5.4 Exit Interviews as a Privacy Control: Departure Debriefs and Practitioner Separations

Exit Interviews as a Privacy Control: Departure Debriefs and Practitioner Separations

Section 5.3 covered the mechanics of offboarding — access revocation, asset return, the survival of confidentiality obligations. This section covers the part of the departure the outline names separately in task 3.C: recommend privacy-related issues are included in exit interviews.

Treat the exit interview as an intelligence channel, not a courtesy. A departing employee has no career incentive to stay silent and no supervisor left to protect. The single most common way a program learns that a manager has been sharing chart access credentials, that a unit routinely photographs wound care on personal phones, or that a physician has been dictating in a public corridor, is that someone said so on their way out the door.

---

1. What the Privacy Segment of an Exit Interview Must Ask

The privacy office should own a standard question set that HR incorporates into every exit interview. Five categories:

The last item deserves emphasis. The exit interview is the correct moment to obtain a written attestation that the individual has returned or destroyed all PHI in their possession and understands that the confidentiality obligation continues indefinitely. That attestation is the document you will want if the person later appears in a competitor's marketing using a patient list.

---

2. The Departure Risk Window

Data exfiltration by departing staff does not begin on the last day. It clusters in the weeks before the resignation is announced, while access is unrestricted and behavior is unremarkable.

+---------------------------------------------------------------------------------------------------+
|                       DEPARTURE PRIVACY PROTOCOL - SEQUENCE AND OWNER                             |
|                                                                                                   |
|   T-90 to T-0  RETROSPECTIVE REVIEW (Privacy + Security, triggered by notice of resignation)      |
|   • Pull 90 days of EHR access history for the departing user.                                   |
|   • Pull egress signals: bulk report exports, print volume spikes, USB writes, personal-email      |
|     attachments, cloud-sync uploads.                                                              |
|   • Compare against role norms and peer baselines, not against zero.                              |
|                                        |                                                          |
|   NOTICE PERIOD  ACCESS RIGHT-SIZING (IT + Manager)                                               |
|   • Remove elevated, administrative, and bulk-export rights immediately; retain only what the      |
|     remaining duties require. Full revocation still occurs at separation.                         |
|                                        |                                                          |
|   EXIT INTERVIEW  PRIVACY DEBRIEF (HR, with the privacy question set)                             |
|   • Ask the five categories above. Capture answers verbatim. Obtain the return/destruction         |
|     attestation. Escalate any disclosed concern to the privacy office the same day.                |
|                                        |                                                          |
|   SEPARATION DAY  REVOCATION AND ASSET RETURN (IT + Manager)                                      |
|   • Terminate all access at or before the effective moment; involuntary terminations are           |
|     revoked before the notification conversation begins.                                           |
|                                        |                                                          |
|   T+30  VERIFICATION (Privacy)                                                                    |
|   • Confirm zero post-separation access events. Confirm retrieval of anything disclosed at exit.   |
|   • Feed themes into the quarterly trend report.                                                   |
+---------------------------------------------------------------------------------------------------+

[!CAUTION] Do not let the exit interview substitute for the technical review. Someone planning to take data will not volunteer it. The attestation deters the honest and documents the dishonest; the access and egress review is what actually detects. Run both.

---

3. Practitioners, Contractors, and Business Associates Leave Differently

Departing physicians and licensed practitioners. Three obligations that a general employee exit protocol will miss:

1. Patient notification and continuity of care. State medical board rules and professional obligations generally require that patients of a departing practitioner be notified and given a means to obtain continuing care and to request their records. Silence risks a patient-abandonment finding as well as a records-access complaint.
2. Record custody. Absent a contrary contract, the medical record belongs to the practice or facility, not to the practitioner. A departing physician may receive copies of records for patients who elect to follow them, under a written instrument, with an accounting where required. Removing original charts is a records loss and, depending on facts, an impermissible disclosure.
3. Patient list use. Taking a practice-generated patient list to solicit at a new employer is a use of PHI for the physician's own marketing without authorization. Address it in the exit conversation and in the departure agreement.

Contractors, students, volunteers, and agency staff. These populations rotate constantly and are frequently invisible to the HR termination feed that triggers deprovisioning. The sponsoring department must be the trigger, and the sponsor must confirm access termination in writing. An unreconciled contractor account is one of the most common findings in an access audit.

Business associate personnel. You will not exit-interview a vendor's employee. The equivalent control lives in the BAA and in vendor oversight: contractual obligation to remove your organization's access on their personnel changes, plus periodic reconciliation of the vendor's active user list against your own records.

---

4. Closing the Loop

An exit interview finding that stops at the personnel file has produced no compliance value. The routing rules:

• Same-day escalation of any disclosed privacy concern to the privacy office, regardless of how minor it sounds.
• Investigation where the disclosure describes a possible impermissible use or disclosure, using the Chapter 9 process — a departing employee's report is an allegation like any other.
• Non-retaliation applies. Section 164.530(g) protects the individual for reporting, and a former employee who filed a complaint retains that protection; adverse references or contested unemployment claims following an exit disclosure are a serious exposure.
• Trending. Aggregate exit themes quarterly. Three departing employees from the same unit describing the same workaround is a control gap, not three anecdotes.
• Feedback to the work plan. Recurring exit themes belong in next year's audit scope and training priorities.