Stale Accounts, Real Risk: Keeping Aged Care Access Under Control

Aged care organisations manage constant change. Staff join and leave, roles change, agency workers come and go, and teams may work across several facilities.

Access to systems and applications needs to keep pace with these changes. When it doesn't, former staff, contractors or people who have changed roles often retain access they no longer need - this is a key business risk around resident information, finance systems and operational tools.

This is not the result of a person being careless - most often it is the result of a manual process, competing priorities and systems that do not react well with workforce changes.

Access should match the role

A new team member needs access to the systems required for their role and site - sounds simple. Someone changing roles may need some permissions added and others removed. A contractor may need access for a fixed period, while a former employee should lose access promptly when their engagement ends.

This becomes complex when staff work across multiple facilities, or have infrequent shift patterns . A person transferring sites may need access to the new location without retaining unnecessary access to the previous one.

The Aged Care Quality and Safety Commission identifies confidentiality, availability and appropriate access as important parts of information management. Sensitive information should be available to authorised people when required, but restricted from those who do not need it.

Access accumulation = Increased Risk

Access often grows through small changes. A person keeps permissions from a previous role or "higer duties", a temporary contractor account remains active or a worker receives access to a new site without losing old permissions.

Over time, this creates privilege creep. It makes access reviews harder and increases the potential impact if an account is compromised.

Shared accounts create another challenge. They make it difficult to determine who accessed information or changed a record, and they complicate offboarding. Each worker should have an individual account wherever possible.

Role-Based Access Controls

Role-based access controls (RBAC) connect permissions with responsibilities. Instead of assigning access individually to each person, organisations develop  "profiles" for common roles such as nurses, personal care workers, lifestyle coordinators, facility managers and contractors.

Each profile reflects what each person needs to do their work, along with the facility or team where they work and the applications, data and access needed to deliver successfully. It does NOT provide broad access simply because that may be useful later.

When someone changes roles or facilities, their access can then be updated as part of the same process.

Connecting access to workforce changes

A reliable access process follows three stages:

• Joiner: provide approved access based on the person's role and site
• Mover: remove old permissions when responsibilities change
• Leaver: disable access promptly when employment or engagement ends

Manual processes are difficult to consistently execute when an organisation has several facilities, shift work, agency staff and frequent role changes.

Connecting workforce information systems with IT security services such as Microsoft Entra ID reduce reliance on memory and individual IT requests. New workers can receive approved access, role changes trigger updates and departing workers have access disabled across connected services within seconds of an update to the workforce system being approved.

Microsolve’s aged care Microsoft 365 guidance explains how Entra ID automation can support onboarding, role changes and offboarding.

Managing contractor access

Agency staff and contractors need access available quickly, but more often that not, do not need permanent access.

While Roles are ideal, these access categories need a bit more information before access is provided: confirm which systems are required, who approved the request, which site is involved and when access expires. Agency and contract staff should be provided with Time-limited access which matches perfectly with the nature of their short-term placements, project work and temporary cover.

If their engagement is extended, access can be deliberately renewed rather than remaining active by default.

High-risk permissions

Regular access reviews are required to confirm that permissions still match a person's role where access to high-risk environments is involved.

Start with access to:

• Resident records
• Medication-related systems
• Finance information
• HR records
• Administrative tools

Look for accounts without a current owner, former workers who remain active, contractors without expiry dates and permissions carried over from previous roles.

Microsolve’s Identity and Access Management service supports identity lifecycle management, access reviews and audit activity.

Offboard promptly (with respect!)

Disabling email is only one part of offboarding. Access may also exist through Microsoft 365, Teams, SharePoint, clinical applications, remote access tools, finance systems, mobile devices and third-party services.

The offboarding process must cover all systems and remove access as soon as practical. Records may need to be retained, but the former user should not continue to access them.

Making access easier to manage

Access management should not depend on one person remembering every workforce change. Role-based access, automated lifecycle processes, time-limited contractor accounts and regular reviews make the process more consistent.

These controls do not exist to make care teams work harder. They help ensure that people can access what they need while reducing unnecessary access to resident and organisational information.

Microsolve helps aged care organisations manage Microsoft 365, Entra ID, identity lifecycle processes and security controls around real workforce and multi-site requirements.