Access control is one of the most foundational concepts in information security, and it's also one of the most underimplemented in small practices. The reason is simple: when you're running a small team, access control feels bureaucratic. Why add friction to a three-person staff sharing systems they all use together?
The answer is that access control isn't primarily about preventing insider threats. It's about limiting the blast radius when something goes wrong. When an account is compromised, when a device is stolen, or when a staff member leaves unexpectedly, your access controls determine how much damage can be done before you can respond.
The three principles of access control
Least privilege
Every person should have access to exactly what they need to do their job, and nothing more. A front desk coordinator doesn't need access to clinical notes. A billing specialist doesn't need admin access to your EHR. A part-time contractor doesn't need access to your full patient database.
This isn't about distrust. It's about limiting what an attacker can access if they compromise any individual account. An account with limited access is a contained problem. An account with admin access to everything is a catastrophe.
Unique accounts
Every person who accesses systems with patient data needs their own account with their own credentials. No shared logins. No "team" accounts. No "just use my login while I'm on vacation."
Shared accounts make it impossible to audit who did what. They make offboarding impossible without disrupting other users. And they mean that one compromised credential gives an attacker access to everything that account can reach.
Regular review
Access doesn't manage itself. People change roles. Staff leave. New systems get added. Access that was appropriate six months ago may not be appropriate today. A quarterly review of who has access to what takes an hour and catches the gaps that create the most risk.
The offboarding gap: The most common access control failure in small practices isn't about current staff. It's about former staff. Departed employees whose accounts weren't promptly disabled remain a persistent risk for months or years. Check your active user lists against your current staff roster.
Practical access control for small practices
EHR and practice management systems
Most EHR systems have role-based access controls built in. Use them. Assign roles based on job function, not convenience. Review active users quarterly and disable accounts within one business day of a staff departure.
Each staff member should have their own email account under your domain. Individual accounts allow you to audit activity, disable access immediately when someone leaves, and maintain clear communication records. Shared inboxes (like info@ or billing@) are fine for shared communication, but shouldn't be the only account a person uses.
Cloud storage
Set folder permissions based on need. Not everyone in the practice needs access to every folder. Clinical staff don't need access to HR files. Admin staff don't need access to clinical templates. Configure permissions intentionally and review them when roles change.
Admin accounts
Keep admin accounts separate from daily-use accounts where possible. If you need admin access to configure a system, use a dedicated admin account for that task, not your regular email-reading, document-editing account. This limits the damage from a phishing attack that targets your regular account.
The offboarding checklist: When a staff member leaves, within the first business day: disable their login to all systems, remove them from shared accounts, transfer ownership of any files they owned, forward or close their email account, and revoke any physical access (keys, codes). Don't wait until the exit interview is done. Do it on the last day.
Passwords still matter, just not alone
Strong, unique passwords for every account remain important. A password manager (1Password, Bitwarden, LastPass) solves the problem of staff reusing passwords across systems. Combined with MFA, strong unique passwords close the majority of credential-based attack pathways.
The goal is defense in depth: MFA as the second factor, least-privilege access to limit blast radius, and regular review to catch what's drifted. None of these requires a dedicated IT team to implement. They require intentionality and a routine.
Access control is the unsexy part of cybersecurity. It's not a product you buy. It's a practice you build and maintain. But it's also where most breaches could have been stopped or contained, and where a small investment of time creates substantial risk reduction.
Want to see how your access controls compare to HIPAA requirements?
The free Cyber Health Score takes 5 minutes and covers access control across the systems most practices use.
Get your free Cyber Health Score