Quarterly Access Recertification for Peptide Clinic Staff

Published October 12, 2026.

Start from current work, not old job titles

A recertification should compare each identity's actual responsibilities with the systems and roles currently assigned. Include employees, contractors, remote assistants, vendors, shared mailboxes, API tokens, and service accounts. The system owner should define privilege levels, while the manager confirms work need. An assistant can assemble evidence and chase responses but should not approve their own access or resolve ambiguous clinical and administrative boundaries alone.

Give reviewers useful context

For every access grant, show the system, role, sensitive functions, last activity when appropriate, grant date, owner, and linked job responsibility. Grouping everything under “user” makes review superficial. Flag dormant accounts, duplicate identities, former projects, broad administrator roles, and accounts without owners. Do not use inactivity alone to remove a critical service account; first identify dependencies and a recovery plan.

Record the decision and execution

Reviewers should attest to keep, reduce, remove, transfer, or investigate. Each decision needs an approver and due date. Execution should produce evidence from the target system, not just a checked spreadsheet. Rotate shared secrets, revoke sessions, and transfer owned assets when relevant. Emergency removals follow the incident or offboarding process immediately; quarterly review is a backstop, not a reason to leave known inappropriate access in place.

Verify and improve

Reconcile approved decisions with actual system state and track overdue removals, orphaned accounts, and repeated privilege creep. Sample whether role definitions match day-to-day tasks. Report exceptions to privacy and security owners without exposing patient information in the review packet. Over time, improve default roles and onboarding so fewer grants require correction. A complete recertification can show who reviewed what, why access remained, and whether the system change actually occurred.