How To Remove Former Employee Access To Dental Software
Protect your practice with DDS Rescue's 7-step offboarding runbook. Revoke dental software access and stay HIPAA-compliant. Book a FREE Rescue Call!
Key Takeaways
- Terminations create immediate risk when former employees retain access to dental practice management systems holding patient records.
- Generic IT offboarding usually stops at email and never reaches the PMS, imaging software, clearinghouse portals, or shared logins that actually hold ePHI.
- A seven-step sequence plus software-specific deactivation paths closes every access point and creates a HIPAA-ready record.
- Shared front-desk credentials and forgotten portal logins are the most common gaps that leave practices exposed after an employee departs.
- DDS Rescue delivers dental-exclusive compliance and cybersecurity support that covers offboarding, risk assessment, and incident response.
Talk Through Your Offboarding Risks
Before You Start: Roles, Checklist, And Credentials
The office manager owns this process, but it only works when key roles are clear. The practice owner approves the termination and needs one sentence confirming offboarding is complete. The lead dental assistant confirms clinical-side access such as imaging software, sensors, and any clinical-only logins that the office manager may not see. Any existing IT provider is informed and supports the work, while the practice still directs the sequence.
Gather these items before changing any settings:
- Administrator credentials for the PMS (practice management software holding the schedule, charts, and patient records)
- A written list of every system the employee used, including clinical, administrative, and vendor-facing tools
- The employee’s devices, hardware tokens, keys, and badge
- A printed or digital checklist to sign and timestamp when each step is complete
Three terms appear throughout this runbook. ePHI means electronic protected health information, which is any patient data stored or transmitted digitally. MFA means multi-factor authentication, a second verification step beyond a password. A BAA is a Business Associate Agreement, the contract HIPAA requires before a vendor can handle patient data.
Get Your Offboarding Plan Reviewed
How To Remove Former Employee Access To Dental Software: The 7-Step Sequence
Work through these steps in order so every access path closes cleanly. Each step addresses a specific way a former employee could still reach ePHI.
- Disable the practice management software account the same hour. Deactivate the user account immediately and keep the record. Deletion removes the audit trail and can orphan historical records. See the software-specific section below for the exact path in your system.
- Change every shared password the employee could have seen. This includes the front-desk shared login, shared operatory accounts, and any generic admin credentials. 45 CFR 164.308(a)(5)(ii)(D) lists password management as an addressable HIPAA implementation specification, so rotating credentials a departing employee knew is a direct compliance obligation.
- Revoke access to imaging and radiography software. Imaging systems carry a separate login from the PMS and are routinely forgotten during offboarding. The lead dental assistant should confirm this step is complete for every imaging platform in use.
- Kill clearinghouse, insurance, and vendor portal access. Claims and eligibility portals hold ePHI and rarely appear on generic offboarding lists. Each portal requires its own login revocation, because access does not cascade from the PMS or email account.
- Cut remote access. Disable VPN credentials, remote desktop sessions, and any remote support tool the employee may have installed on a practice workstation. HIPAA’s Workforce Security standard at 45 CFR 164.308(a)(3)(ii)(C) requires procedures for terminating access to ePHI when employment or another workforce arrangement ends, and remote pathways count as access pathways.
- Recover devices and physical access. Collect the laptop, any tablets, USB drives, keys, badge, and MFA hardware token. Change door codes, alarm codes, and the Wi-Fi password. 45 CFR 164.310(a)(2)(iii) makes access control and validation procedures an addressable specification that includes physical entry revocation.
- Sign and timestamp the offboarding record, then review the audit log. This step turns a scramble into a defensible record. Document every system, who disabled it, and when. Then pull the audit log and confirm no logins occurred after the termination time. 45 CFR 164.308(a)(1)(ii)(D) requires covered entities to regularly review records of information system activity, including audit logs and access reports.
Generic email and workspace deactivation covers only a narrow slice of step two, usually limited to the inbox. It often leaves the PMS, imaging software, clearinghouse portals, and shared front-desk logins untouched and produces no record tied to HIPAA’s termination-procedure requirement.
Have DDS Rescue Check Your 7 Steps
Software-By-Software: Deactivating A User In Open Dental, Dentrix, Eaglesoft, And Denticon
Step one told you to deactivate the PMS account without deleting it. This section shows where to do that in the four systems most dental practices run. Menu paths vary by software version, so confirm each path against the vendor’s current documentation before clicking, and record the version number in the offboarding log. The paths below reflect the general navigation structure of each system and serve as a starting point.
Open Dental: Deactivate And Hide, Never Delete
In Open Dental, to edit an existing user, go to the Main Menu, click Setup, then Security, and double-click the user in the grid to open the User Edit window. Use the deactivate and hide options rather than deleting the record. Deleting a user in Open Dental removes the audit trail and the record of who performed which actions, and can orphan historical chart entries tied to that user ID.
The recurring question is direct: can you delete a user in Open Dental. The defensible approach is to deactivate and hide the account and keep the record intact. The audit trail is what makes the offboarding defensible if HHS ever asks.
