A new hire starts Monday. By 9:15 they have a login to the practice management system, a spot at the front desk, and a full view of the schedule. Nobody has handed them a policy, a confidentiality agreement, or ten minutes of training.
That is a problem. Not because anyone did something malicious. Because HIPAA treats access as the trigger, not intent, and the paperwork that proves you handled that access correctly is created on day one or it is not created at all.
This piece walks the onboarding sequence in order: what has to happen before access is granted, what has to happen in the first week, and what has to end up in a file you can hand an investigator two years from now.
Why Onboarding Is a Compliance Event, Not an H.R. Errand
Most small practices treat onboarding as a payroll task. Tax forms, direct deposit, scrubs, done.
The Security Rule disagrees. Workforce security under 45 CFR 164.308(a)(3) asks you to authorize and supervise workforce members who work with electronic P.H.I. (Protected Health Information), to have a clearance procedure that determines whether someone’s access is appropriate, and to have procedures for terminating that access. The Privacy Rule adds training at 45 CFR 164.530(b)(1) and sanctions at 45 CFR 164.530(e).
None of that happens after the fact. It happens as the person is hired.
Most small clinics that contact One Guy Consulting have never run an onboarding sequence like this. That is not shameful. It is the starting point.
Before You Create the Login
Two things belong in front of the account creation, not behind it.
Decide what this role actually needs
Minimum necessary is not only about disclosures to the outside. It shapes internal access too. A front desk hire needs demographics, scheduling, and billing contact. A hygienist needs the clinical chart. A part-time bookkeeper may need neither.
Write the role down and write down what it gets. That single sentence is your access authorization record under 45 CFR 164.308(a)(4)(ii)(B). It does not need to be a form from a vendor. It needs to exist.
Run the clearance step
45 CFR 164.308(a)(3)(ii)(B) is an addressable specification, and addressable does not mean optional. It means you implement it, or you document why it is not reasonable and what you do instead. For most small practices, clearance is a background check for anyone with clinical or financial system access, plus license verification where a license applies.
Document the date it was run and who reviewed it. That is the whole requirement.
The First Day Paperwork
Three documents, signed before access is live.
A confidentiality agreement. This is the workforce member promising to protect P.H.I., to use it only for their job, and to report problems. It is not a B.A.A. (Business Associate Agreement). A B.A.A. governs an outside company that handles P.H.I. on your behalf. An employee is workforce, not a business associate, and giving an employee a B.A.A. signals to a reviewer that the distinction is not understood in your office.
A signed acknowledgment that they received the policies. Not “we emailed the handbook.” A dated signature saying they read the policies that apply to their role, including the sanctions policy.
A sanctions acknowledgment. 45 CFR 164.530(e) requires sanctions against workforce members who violate your policies. Sanctions applied to someone who was never told the rule tend not to survive scrutiny, from OCR (Office for Civil Rights) or from an employment lawyer.
Saying “everybody here knows not to snoop” does not change the regulatory classification of an unauthorized access. Get the signature.
Training, and What “Reasonable Period of Time” Means
45 CFR 164.530(b)(1) requires training on your privacy policies and procedures “as necessary and appropriate for the members of the workforce to carry out their functions.” The timing for new hires sits in a separate implementation specification: 45 CFR 164.530(b)(2)(i)(B) requires training each new member of the workforce within a reasonable period of time after the person joins. The security awareness requirement at 45 CFR 164.308(a)(5)(i) runs alongside it.
The regulation does not give a number of days. You will find a lot of articles that say “it depends” and then move on. That is not helpful, so here is the practical standard One Guy Consulting uses with clients: complete the training before the new hire works unsupervised with P.H.I., and no later than 30 days from the start date. Then repeat annually, tracked from the completion date of the last session, not from a calendar quarter someone picked.
Two things make a training record hold up. The exact date and time it was completed, and the name of the specific module completed. “Staff trained 2026” is not a record. It is a note.
Access, Devices, and the Things People Forget
Unique user ID, always
45 CFR 164.312(a)(2)(i) requires a unique name or number for identifying and tracking user identity. Shared front desk logins are among the most common findings in small practices, and they destroy your audit trail. If four people use “frontdesk,” nobody accessed anything. The system cannot tell you who did.
