Termination, documented the same day

Most HIPAA obligations move in months. This one moves in hours, and the thing that survives an audit is not that you did it. It is that you wrote down that you did it, on the day.

The policy is composed from your clinic’s facts

Your termination policy covers same-day account revocation on separation, device and media collection, and shared credential rotation, with a standing position that shared logins should not exist in the first place. Your rotation timing and your involuntary-revocation deadline render from your own recorded settings.

Conditional clauses fire on your facts: staff-owned devices pull in wiping clinic data from a personal device, paper records pull in retrieving physical charts, a physical facility pulls in collecting keys, badges, and codes. Your login systems and device inventory render into the policy as the actual checklist, so it names your systems rather than “all applicable accounts.”

The policy states plainly that offboarding performed but not documented is incomplete, and that delayed or undocumented offboarding opens a sanction review.

What gets tracked after the policy exists

Eight requirements:

• An active policy exists, reviewed within twelve months, with facts that have not drifted.
• Every member recorded as terminated has a termination event on file, no orphans.
• No termination has been sitting in progress for more than seven days.
• Every completed termination in the last twelve months has a signed termination letter.
• No completed termination has a required checklist item still open.
• Any administrative override has its retroactive checklist items reconciled.

The orphan check is the useful one. A member marked terminated in your workforce records with no corresponding termination event is exactly the case where someone left and offboarding never formally started.

What this is, and what it is not

This is the part to read carefully. This control tracks the offboarding paperwork: that the event exists, the letter is signed, the checklist is complete, nothing is stale. It does not read your authorization records, facility access assignments, or vendor accounts to check whether access was actually cut off.

That means a termination can show fully complete here, with every checklist box ticked, while the person’s authorization record still sits unrevoked elsewhere in the system. The checklist item is a completion you record, not a reconciliation against the access tables.

The platform does measure lingering authorization, terminated members whose access was never revoked, but that signal feeds the risk analysis, not this control. If you want the access-state answer rather than the paperwork answer, that is where it lives.

What an investigator gets

A termination event for every departed member. Signed letters. Completed checklists naming your real systems and devices. Dates on all of it. What the rule asks for is a documented process that ran, and this is that record, with its limits stated.