Dentrix: Inactivate The Staff Member, Then Check E-Services
In Dentrix, staff setup is accessed from the Office Manager via Maintenance > Practice Setup > Practice Resource Setup, where assistants and administrative staff are entered under Staff. Locate the departing employee and set their status to inactive. The critical trap is that inactivating the staff record does not automatically remove portal or e-services access. Dentrix e-services and any connected patient communication or insurance portal logins are managed separately and require their own revocation step.
Eaglesoft: Uncheck Active, Then Chase The Portal Login
In Eaglesoft, go to Lists → Provider/Staff, open the departing employee’s record, and uncheck the Active checkbox. As with Dentrix, the staff list entry and any employee portal or e-services login are separate. Unchecking Active in the staff list does not close the portal account, so that step must be completed independently.
Denticon: Inactivate The User And Confirm The Account Is Disabled
In Denticon, navigate to Setup → Security → Users, locate the departing employee, and set the account to inactive. Because Denticon is cloud-hosted, confirm that the account is fully disabled, not just removed from the schedule or a role assignment, before closing this step in the offboarding record. Cloud-hosted systems require the same deliberate confirmation as server-based systems.
Confirm Your PMS Deactivation Steps
The Access That Actually Lingers: Shared Logins And Connected Systems
The shared front-desk login is the most common real-world failure. One shared credential means changing the password locks out the entire team, so nobody changes it and the former employee still knows it. 45 CFR 164.312(a)(2)(i) makes unique user identification a required HIPAA implementation specification for exactly this reason, because shared credentials make it impossible to prove a terminated employee’s access was actually revoked.
The systems most commonly missed in a dental practice offboarding include:
- Shared front-desk and operatory logins that require a password rotation affecting all remaining staff
- Imaging and sensor software that carries a separate login from the PMS and is routinely skipped
- Clearinghouse and insurance eligibility portals that hold ePHI and rarely appear on a generic checklist
- VPN and remote desktop tools covering any remote access the employee used, including tools they may have installed themselves
- The practice’s email account, including any shared mailbox or distribution list the employee administered
- Consumer AI tool accounts where staff may have pasted patient information, which creates risk because those tools will not sign a BAA and still need to be reviewed and closed
The practical fix for shared front-desk logins is to move the team onto named individual accounts. The next termination then becomes a one-click deactivation instead of a password change that disrupts everyone and creates a window of exposure. For a broader look at securing practice email and accounts, see How To Secure Dental Practice Email Accounts: 7 Steps.
The Paper Trail: HIPAA Termination Procedures And Workforce Access
The HIPAA Security Rule at 45 CFR 164.308(a)(3)(ii)(C), an addressable implementation specification, requires covered entities to implement procedures for terminating access to ePHI when employment or another workforce arrangement ends, or to document why that is not reasonable and appropriate and implement an equivalent alternative measure. The HHS Office for Civil Rights is the authoritative source for the rule’s text and enforcement guidance. This article does not constitute legal advice and does not substitute for an attorney.
The artifact that satisfies this requirement is a signed, timestamped offboarding record listing every system, who disabled it, when, and the results of the audit-log review. 45 CFR 164.316(b)(2)(i) requires Security Rule documentation to be retained for six years from the date of creation or the date it was last in effect, whichever is later. Keep the offboarding record with the practice’s HIPAA documentation set and make it retrievable.
For a full overview of the cybersecurity posture a dental practice should maintain, see Dental Practice Cybersecurity: A Step-By-Step Office Plan.
If The Account Was Used After The Employee Left
The audit-log review in step seven sometimes reveals post-termination activity. Warning signs include logins at unusual hours, records viewed that the employee had no job-related reason to open, and a password reset nobody on staff requested. A 2026 HIPAA Journal analysis of HHS OCR breach data found unauthorized access and disclosure incidents were the second-leading cause of large healthcare data breaches in the first half of 2026. In one documented case, a former employee’s credentials remained active for two days after termination and were used to access over a million patient records.
If post-termination access is suspected, take these immediate steps:
- Preserve the audit log and avoid clearing or overwriting it
- Avoid wiping the device associated with the suspected access
- Notify the practice owner immediately
- Get a technical determination of what actually happened before anyone concedes anything to any party
DDS Rescue’s bench supports this situation with both technical and legal expertise. A CISSP runs the forensic analysis to establish whether a breach actually occurred by reading system logs and determining the scope of access. DDS Rescue also provides access to an on-staff HIPAA attorney who spent ten years at the HHS Office for Civil Rights, including as its HIPAA Team Lead, to handle the response. 45 CFR 164.308(a)(6)(ii) requires covered entities to identify and respond to suspected security incidents, mitigate harmful effects, and document incidents and their outcomes. A clear technical determination before any disclosure decision supports a managed response.
Get Help With A Suspected Breach
DIY Or Hand It To A Dental Partner
The checklist above is sufficient for a small practice with a clean termination, no sign of post-departure access, named individual logins across every system, and someone on staff who has the admin credentials and the time to work through it completely.