The device the new hire will actually use
Whether it is a practice laptop or their own phone checking the schedule, it goes on the inventory the day they start. Record the device, whether it stores or accesses electronic P.H.I., and whether full disk encryption is on. FileVault on a Mac, BitLocker on Windows. Encryption is addressable under 45 CFR 164.312(a)(2)(iv), and where it is in place, encrypted data that meets the H.H.S. (Department of Health and Human Services) standard is not considered unsecured, which changes the breach notification math entirely.
Physical access
Keys, door codes, badge, alarm code. Write down what was issued to whom on what date. This is the part that becomes urgent the day someone quits, and it is also 45 CFR 164.310(a)(2)(iii).
What You Keep, and For How Long
45 CFR 164.530(j) requires documentation to be retained for six years from the date of its creation or the date it was last in effect, whichever is later.
For each workforce member, that means the access authorization, the clearance record, the signed confidentiality agreement, the policy acknowledgments, the training completion records with dates, and the device and physical access issuance record.
When an auditor asks, and they will ask, you need to show the paper trail. A binder collecting dust in a back office still beats a mental note, but a searchable record you can export beats both.
The Offboarding Mirror
Every item on this list has a matching item on the way out. Access revoked, devices returned, keys collected, all on the last day, all with a date.
45 CFR 164.308(a)(3)(ii)(C) covers termination procedures, and lingering access for departed staff shows up in enforcement actions and breach reports with grim regularity. If you build the onboarding checklist properly, the offboarding checklist is the same list read backwards.
Frequently Asked Questions
Does HIPAA require background checks for new hires?
The Security Rule’s workforce clearance procedure at 45 CFR 164.308(a)(3)(ii)(B) is addressable, so it is not a flat federal mandate for a background check specifically. You must assess whether it is reasonable and appropriate, implement it if it is, and document the alternative if it is not. Separately, state law and payer contracts often require screening, and exclusion checks against the O.I.G. (Office of Inspector General) list apply to organizations billing federal programs.
How long do we have to train a new employee under HIPAA?
45 CFR 164.530(b)(2)(i)(B) says training must happen within a reasonable period of time after the person joins the workforce, without naming a number. A defensible practice is before unsupervised access to P.H.I. and no later than 30 days from the start date, with the completion date documented.
Do employees sign a business associate agreement?
No. Workforce members are not business associates. Employees sign a confidentiality agreement. B.A.A.s are for outside vendors that create, receive, maintain, or transmit P.H.I. on your behalf.
Can new hires share a front desk login for their first week?
No. 45 CFR 164.312(a)(2)(i) requires unique user identification, and shared credentials eliminate the ability to reconstruct who accessed what. Set up the individual account before the first shift.
What if we hired someone six months ago and skipped all of this?
Do it now, dated today, honestly. Backdating documents is far worse than a late record. Run the access review, get the agreements signed, complete the training, and note in your file that the gap was found and closed on the date it was closed.
Does a volunteer or a student intern need onboarding paperwork?
Yes, if they have access to P.H.I. The definition of workforce at 45 CFR 160.103 includes volunteers and trainees under the direct control of the covered entity, whether or not they are paid.
How long do we keep onboarding records after someone leaves?
Six years from creation or from the date the document was last in effect, whichever is later, per 45 CFR 164.530(j). Employment law retention periods run separately and may be longer.
Conclusion
Onboarding is the cheapest compliance work you will ever do. Every item here takes minutes on day one and takes days to reconstruct two years later under pressure.
If you want a second set of eyes on how your practice brings people on, One Guy Consulting offers a free 30-minute review that walks your current onboarding sequence, names the gaps, and flags which ones matter first. No obligation, no pressure.
One Guy Consulting offers affordable HIPAA compliance packages for practices of all sizes. Learn more.
This article is educational and is not legal advice. Chuck Weiselberg is not an attorney. For legal questions about your specific situation, consult legal counsel.
Sources
- 45 CFR 164.308(a)(3), workforce security, including authorization and supervision, workforce clearance, and termination procedures
- 45 CFR 164.308(a)(4), information access management, including access authorization and access establishment and modification
- 45 CFR 164.308(a)(5)(i), security awareness and training
- 45 CFR 164.310(a)(2)(iii), access control and validation procedures
- 45 CFR 164.312(a)(2)(i), unique user identification
- 45 CFR 164.312(a)(2)(iv), encryption and decryption
- 45 CFR 164.530(b)(1), privacy training requirement
- 45 CFR 164.530(e), sanctions
- 45 CFR 164.530(j), documentation and six-year retention
- 45 CFR 160.103, definition of workforce
- H.H.S. guidance on securing P.H.I. for breach notification purposes