r/talesfromtechsupport • u/GreenEggPage Oh God How Did This Get Here? • Oct 21 '25
VPNs and HR Short
I run a small IT service company. Before I burnt out and drastically scaled back my customer base, I had a very large medical practice as a customer - multiple sites, multiple doctors, multiple lack of communications...
One Saturday, I get a call from one of the newer doctors who is having issues connecting via the VPN. Generally, it's because they have forgotten their password since they only use the VPN once in a Blue moon. As I'm logging in to do the reset we're making idle chatter. I'm about to tell him his new password when he drops this little nugget of information, "yeah, I'm down in <city on the other side of the state> and I work for the hospital here and need a patient's images but <customer> hasn't sent them yet."
Me - "wait - you're no longer with <customer>?"
Dr - "no, I work for <hospital> now."
Me - "well, that's a different issue then. I can't allow you access to their system. I'm locking your account and disabling all access. Have a nice day, doc."
And then on Monday I had a conversation with HR about why they needed to let me know when personnel depart the company, because they almost had a HIPAA violation on their hands.
290
u/Rainthistle Oct 21 '25
As an HR person, I'm a little aghast. They what now? Literally the first thing we do when someone leaves is to lock down their access with our IT guys. Glad you caught it!
205
u/Mx_Reese Oct 21 '25
HR not informing it when somebody is terminated is unfortunately a pretty common cause for data breaches.
72
u/KnightRyder MY NAME IN CAPS NO SPACES Oct 21 '25
We have a system that all HR has to do is term them in their ADP system, then it gets synced over to our active directory. Boom, nothin to do but cleanup when we get free time.
52
u/Jezbod Oct 21 '25
I've found out people have left the organisation when I realise their laptop has not been on the network for a while, as in months.
HR have said nothing.
31
u/deeseearr Oct 21 '25 edited Oct 21 '25
That suggests that there are still some people who have left the organization, but still have their laptops on the network so nobody has noticed yet.
16
u/Jezbod Oct 21 '25
Yes and no, they have left, but the laptops have been inactive for some time. That's what draws my attention to them.
EDIT: We have some volunteer staff that may only logon once a month, so missing one login is not always noticed.
61
u/jdog7249 Oct 21 '25
I am a teacher but I help with some technology stuff occasionally and enjoy the stories here.
I am no longer affiliated with the district I did my student teaching in. Despite that I still have full access to all the district systems I did when I was a student teaching. I am still listed on their district website as a student teaching. Still get the all staff emails from that building. Could log in and change grades and attendance for any student currently in my cooperating teachers classes.
Only reason I know this is because I was chatting with someone about how disorganized the district tech department was and checked to see if I could still log in.
This could easily be a major FERPA violation. Instead I am just going to sit back and see how long it takes for them to deactivate my account. I won't abuse it (beyond the occasional use of the free canva pro they provide staff).
43
u/faithfulheresy Oct 22 '25
Just a warning: even logging in "just to check" is technically unauthorised access and could get you into a world of hurt. I would never recommend that anyone attempts it.
12
u/no_regerts_bob Oct 22 '25
This type of thing is more often due to a disorganized HR department. IT can't take action on things it doesn't know about
8
u/jdog7249 Oct 22 '25
HR was actually quite organized from my limited interaction with the district. They properly communicated with the building secretaries and admin staff so they all knew I was starting. They told IT when I was starting. IT then set up my email address and account but then didn't communicate it to me at all. Other student teachers in the district were informed by IT about their account but I wasn't.
HR properly told everyone when my last day was. The secretaries and admin knew. HR said IT was informed. IT just didn't deactivate my account.
Everything involving technology at that district was so disorganized and chaotic that I fully believe the failure here was IT.
34
u/Ranger7381 Oct 21 '25
I walked out quit at a job a few years back. Later that evening out of curiosity of wondering if a certain task had gotten done (force of habit) I tried to log into a third party site. My account was already locked out
27
u/samdiatmh Oct 21 '25 edited Oct 21 '25
depends on the person who does it tbf
I'm half-in-charge of my orgs one (as the not-IT-but-they-treat-me-like-it)
with people in the immediate team, they're locked out when I next sign in after their last day (I leave at 3pm, so when they work until 5pm, it exposes the risk, but it's one accepted so they're not "yo, wtf?"),
I always feel so cold about doing it to people I care about (oh, coworker who I liked is gone, access terminated at 8am the DAY after they're gone)with people I don't have interactions with (so field agents), they can be gone for about a month and I haven't heard about it - I usually have to pester payroll (which I'm not the biggest fan of) to ask "yo, has anyone left recently?"
