Dental User Access Reviews: 2026 HIPAA Checklist

A user access review is a reconciliation exercise. The practice collects the active identities and privileges for systems that create, receive, maintain, or transmit ePHI, then compares that access with current employment, job duties, vendor relationships, and approved business needs. The review should include the practice-management system, imaging, Microsoft 365 or Google Workspace, backup portals, remote-support tools, security consoles, servers, firewalls, cloud applications, and other systems that can expose or control sensitive data.

The useful output is not a spreadsheet that says every account exists. It is a decision record showing which access is still appropriate, which access should be reduced or removed, who approved exceptions, and what corrective work was completed. That turns access management from a setup task performed during onboarding into an ongoing security control that reflects the practice as people and technology change.

The current HIPAA Security Rule requires regulated entities to implement policies and procedures so access to ePHI is appropriate for workforce members and other authorized users. HHS also requires technical access controls for systems maintaining ePHI so only authorized persons or software programs receive access. OCR's audit protocol looks for procedures that terminate access when employment or another arrangement ends and for appropriate privilege changes when a workforce member's job description changes.

HIPAA is intentionally flexible about technology. It does not tell every dental practice to buy a particular identity platform or use one permission template. The practice should instead be able to explain how its access decisions reduce identified risk and how those decisions are implemented across the actual systems that staff, contractors, and vendors use.

Unique identities create accountability. OCR's audit protocol evaluates whether users are assigned unique IDs so activity can be attributed to a specific person. Shared front-desk, clinical, or administrator credentials weaken that attribution because several people can appear as one identity in audit logs, password resets, permission changes, and incident investigations.

Shared physical workstations do not require shared application identities. A practice can design fast sign-in workflows, workstation locking, badge or identity tools, and role-based access while still giving users individual accounts. The exact technical design should fit clinical workflow, but the audit trail should not depend on guessing which staff member was using a generic account at a particular time.

Start with accounts that can create the most impact: domain or directory administrators, cloud tenant administrators, firewall and network-management accounts, backup administrators, security consoles, remote-management tools, PMS and imaging administrators, vendor support identities, and accounts that can export large amounts of data. Then review ordinary workforce accounts and application roles against current job responsibilities.

Do not forget identities outside the main directory. Dental environments often accumulate separate vendor portals, imaging accounts, payment systems, e-prescribing access, scanners, phone systems, website administration, DNS and domain registrars, and local device credentials. A central access register helps the practice see those scattered privileges together instead of discovering them during an employee departure or security incident.

Select recent terminations and transfers and trace them through the actual systems. For a former employee, verify that interactive accounts, email, VPN, remote access, PMS access, cloud applications, physical access credentials, and other relevant identities were disabled or removed according to the practice's documented process. For a transfer or promotion, verify that access was adjusted to match the new role rather than simply adding new permissions while retaining everything from the prior job.

This evidence-based approach is stronger than asking whether offboarding usually happens. It tests whether HR, practice leadership, and IT are connected operationally. If one system is consistently missed, update the offboarding checklist and ownership model so the next departure does not depend on someone remembering an undocumented step.

Administrator rights should be easy to justify. Identify who has privileged access, what system the privilege applies to, why it is needed, whether the person also has a separate standard account for ordinary work, and how emergency or vendor use is controlled. Remove privileges that were granted for a completed project or inherited from a prior role and never revisited.

Also check recovery paths. A well-protected administrator account can still be undermined by a weak recovery email, shared MFA method, stale phone number, unmanaged local admin password, or vendor backdoor. Review the entire path by which privileged access can be obtained, reset, delegated, or recovered rather than focusing only on the visible username.

HIPAA requires procedures for obtaining necessary ePHI during an emergency. OCR's protocol examines whether emergency access is limited to appropriate personnel, whether responsibilities are defined, and whether access is normalized after the emergency. That means emergency access should be planned before an outage rather than improvised with a permanently shared administrator password.

Document who may initiate emergency access, which scenarios qualify, how credentials are protected, what activity is logged, how use is communicated, and how temporary privileges are removed afterward. Test the procedure periodically or when the environment changes so an emergency account is not discovered to be disabled, undocumented, or inaccessible at the moment it is actually needed.

The current HIPAA Security Rule does not publish one universal quarterly, monthly, or annual access-review interval for every dental practice. The practice should establish a documented cadence appropriate to its risks, workforce size, system complexity, and rate of change, and it should perform event-driven reviews when significant changes occur.

Useful triggers include employee departures, transfers, acquisitions, new locations, major PMS or imaging migrations, new remote-support vendors, changes in ownership, security incidents, and discovery of shared or stale accounts. The cadence should be frequent enough that inappropriate access is found through the control rather than by accident months later.

Keep a dated record of the systems reviewed, exported user lists or reports, reviewers, decisions, exceptions, approvals, and remediation items. For terminated staff or changed roles, retain evidence that access was actually removed or modified. For privileged accounts, document ownership and business justification. For emergency accounts, document authorized users and the procedure for invoking and closing emergency access.

The evidence should be understandable to someone who did not perform the review. That makes it useful for management oversight, future risk analysis, internal audits, incident response, and vendor transitions. Avoid storing passwords or recovery secrets in the review artifact itself; the goal is evidence of control, not a new collection of sensitive credentials.