Bring in a partner when any of the following apply: multiple locations, shared logins across the front desk, a cloud-hosted PMS, any indication the account was used after departure, or no one on staff who can read an audit log and interpret what it shows.
DDS Rescue is the dental-exclusive compliance and cybersecurity company that handles this end to end. Its services cover OSHA and infection control compliance, HIPAA compliance, backup and recovery, and managed cybersecurity, with more than 1,000 practices supported nationwide and an 85% renewal rate on compliance clients. Compliance, HIPAA, backup, and cybersecurity are delivered nationally and live and virtually, so location is never a constraint. On-site IT and managed services are available within San Diego County.
Generic managed IT often relies on workspace account deactivation plus a short generic checklist that focuses on the inbox. DDS Rescue’s scope extends through the PMS, imaging software, clearinghouse portals, and shared front-desk logins, and it backs incident response with a CISSP-led team and access to an on-staff HIPAA attorney if something goes wrong.
Conclusion: Run The Steps Today, Then Close The Gaps
Running a structured offboarding sequence protects patient data, satisfies HIPAA’s termination requirements, and reduces the chance of a post-termination incident. The seven steps, the software-specific paths, and the signed record give the practice a clear story if anyone ever asks how access was removed.
Run the seven steps today, sign the offboarding record, and then schedule a FREE Rescue Call to close the gaps the checklist surfaced and to plan longer-term improvements.
Schedule Your FREE Rescue Call
Frequently Asked Questions
Can I Delete A User In Open Dental, Or Should I Deactivate?
Deactivate and hide the account and avoid deleting it. Deleting a user in Open Dental removes the audit trail and the record of who performed which actions in the system, and can orphan historical chart entries tied to that user ID. The deactivated account stays in the database as a read-only record, which aligns with HIPAA’s audit-control requirements. If HHS ever asks who accessed a chart on a given date, that record needs to exist.
How Do I Remove Access For A Terminated Employee If The Front Desk Shares One Login?
Change the shared password the same day as the termination and coordinate the change with all remaining staff so they are not locked out. Then move the front desk onto named individual accounts as soon as operationally possible. Named accounts make the next termination a one-click deactivation instead of a password rotation that disrupts the whole team and creates a window of exposure. Shared credentials also make it impossible to prove in an audit log that a specific former employee’s access was actually revoked.
Does Deactivating A Staff Member In Dentrix Or Eaglesoft Also Remove Their Portal Access?
No. In both Dentrix and Eaglesoft, the staff list entry and the portal or e-services login are separate systems. Inactivating the staff record in Dentrix’s Practice Resource Setup stops the person from appearing in scheduling and clinical workflows, but it does not close their Dentrix e-services login or any connected patient communication portal. The same applies in Eaglesoft: unchecking Active in the Provider/Staff list does not revoke the employee portal account. Both steps must be completed independently and documented in the offboarding record.
How Long Do I Keep The Offboarding Record?
Keep the offboarding record with the practice’s HIPAA documentation set and retain it for at least six years. The six-year period runs from the date the record was created or the date it was last in effect, whichever is later, consistent with the HIPAA Security Rule. The record should be retrievable on demand so that, if HHS investigates a breach or conducts a compliance review, the practice can produce evidence of the termination procedure.
What Do I Do If I Think The Former Employee Logged In After They Left?
Preserve the audit log immediately and avoid clearing or overwriting it. Do not wipe the device associated with the suspected access. Notify the practice owner. Then obtain a technical determination of what actually happened, including which records were accessed, from which device, and at what time, before anyone concedes anything to any party, including the former employee. A forensic review establishes whether a reportable breach actually occurred and prevents commitments based on incomplete information.
Does HIPAA Require Anything Specific When An Employee Leaves?
Yes. 45 CFR 164.308(a)(3)(ii)(C), an addressable implementation specification, requires covered entities to implement procedures for terminating access to ePHI when employment or another workforce arrangement ends, or to document why that is not reasonable and appropriate and implement an equivalent alternative measure. Because the specification is classified as addressable, a practice must either implement it or document why an equivalent alternative is more appropriate. The HHS Office for Civil Rights is the authoritative source for the rule’s text and enforcement guidance. This article does not constitute legal advice.
Can DDS Rescue Handle This For A Practice Outside San Diego?
Yes. Compliance, HIPAA, backup, and cybersecurity are delivered nationally and live and virtually, so location does not limit those services. Every walkthrough and training session is conducted live and remotely, so a practice in any state can access the full compliance and cybersecurity offering. The one geographic limitation applies to on-site IT and managed services, which are available within San Diego County.
What Does A FREE Rescue Call Involve?
A FREE Rescue Call is a conversation with a person who knows the subject and can scope your situation on the call. The discussion focuses on what the practice’s offboarding and compliance picture actually needs, which systems are involved, whether shared credentials are a factor, whether there is any sign of post-departure access, and what the next concrete steps look like. There is no obligation and no required commitment, only a structured starting point for getting the situation handled correctly.