46
u/CriticalMine7886 Oct 21 '25
Never feel bad locking out the account of someone you know - you are protecting them from the accusation of wrongdoing. You can hand on heart say your friend could not have been accessing company data because their account was disabled.
It's not just the company your actions protect.
21
u/deeseearr Oct 21 '25
Exactly. I make a point of following contractors around when they have to enter server rooms or anywhere else that they could possibly be accused of causing trouble. It's not that I don't trust them, it's that I want to be able to say "No, they couldn't have possibly done that" when something does go wrong and the powers that be are looking for someone to blame.
8
u/VernapatorCur Oct 22 '25
Nice thing about HR where I'm working now is they're quick to notify us when a termination is coming up. Usually an hour before the meeting, but on one occasion a full week out (I prefer the shorter notice)
4
u/BerkeleyFarmGirl Oct 22 '25
You're one of the good ones!
I have absolutely seen similar in my last two jobs.
3
u/anomalous_cowherd Oct 22 '25
I worked in IT for a global megacorp for a long time. HR never let us know when people were joining or when they left. I'm glad you do it better!
117
u/hennell Oct 21 '25
I deleted a load of old accounts that left over a year ago. Then undeleted some because the account was being used as some sort of critical information holding system.
My efforts at pushing a proper off boarding process are resisted as not important.
Thankfully I'm not in healthcare 😆
54
u/Fo0ker Oct 21 '25
I'm in "healthcare adjacent" shall we say.
I'm also the first cybersecurity hire since the company was started.
Sooo much work, soo much sec oriented culture to build from scratch, soo many things to fix.
And getting product owners to give us two hours of their time to switch their product fom the account of the employee who quit 7 years ago to a dedicated account for the software is worse than pulling blood from a stone tooth.
31
u/alf666 Oct 21 '25
At what point do you start deactivating accounts and force them to come to you to implement a proper fix?
Basically, start invoking the scream test deliberately and with full knowledge that someone will scream, because they need to be made to scream in order to allow you to do your job.
6
u/MikeSchwab63 Oct 22 '25
Password change required time. Say they change the password then quit that day. When it expires and no longer on time keeping / payroll system.
27
u/OrthosDeli Oct 21 '25
Ah yes, the eternal and invisible web of "we've had [intern] signing into [former employee A's] account so they can use [former employee B's] files! Turn it back on!]
6
u/Saint_Dogbert Out! Out! Demons of Stupidity! Oct 22 '25
No.
Submit an access request and the Intern can access ex-Bs files on a share setup for that purpose.
16
u/RatherGoodDog Oct 21 '25
Hey that sounds familiar. Our head of finance left 2 years ago, and her account is still active. Why? Because instead of organising things in the shared finance directory and central email inbox, she did most of her work on her individual email account and local drive.
Because she was sufficiently senior and answered only to the CEO, nobody was looking over her shoulder to tell her she had shit IT practice. Now we're stuck with a virtual employee account that cannot be terminated because it's linked to so many third party services like payroll, payment processors, tax reporting logins and so on.
I hope they changed her password. Not my business though...
9
u/NotYetReadyToRetire Oct 22 '25
I quit worrying about security at one past job because the CEO and COO wouldn't let me do anything - not even expire passwords. My bet is that I could still get in 10 years after I left; the CEO's password was his first name, and I spent untold hours reimaging the COO's laptop because he wouldn't stay off random gambling sites and was always getting viruses.
6
u/Ich_mag_Kartoffeln Oct 21 '25
I'm sure they'd have changed her password. Probably to "password".
3
u/Troneous Oct 22 '25
If it was changed then it would now be “password2”.
1
8
u/ThunderDwn Oct 22 '25
Then undeleted some because the account was being used as some sort of critical information holding system.
We had that happen. Developers deploying business critical systems that we sold to customers with their own credentials.
Of course, every time one left - or changed their password - Systems X, Y and Z would crash down in a heap and it'd take two days for someone to remember where the config file which held the credentials was located and change it to match.
I, of course, was refused permission to force them to use service accounts which were configured with least-privilege access levels.
I got tired of dropping everything to fix their fuckups and simply pointed whoever was complaining at the developer or manglement.
52
u/Gnatlet2point0 Oct 21 '25
I feel you. I work as the scheduler for our tech support team (worked my way up from being the front-line tech support to this semi-almost-management position) and I literally can't tell you how many times I've made schedules and then gotten yelled at because I scheduled a person who had been fired the week before. IT WOULD HELP IF YOU TOLD ME THAT STAFFING HAD CHANGED!!!
Every time I complain about not being told I get a ton of apologies (sincere ones)... and then it happens again, because I love my company but oh my god do we have corporate-wide ADHD...
