Workforce security and information access management

Granite City Family Dental — Policy set version 1.0 — Effective November 1, 2026 — Binder edition 2026

Authority: 45 CFR 164.308(a)(3) (workforce security) and 164.308(a)(4) (information access management).

Approved by Dr. Maria Lindqvist, Owner. Responsible officer: Janelle Okafor, Office Manager. Backup designee: Dr. Maria Lindqvist.

Purpose and scope

This policy controls who in the workforce of Granite City Family Dental may reach protected health information, how that access is approved, how it is reviewed, and how it is removed the day a person leaves. It applies to every employee, provider, owner, contractor, student and volunteer (9 people at the effective date) and to every system that holds electronic PHI, starting with Open Dental and Microsoft 365.

1. Authorization and supervision

Authority: 45 CFR 164.308(a)(3)(ii)(A).

Access to PHI is granted by role, never by person. The roles below and the minimum-necessary matrix in document 07 define what each role may see. A workforce member who does not need PHI for their job has no PHI access and works under the supervision of someone who does.

• Students, volunteers and temporary staff are supervised by a named employee and receive only the access that employee requests in writing.
• Vendors and contractors who work on systems are supervised while on site or connected; their access is time-limited and recorded on the Network Access Request Form.
• The Security Officer may suspend any person's access at once when misuse is suspected, pending review under the sanction policy (document 05).

2. Workforce clearance

Authority: 45 CFR 164.308(a)(3)(ii)(B).

Before a person is given PHI access the practice confirms they are suitable for that access.

• A background check is completed before hire for every position with PHI access. The result is kept in the personnel file, not in this binder.
• Professional licenses are verified with the licensing board at hire and at each renewal. The verification date is noted in the personnel file.
• Every workforce member signs the confidentiality agreement and the policy acknowledgment (document 26) before their first login.
• Privacy and security training is completed within 30 days of hire (document 12).

3. Access authorization, establishment and modification

Authority: 45 CFR 164.308(a)(4)(ii)(B) and (C).

How access is requested and approved at Granite City Family Dental:

The administrator submits a Network Access Request naming the role; the Security Officer approves; the IT provider creates accounts limited to that role's minimum-necessary access.

• Every request is written on the Network Access Request Form on the next page, approved by Janelle Okafor, and sent to CRU Technologies to carry out.
• Accounts are created with the system role named in the minimum-necessary matrix for that job. Administrator rights are given only to the Security Officer, the owner and the IT provider.
• A change of job duties is treated as a new request: the old access is removed and the new access approved on a fresh form.
• Completed forms are kept behind this policy for six years.

4. Periodic access review

Authority: 45 CFR 164.308(a)(4)(ii)(C).

Janelle Okafor reviews the user access list quarterly. The review confirms that every account belongs to a current workforce member, that the role still matches the job, that MFA is on, and that no departed person retains access. Each review is dated in the "Last reviewed" column of the user access list and signed below. An annual certification of the full list is presented at the annual review meeting (document 24).

5. Shared logins

No login to any system holding PHI is shared. Shared logins remain prohibited. If one is ever created for an emergency, the Security Officer is told the same day, its use is logged, and it is removed within 30 days.

6. Termination procedures

Authority: 45 CFR 164.308(a)(3)(ii)(C).

Access is removed on the person's last day, before or at the exit meeting, whether the departure is voluntary or not. The administrator and the Security Officer complete the Termination Checklist together and file it behind this policy.

1. Disable EHR, email, Windows and remote access accounts before or at the exit meeting.2. Collect keys, badges, laptops, phones and any paper PHI.3. Change shared door codes, alarm codes and any shared passwords the person knew.4. Remove from group mailboxes, portals, vendor accounts and MFA devices.5. Record the completed checklist in the binder.

• For an involuntary termination, accounts are disabled while the exit meeting is taking place, not after.
• Contractor and vendor accounts are disabled the day the engagement ends.
• The departures log at the end of this document is the evidence that each checklist was completed.

7. Enforcement

Violations of this policy, including sharing a login, using another person's account or keeping access after a role change, are handled under the sanction policy (document 05).

Network Access Request Form

Purpose: to request, change or remove access to the systems of Granite City Family Dental.

Requester name: __________________________________________

Role / job title: __________________________________________

Date of request: __________________________________________

Request type:

☐ New access

☐ Change of role or permissions

☐ Remove access

☐ Temporary or vendor access (end date: ______________)

Systems requested (EHR, email, Windows, remote access, portals, other): __________________________________________

Access level requested (system role name from the minimum-necessary matrix): __________________________________________

Justification: __________________________________________

MFA enrolled? [ ] Yes [ ] No, due by ______________

Confidentiality agreement signed? [ ] Yes [ ] No

Approved by supervisor / administrator: ___________________________ Date: ______________

Approved by Security Officer (Janelle Okafor): ___________________________ Date: ______________

Completed by IT provider (CRU Technologies): ___________________________ Date: ______________

Termination Checklist

Workforce member: __________________________________________

Role: __________________________________________

Last day: ______________ Voluntary [ ] Involuntary [ ]

☐ Disable EHR, email, Windows and remote access accounts before or at the exit meeting. — done by ______________ time ______

☐ Collect keys, badges, laptops, phones and any paper PHI. — done by ______________ time ______

☐ Change shared door codes, alarm codes and any shared passwords the person knew. — done by ______________ time ______

☐ Remove from group mailboxes, portals, vendor accounts and MFA devices. — done by ______________ time ______

☐ Record the completed checklist in the binder. — done by ______________ time ______

☐ Confirmed with CRU Technologies that all accounts show as disabled.

☐ Access removed from the user access list.

☐ Entry added to the departures log.

Completed by: ___________________________ Signature: ___________________________ Date: ______________

Security Officer review: ___________________________ Date: ______________

User access list

Authority: 45 CFR 164.308(a)(3)-(4). Reviewed quarterly by Janelle Okafor.

Review sign-off: ___________________________ Date: ______________

Review sign-off: ___________________________ Date: ______________

Review sign-off: ___________________________ Date: ______________

Review sign-off: ___________________________ Date: ______________

Departures log — 2026

Authority: 45 CFR 164.308(a)(3)(ii)(C).

Approval

Policy approved by: Dr. Maria Lindqvist, Owner

Signature: ___________________________ Date: ______________

Security Officer: Janelle Okafor Signature: ___________________________ Date: ______________