What should a dental practice do first when the office manager resigns?

Two things at once. Start the access list, because that has a real deadline attached to it, and start the knowledge list, because you only have access to the person's memory while they are still working. The access list covers user accounts, remote access, third-party and cloud accounts, shared administrative passwords, keys, badges, and door and alarm codes. The knowledge list covers payer specifics, workarounds, vendor contacts, open patient follow-ups, and the reasons behind the office's unwritten rules.

Is there a legal requirement to shut off a former employee's access?

The HIPAA Security Rule addresses it directly. 45 CFR 164.308(a)(3)(ii)(C) calls for procedures to terminate access to electronic protected health information when a workforce member's employment ends. It is listed as an addressable implementation specification, which HHS is explicit does not mean optional. A practice either puts the procedure in place, puts a reasonable and appropriate alternative in place, or documents its assessment and decision. Every path leaves a written trail. Talk with your own advisor about how this applies to your practice and your state.

Does the HIPAA security official role transfer automatically to whoever takes the job?

No. 45 CFR 164.308(a)(2) puts the obligation on the practice to identify the security official, not on any individual to hand it over. If the person who held it is leaving, the practice has to name a replacement and record that it did. This is one of the quietest gaps a departure creates, because nothing visibly breaks when it goes unfilled.

How much of this can we realistically capture in a two week notice period?

More than you would think, if you ask for it in a form the person can produce quickly. Screen recordings of the four or five tasks nobody else has done are worth more than a written manual and take a fraction of the time. A voice memo walking through the payer specifics is better than nothing and takes one sitting. The failure mode is not that people refuse. It is that nobody asks until the last afternoon.

Is cross-training enough to protect against this?

It helps, and it is worth doing, but it solves a different problem. Cross-training means a second person can do the task. It does not mean anyone can look up how the task is done. If both trained people are out, or if the second person leaves next, you are back where you started. Documentation and cross-training work together; neither one substitutes for the other.

What to Do When the Person Who Knows Everything Leaves

August 10, 2026 · 6 min read

Someone hands you a resignation letter. You are happy for them, and you mean it. Then you get back to your office, close the door, and start a list of everything only they know.

Which insurance company wants the narrative typed into the box and which one wants it attached. The trick to getting the sterilizer to finish its cycle. Who to call at the software company, and which of the three phone numbers reaches a person. The patients who said they would call back. The reason one afternoon a week is blocked off.

The list gets long fast, and almost none of it is written down.

Some of it is already written down, and that is where to start

Here is the part that gets missed in the scramble. A dental practice already carries several written obligations that name a specific person, and a departure touches every one of them. Those documents are the one place where this practice's knowledge is guaranteed to exist on paper.

The HIPAA Security Rule requires a covered entity to "identify the security official who is responsible for the development and implementation of the policies and procedures" the rule requires. That sits at 45 CFR 164.308(a)(2), it is a standard rather than a suggestion, and in a small practice that official is very often the office manager. When they go, the obligation does not go with them. The practice still has to have one, which means somebody has to be named and the naming has to be recorded.

The same section covers what happens to their access. 45 CFR 164.308(a)(3)(ii)(C) calls for procedures "for terminating access to electronic protected health information when the employment of, or other arrangement with, a workforce member ends." That specification is marked addressable, which is not the same as optional. HHS says so plainly in its own guidance written for solo and small group practices: an addressable specification "is not optional," and a practice either puts it in place, puts a reasonable alternative in place, or documents why neither is appropriate. Every one of those paths produces a document. A practice that never made the decision has neither the procedure nor the paperwork.

OSHA adds one more. The written exposure control plan has to be reviewed and updated at least annually "and whenever necessary to reflect new or modified tasks and procedures which affect occupational exposure and to reflect new or revised employee positions with occupational exposure," at 29 CFR 1910.1030(c)(1)(iv). When one person leaves and their duties get spread across three people, those are modified tasks and revised positions.

The CDC's expectations for safe dental care add a fourth named role. At least one individual trained in infection prevention should be responsible for coordinating the program. Often that is a clinical team member rather than the office manager, so this one may not be in play. The point is not who holds it. The point is that most practices cannot say out loud who currently holds each of these four roles, and a resignation is the moment that becomes expensive.

Then decide what gets shut off, and when

HHS published a short piece on exactly this situation, under the heading "Your Employee Just Quit!" It is guidance rather than a rule, but the checklist is sound and it comes from the agency that would be asking the questions later.

De-activate the user accounts. Turn off remote access. Turn off the third-party and cloud accounts, which is the one that gets forgotten, because those live outside the practice software and nobody keeps a list of them. Change the password on any shared administrative account the person could reach. Collect the keys, the badges, and the fobs, and change the door and alarm codes.

That last one is worth saying out loud. If the person who is leaving knows the alarm code, then the alarm code is now a former employee's alarm code.

