064) across a multisite hospital, internal audit discovers that a billing executive who transferred from Branch A inpatient billing to Branch B procurement two months earlier still retains active bill-cancellation rights in Branch A’s HIS; simultaneously, two departed TPA desk coordinators still have active external payer-portal credentials and shared department email access. Provisioning new logins quickly while leaving transfer and exit revocations unverified created silent privilege accumulation and orphaned external accounts.
For hospital CIOs, information-security leads and HR heads, the core question is how to coordinate HR lifecycle events and IT system owners so every joiner gets only approved access and every mover or leaver has obsolete access demonstrably removed.
Separate job appointment from clinical privileges
Hospital staff rarely use a single unified login. Depending on their role, employees access the core HIS/EMR, pharmacy or stores modules, ERP finance, PACS/RIS, laboratory analysers, corporate email, biometric doors and external TPA or vendor portals. When HR tracks joining and relieving dates in an HRIS while IT tracks tickets in a separate helpdesk without a shared account inventory per employee, leaver revocations miss secondary systems and movers accumulate permissions from every department they have ever worked in.
The NABH standards catalogue and the CERT-In cybersecurity directions index provide accreditation and cybersecurity governance context for access control, account accountability and incident readiness (reference context only; security leads and legal counsel must verify applicable statutory cybersecurity directions and internal access policies).
In the illustrative 75-event JML-ACC-064 quarterly lifecycle review (35 joiners, 22 internal movers and 18 leavers), account provisioning and revocation outcomes are reconciled across internal and external systems:
Scroll horizontally to see all columns.
Lifecycle cohort (JML-ACC-064) | Staff events | Target system accounts | Provisioning & revocation verification | Audit & remediation outcome |
|---|---|---|---|---|
| Joiners (new hires & residents) | 35 | 105 | Role-scoped access issued after training/privilege check | 100% matched to signed role matrix |
| Movers (branch / department transfers) | 22 | 66 | 19 cleanly swapped; 3 retained legacy branch/role rights | 3 legacy permissions revoked via mover audit |
| Standard leavers (planned exits) | 15 | 45 | Core HIS/email disabled on last working day; 2 vendor portals open | 2 external portal accounts revoked & added to checklist |
| Immediate / unscheduled separations | 3 | 9 | Emergency kill-switch executed across SSO, VPN & HIS | All 9 accounts disabled within 30 minutes; logs preserved |
| Total lifecycle events (`JML-ACC-064`) | 75 | 225 | 217 compliant on first pass + 5 legacy/portal gaps caught | 100% of 225 accounts reconciled with owner sign-off |
Across the 75 staff events (35 + 22 + 15 + 3 = 75) and 225 associated system accounts (105 + 66 + 45 + 9 = 225), the reconciliation catches and closes the 3 unrevoked legacy mover permissions and 2 external vendor-portal accounts before clearance sign-off.
Compare manual task lists with provisioning integration
Automated Single Sign-On (SSO) and directory deactivation handle primary email and SSO-connected apps quickly, but many hospital modules—legacy lab interfaces, standalone PACS admin tools, biometric controllers and third-party TPA portals—rely on local user tables. The JML register must therefore track a per-person *assigned system inventory* so offboarding generates explicit revocation tasks for every non-SSO system owner and blocks final exit clearance until each owner records a timestamped removal confirmation.
Connect the HR-to-IT onboarding and offboarding workflow with Track credential and privilege records without granting privileges, Control contract-staff readiness and vendor billing separately and Build staff rosters around approved capabilities and coverage so that clinical privilege boundaries, contractor badge controls and role-based HIS permission matrices operate from the same identity ledger.
Worked workflow
Original illustrative workflow. Follow the labelled transitions, including the exception paths.
- A · StepRecord authoritative HR Joiner, Mover or Leaver (JML) event with effective timestamp and role/site code
- B · StepLook up approved role-access template and existing assigned system/asset inventory for the user
- C · StepExecute SSO/local provisioning for new scope and issue revocation tasks for prior or exiting scope
- D · DecisionAll new permissions matched to role/privilege scope and all prior/leaver accounts confirmed revoked?
