It's the week before Thanksgiving. A clinician is out, a colleague is covering her caseload, and a client calls in distress. The covering clinician needs the treatment plan now — and the fastest path to it is a text message that reads "my login is…". Nobody is being careless. Someone in crisis is waiting, and that outranks a password policy every time.
But that one message does something that lasts well past the holidays. From that moment, your EHR's audit log is fiction. Every action under that account looks like one person when it was really two, and if anyone later asks who opened a particular chart on a particular day — a client, an auditor, an investigator — you cannot answer. HIPAA's audit control expectations assume you can.
Why this happens every December
Coverage is a clinical necessity, and most small practices never set up a technical way to do it. So the workaround fills the gap:
- Shared credentials for the week. Passed by text or sticky note, and almost never changed when the clinician returns.
- "Just give everyone full access." The holiday fix becomes the permanent configuration, because nobody revisits it in January.
- Records exported "to have on hand." A PDF of the caseload saved to a personal laptop for the on-call week, still there in March.
- Nobody knows who's covering what. The schedule lives in someone's head, so access is granted reactively, mid-crisis, with no record of who got what.
Set it up properly before the schedule thins out
This is a one-afternoon project, and it holds for every future holiday, medical leave and resignation:
- Every clinician has their own account. No exceptions, ever. If your EHR charges per user, that cost is lower than one breach investigation — and most platforms have a lower-tier or coverage seat for exactly this.
- Learn your EHR's coverage or proxy feature. Most behavioral health platforms can grant one clinician temporary access to another's caseload, logged under their own name. Ask your vendor what theirs is called; it's usually already included.
- Create a break-glass procedure, not a shared password. Write down who can grant emergency access, how it's requested at 9 p.m. on a Sunday, and that it's logged and reviewed afterward. Clinicians will follow a fast process; they route around a slow one.
- Write the coverage schedule down before the holidays. Who covers whose caseload, which dates, and what access each person needs. Grant it on the start date, remove it on the end date.
- Put a January reminder on the calendar. Reverse the temporary permissions. This is the step everyone skips, and it's why so many practices quietly run with everyone having access to everything.
The season makes it worse
Behavioral health volume doesn't drop in December — for many clients it rises, and so does crisis contact. You're handling more sensitive moments with fewer people on hand, which is exactly when a clean record of who accessed what matters most. The same logic applies to your downtime plan: decide calmly in advance, so nobody improvises under pressure.
This week, ask your EHR vendor one question: "How do we give a covering clinician temporary access to another clinician's caseload, logged under their own name?" Then write your December coverage schedule with access start and end dates beside each name. We've put the full checklist — onboarding, coverage, offboarding and annual review — in our free resources library.
Your team will share a password if that's the only way to cover a client in crisis. The fix isn't a sterner policy. It's giving them a faster, legitimate path — set up in November, while there's still time to do it calmly.
Andrew — Founder, NextGen Strategy Partners
Veteran-owned managed IT for the nonprofits, schools, behavioral health providers, and medical & dental practices of McHenry & Lake Counties. Request a free security assessment →