Write down what only they knew, while they are still here

The regulatory list is the floor. It is not what will hurt you later. What will hurt is the working knowledge that never had a home.

Here are the categories worth capturing, roughly in order of what they cost when they go missing.

The payer specifics. Which plan needs which attachment, in what format, through which portal, and which one will deny the claim if the narrative is a sentence too short. This is usually the single most expensive undocumented thing in a practice, because it stays invisible until claims start coming back.

The workarounds. Every office has a handful of steps that are not how the software is meant to work, but are how this office actually does it. Nobody writes these down because everybody is a little embarrassed by them.

Who to call. Vendor contacts, account numbers, the rep who answers, the phone tree shortcut that gets you a human.

The open follow-ups. The treatment somebody said they would think about. The patient waiting for a benefit year to turn over. If that list lives in one person's memory, it walks out the door with them.

The reasons. Why that afternoon is blocked. Why this patient gets a call and not a text. Anyone can copy a rule. The reason behind the rule is what makes it survive contact with a busy morning.

Ask for all of it in writing while the person is still in the building and still glad to help. Most people are glad to help. Very few of them get asked.

Give it an owner and a place

Written knowledge survives when somebody owns it and there is one obvious place it lives. That is the whole lesson of the required documents above. They persist because a named person is responsible and there is a consequence for letting them go stale. Operational knowledge usually gets neither, which is why it evaporates.

Cross-training helps, and you should do it, but cross-training moves knowledge from one head into two heads. It does not put it anywhere you can look it up.

You do not need to write a manual in one sitting. You need somewhere the next person can look, and a habit of putting things there.

That is the work Saige does. It gives a practice one place for its procedures, its training material, and the specific answers to the specific questions this office actually gets asked, so a new hire can look something up instead of interrupting the one person who remembers. The knowledge stops being a person and becomes a place.

If you want to see how that would fit your office, we are glad to walk you through it. No contracts and no onboarding fee, so the decision stays reversible.

The departure in front of you right now is going to be hard either way. The one after it does not have to be.

Deren Flesher, DDS. Founder, AiroDental.

Frequently asked questions

What should a dental practice do first when the office manager resigns?: Two things at once. Start the access list, because that has a real deadline attached to it, and start the knowledge list, because you only have access to the person's memory while they are still working. The access list covers user accounts, remote access, third-party and cloud accounts, shared administrative passwords, keys, badges, and door and alarm codes. The knowledge list covers payer specifics, workarounds, vendor contacts, open patient follow-ups, and the reasons behind the office's unwritten rules.
Is there a legal requirement to shut off a former employee's access?: The HIPAA Security Rule addresses it directly. 45 CFR 164.308(a)(3)(ii)(C) calls for procedures to terminate access to electronic protected health information when a workforce member's employment ends. It is listed as an addressable implementation specification, which HHS is explicit does not mean optional. A practice either puts the procedure in place, puts a reasonable and appropriate alternative in place, or documents its assessment and decision. Every path leaves a written trail. Talk with your own advisor about how this applies to your practice and your state.
Does the HIPAA security official role transfer automatically to whoever takes the job?: No. 45 CFR 164.308(a)(2) puts the obligation on the practice to identify the security official, not on any individual to hand it over. If the person who held it is leaving, the practice has to name a replacement and record that it did. This is one of the quietest gaps a departure creates, because nothing visibly breaks when it goes unfilled.
How much of this can we realistically capture in a two week notice period?: More than you would think, if you ask for it in a form the person can produce quickly. Screen recordings of the four or five tasks nobody else has done are worth more than a written manual and take a fraction of the time. A voice memo walking through the payer specifics is better than nothing and takes one sitting. The failure mode is not that people refuse. It is that nobody asks until the last afternoon.
Is cross-training enough to protect against this?: It helps, and it is worth doing, but it solves a different problem. Cross-training means a second person can do the task. It does not mean anyone can look up how the task is done. If both trained people are out, or if the second person leaves next, you are back where you started. Documentation and cross-training work together; neither one substitutes for the other.

The Count

No practice closes the day on a feeling; the day sheet is set against the deposit. A software trial deserves the same habit. This post shows how to keep two columns, the task done in the tool and the task done the old way, who keeps them, and what to do when the count and the mood disagree.

October 16, 2026 · 6 min read

The Teenager Who Drove Himself

A seventeen-year-old with a license walks up to the counter by himself. May he be seen today, and who gets told what afterward? The first answer belongs to your state. The second is a federal rule most front desks guess wrong. Both belong on one page the doctor writes before he arrives.

October 12, 2026 · 7 min read

The Thing You Are Still Doing By Hand

Open the top drawer at your front desk. There is a notebook in it that was supposed to be gone when you bought the software. A by-hand process survives for one of three reasons: it is a backup, nobody was entitled to end it, or the software does not do the job. Each one calls for a different response, and none of them is throwing the notebook away.

October 9, 2026 · 6 min read