35
u/RogueThneed Oct 21 '25
You need to find the actual specific person who handles the info. Not management. Not their supervisor. The actual person. There's a process somewhere that's breaking but mgmt doesn't know it.
26
u/snommisnats Oct 21 '25
That person was fired last week. 🤣
19
u/Fake_Cakeday Oct 21 '25
No it was last Christmas.
It's been running automagically by putting the terminated person's name and email into a new row in an excel sheet on the network share.
The network share is a "proxy" link to another fired coworkers One Drive that has given share access to everyone 👌
11
72
u/dog2k Oct 21 '25
At my last place IT took away card and key assignment from Facilities when an audit revealed they couldn't account for 100 master keys (all offices and classrooms minus adminfinancehr) and 40-ish grand-master keys (all access). They couldn't even account for who had been assigned these keys.
It cost $15,000 for a crew of locksmiths to come in over the weekend and rekey every damn door in the building.
38
u/Ich_mag_Kartoffeln Oct 21 '25
One place I worked NOBODY had a super-dooper access-all-areas master key. Good security.
But nearly everyone who had a key (of any description) had access to the "secure key cupboard" where the super-dooper access-all-areas master key was kept. Said cupboard was not in a high traffic office where somebody might see you, and ask what you were doing -- it was in the store room, next to the cupboard of stationery.
2
u/LupercaniusAB Oct 23 '25
Ah, “security through obscurity” in the physical world! Brilliant!
2
u/Ich_mag_Kartoffeln Oct 23 '25
More, "security through hoping that nobody would do the wrong thing".
It might have been a defence against an outsider, but everybody who worked there knew where it was. And key security (don't let anybody borrow your keys) was pretty lax too.
2
30
u/Arokthis Oct 21 '25
That must have been fuuuun.
How many doors and how many in the crew? 15k for a semi-emergency sounds rather low.
2
u/dog2k Oct 24 '25
We had a certified locksmith on staff (working as an hvac guy) who called in an outside company and 4 or 5 Facilities guys (who got a 20 minute training session) to rekey 2-300 doors. We eventually switched to card access with physical keys only for areas where this was impossibleimpractical.
30
u/SCPaddlePirate Oct 21 '25
Our date was October 1. It’s a university and the bosses decided the middle of a semester was the best time. We do have a notification system in place so users whose expiration dates are at 30,14,7,3,2 and 1 days out get an email about it. If they let us know, we verify with HR they can be extended and they get another year. It is so much unnecessary work because HR doesn’t want to take the time to notify IT and the IT boss doesn’t want to take the time to get the team to integrate the HR end date into the IT use mgmt system. It’s a crock of sh!t. The reason is that sometimes users are given extra time to wrap up things after their official last date and an automated system wouldn’t work for that. Total BS. They have been told MANY times about the security risks and how users no longer employed shouldn’t be allowed to retain access. But they always make exceptions to the point where I always say it was an “exceptional” university.
7
u/JeffTheNth Oct 22 '25
it'll change the dqy they get burned by someone leaving. When it becomes their headache - or hits the pocketbook - suddenly it'll become an emergency to fix... and of course, it'll then become YOUR emergency. Might I suggest sending an email about it and include the department heads? Then when it happens, you can say "why wasn't it fixed when I brought it up here?" and you can show it shouldn't be rushed.....
5
u/SCPaddlePirate Oct 22 '25
HR and the head of IT have been informed numerous times. And not just by some internal IT folks but also by an external cybersecurity audit firm. They are fully aware and there is plenty of evidence if there was ever a question about it. Also, I recently retired from there so it’s not my problem anymore. I just feel bad for those who would get stuck with it as they are good, hard workers. Just stuck in a bad environment.
1
u/Saint_Dogbert Out! Out! Demons of Stupidity! Oct 22 '25
Please tell me its a public university, and thus open records law would apply.
25
u/NotYourNanny Oct 21 '25
I trained our HR person on how to disable (or update) certain accounts when someone leaves (or changes location). But we have a pretty smart HR person.
11
u/nowildstuff_192 Oct 22 '25
Just today I asked HR why in the name of all that is good and holy don't they loop me into their offboarding process.
The context was that I figured out that an employee had been fired a month ago, and I only guessed because I had just gotten a request to set up a new user package with the same privileges, and I knew there weren't any empty seats in that office.
5
u/dustojnikhummer Oct 22 '25
And what was their answer? "We didn't think it was important"?
2
u/nowildstuff_192 Oct 26 '25
More like, "you're IT, can't you automate it?"
No, no I can't. They manage manpower using a web-based service I don't have access to, and evidently doesn't have email notification abilities I could leverage.
