Topic starter
25/06/2026 1:31 am
TL;DR: A nurse who left a health system a year earlier still had a working login and tried to retrieve a patient’s records, illustrating how failed offboarding turns routine care into a compliance and privacy risk, according to SailPoint. Lingering access is unmanaged identity risk, and healthcare is only the clearest example.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “Facepalm Files: Thanks for the help. Please never do that again.”.
Key questions
Q: What breaks when former employees still have access to authentication systems?
A: The main failure is persistence of trust after role change.
Q: Why do lingering credentials create compliance risk in healthcare?
A: Healthcare access is tied to patient trust, privacy, and documented need.
Q: How do security teams know whether offboarding is actually working?
A: Security teams should measure completion, not process start.
Practitioner guidance
- Verify revocation at departure Require a confirmed disablement event for every leaver before the account is considered closed, including directory, application, and records-system access.
- Track contingent-worker identities separately Maintain a dedicated inventory for travel nurses, contractors, and other non-employees so account ownership and offboarding responsibility are never ambiguous.
- Reconcile access against current need Review dormant but active accounts against current role, contract, or patient-care requirement so stale access is identified before it is reused.
Bottom line: The incident shows that offboarding failures are identity governance failures, not harmless administrative oversights.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 11:00 am
Identity lifecycle failure is the real control gap, not user intent: The nurse was not acting maliciously, which is exactly why this matters. The account remained usable a year after departure, so the organisation’s governance assumption that offboarding had ended access was false. The implication is that lifecycle controls must be measured by actual revocation, not by employment status or process completion.
A question worth separating out:
Q: Should organisations handle contractors and clinicians differently from employees?
A: Yes, because contingent access often spans more systems and is easier to lose track of. The practical difference is not the security standard but the ownership model: every non-employee identity needs a clearly assigned business owner, a verified end date, and a revocation path that does not depend on memory.
👉 Read our full editorial: Expired clinic access exposes identity lifecycle risk in healthcare