Access review checklist for HIPAA

A HIPAA access review checklist for clinics reviewing users, roles, MFA, stale accounts, shared accounts, and evidence.

Access reviews prove least privilege is being managed

Clinics change constantly: new hires, terminations, role changes, temporary coverage, vendor support, and shared workstations. A recurring access review catches drift before it becomes a bigger compliance and security issue.

Review systems, not just people

Run access reviews across email, EHR-adjacent tools, billing, scheduling, file storage, remote access, admin portals, and backup systems. Include MFA and privileged role checks when available.

Close the loop

A review is not complete until removals, role changes, and MFA fixes are confirmed. Store the review result and any follow-up evidence together.

Access review questions

Is the user still employed or contracted?

Does the role match the person’s current job?

Does the account have MFA enabled?

Is there unnecessary admin access?

Are shared accounts justified and controlled?

Were terminated or stale users removed?

Was follow-up evidence saved?