What should you do when a staff person leaves your agency and should no longer have access to HMIS?

What should you do when a staff person leaves your agency and should no longer have access to HMIS?

• A. Delete the account from the HMIS interface.
• B. Email the HMIS Team to deactivate.
• C. Change their role to inactive in the admin panel.
• D. Do nothing until the next audit.

Answer: (B)

When a staff member leaves, stopping their access to client data and HMIS resources immediately is essential to protect privacy and maintain security. The best approach is to email the HMIS Team to deactivate the account. This triggers a centralized, official offboarding process: their login is revoked across all systems, any API keys or single sign-on tokens are disabled, and the deactivation is recorded in an auditable ticket. This creates a trace of who requested the change and when, which supports compliance and future reviews. Relying on in-interface deletion or simply changing a role can leave gaps—local removals might not propagate to connected systems or preserve the necessary audit trail. Waiting for the next audit is not appropriate, as access should be stopped as soon as the departure is known.

When a staff member leaves, stopping their access to client data and HMIS resources immediately is essential to protect privacy and maintain security. The best approach is to email the HMIS Team to deactivate the account. This triggers a centralized, official offboarding process: their login is revoked across all systems, any API keys or single sign-on tokens are disabled, and the deactivation is recorded in an auditable ticket. This creates a trace of who requested the change and when, which supports compliance and future reviews.

Relying on in-interface deletion or simply changing a role can leave gaps—local removals might not propagate to connected systems or preserve the necessary audit trail. Waiting for the next audit is not appropriate, as access should be stopped as soon as the departure is known.