- E · StepHold open mover legacy rights, unconfirmed vendor-portal removal or shared-account dependency
- F · StepSystem owner revokes residual account, rotates shared credential or logs time-bound handover
- G · StepIT security and HR sign off completed JML access record with timestamped evidence
- H · StepUpdate active user-access inventory for periodic recertification and exit settlement
Scroll horizontally to see all columns.
| From | Condition | Next |
|---|---|---|
| A: Record authoritative HR Joiner, Mover or Leaver (JML) event with effective timestamp and role/site code | Continue | B: Look up approved role-access template and existing assigned system/asset inventory for the user |
| B: Look up approved role-access template and existing assigned system/asset inventory for the user | Continue | C: Execute SSO/local provisioning for new scope and issue revocation tasks for prior or exiting scope |
| C: Execute SSO/local provisioning for new scope and issue revocation tasks for prior or exiting scope | Continue | D: All new permissions matched to role/privilege scope and all prior/leaver accounts confirmed revoked? |
| D: All new permissions matched to role/privilege scope and all prior/leaver accounts confirmed revoked? | No | E: Hold open mover legacy rights, unconfirmed vendor-portal removal or shared-account dependency |
| E: Hold open mover legacy rights, unconfirmed vendor-portal removal or shared-account dependency | Continue | F: System owner revokes residual account, rotates shared credential or logs time-bound handover |
| F: System owner revokes residual account, rotates shared credential or logs time-bound handover | Continue | C: Execute SSO/local provisioning for new scope and issue revocation tasks for prior or exiting scope |
| D: All new permissions matched to role/privilege scope and all prior/leaver accounts confirmed revoked? | Yes | G: IT security and HR sign off completed JML access record with timestamped evidence |
| G: IT security and HR sign off completed JML access record with timestamped evidence | Continue | H: Update active user-access inventory for periodic recertification and exit settlement |
Handle movers/shared accounts and delayed vendor responses
Three edge cases require dedicated controls in hospital JML workflows: internal movers who need temporary 7-day read-only access to close out prior-department bills, shared workstation or generic nursing-station accounts where an exiting staff member knew the password, and doctors or pharmacists whose statutory/clinical authority must be checked before order-entry or prescribing flags are enabled. Never handle mover transitions by simply adding the new role group on top of the old one.
In the JML-ACC-064 workflow above, decision gate D prevents a mover or leaver ticket from closing (G) until every linked internal and external account in the user’s inventory is confirmed revoked (E and F).
Test access withdrawal and evidence.
Test the JML control workflow using the 75-event JML-ACC-064 challenge set: a new clinician requiring both HR appointment and clinical privilege sign-off, a billing staff member moving to procurement, a planned resignation with external TPA portal access, and an immediate termination requiring rapid access revocation. Measure time-to-revoke on leavers and residual-privilege count on movers.
Identity and workflow tools coordinate provisioning tasks and audit trails; employment decisions remain with HR, clinical privileges with medical administration, and security architecture with the CIO/CISO.
Next actions
- Build a complete catalogue of both SSO-connected and standalone/external systems (HIS, ERP, PACS, LIS, TPA portals) mapped to each hospital job role.
- Modify the internal transfer (Mover) workflow so issuing new department permissions requires an explicit revocation checklist for the old department.
- Run a monthly reconciliation comparing HR separation dates against active accounts across all clinical, financial and external portal user tables (
JML-ACC-064).
Discuss this workflow
Request a workflow assessment focused on this question: How can a hospital ensure a joiner gets only approved access and a leaver's access is removed?
Describe the operation using business information only. Please leave out patient details.
Applying this guide
The scenarios and numbers are illustrative. Confirm these provider-specific inputs before implementation:
- HR head, CIO/IT security lead and medical administration: Approved JML access policy separating employment status, role-based system access and clinical privileges (`JML-ACC-064`).
- Department managers and standalone system owners (PACS, LIS, TPA desk): Timestamped revocation confirmations for all 22 movers and 18 leavers, including non-SSO and external portal accounts.
- IT system administrator and internal audit: Zero active accounts belonging to separated staff and zero unapproved cross-branch residual permissions in quarterly review.
References
- NABH standards catalogue — Programme selection context only; obtain the current full applicable standard before clause-level assertions. Accreditation is distinct from law and software certification.
- CERT-In cybersecurity directions index — Index of directions and FAQ; security lead and legal counsel must review operative clauses and incident categories.
Topics: hospital employee onboarding · hospital employee onboarding checklist · hospital offboarding access · healthcare joiner mover leaver