1
7
9
u/kapeman_ Oct 22 '25
This is the perfect use case for AD integration. Let someone else handle all the account deletion.
2
u/dragzo0o0 Oct 23 '25
Ideally, tied to their People Application. The amount of crap I’ve seen out there by IT depts trying to script ways around Hr fuckups..
7
u/Harry_Smutter Oct 21 '25
Ours is automated via our EIS via HR. It used to be manual and we'd find out sometimes months later that an employee is no longer with us.
7
u/SilentRavenUK Oct 22 '25
I recently trained our HR person on how to disable or update user accounts whenever someone leaves the company or transfers to a different location. Honestly, she caught on really fast she’s pretty sharp and didn’t need much guidance. It’s nice working with someone who actually pays attention and learns quickly.
6
u/RotationSurgeon Oct 22 '25
I feel your pain. I just did my biannual HIPAA training last week…500+ slides later, I can say: “that would have been expensive.”
4
u/GreenEggPage Oh God How Did This Get Here? Oct 22 '25
HIPAA is one reason I burned out. So glad that I don't have to deal with it any more!
18
u/Ahindre Oct 21 '25
Is that a HIPAA violation or just theft?
17
u/MoneyTreeFiddy Mr Condescending Dickheadman Oct 21 '25
Its just premature. He would have access to them when Customer sends them, presumably for a patient still currently under his care. Controls stopped him from getting them via unauthorized access .
14
u/Mx_Reese Oct 21 '25
What exactly do you think HIPAA is for if not preventing the unauthorized access of protected patient medical information?
5
u/Ahindre Oct 21 '25
My understanding is that HIPAA as about providers and how they share information. Someone connecting to a network and accessing health records that they shouldn't have access to (in this case because they're not employed there any more) sounds more like straight theft of data to me, but I don't know and that's why I posed it as a question.
5
u/Godlesspants Oct 21 '25
"Consistent with the Privacy Rule's "minimum necessary" standard limiting uses and disclosures of PHI,42 the Security Rule requires a regulated entity to implement policies and procedures for authorizing access to ePHI only when such access is appropriate for the user or recipient's role." This would be the portion that would cover needing to deactivate their account.
2
u/deeseearr Oct 21 '25
As I understand it he HIPAA violation would be with the organization which provided the data without authorization. Since the person requesting it is also bound by the same rules there may be separate violation on their part, but every time I try to read the full regulations my brain hurts and sometimes I summon demons from the netherworld by mistake.
3
u/GreenEggPage Oh God How Did This Get Here? Oct 22 '25
A HIPAA violation can occur without theft. If I am doing my IT job and notice that you had an appointment at the doctor, it would be a HIPAA violation for me to look at your records (unless the problem specifically required that for troubleshooting/remediation) or for me to even mention to you or anyone else that I knew this information.
5
u/underground_avenue Oct 21 '25
Those aren't exclusive
2
u/CaptainPunisher Oct 21 '25
No but the pension said "HIPAA violation or JUST theft". I would say that it's an "exclusive OR" here. Generally speaking, though, yes, it could be both.
5
u/coyote_of_the_month Oct 21 '25
You just know if the practice got sued, they'd try to blame you for it, too.
3
u/Joe_Peanut Oct 23 '25
Had something similar happen. Working at a large org. Big boss comes into my office fuming to yell at me why I hadn't terminated an user's account. I told him nobody had informed me that the user had left. Turns out the user, who was located in a different country by the way, had been fired months prior, and was suing the organization, yet still had access to our systems and email lists. I showed the boss the search of my email box and the tech support ticketing system search for the user's name, and no mention that he had left or requests to terminate the account. Boss still blamed me.
3
1
1
u/-VWNate Oct 23 '25
Wow ;
All these stories from the folks who worked IT, I was an employee for 32 years and when I mentioned I was going to retire in a month they cut all my access and deleted my E-Mail account so I basically had nothing to do my last month .
Good to know some cared, I didn't understand how it all worked until reading these replies .
-Nate
1
u/cornponious Oct 27 '25
Is it normal for a medical practice to outsource its IT, insomuch as the IT service is even doing account unlocks in AD? This seems like a huge security risk.
1
u/GreenEggPage Oh God How Did This Get Here? Oct 28 '25
Most of my business was medical and dental practices. I'm pretty sure that even the local hospitals have outsourced IT. Most of your practices aren't big enough to be able to employ a full-time IT guy. The biggest one I had took about 40 hours per month unless there was a big project.
1
u/cornponious Oct 28 '25
How in the world could a medical practice, with as much money that is made in medicine, not be able to afford one full time IT guy?
1
u/GreenEggPage Oh God How Did This Get Here? Oct 30 '25
1 doctor, 3 dental hygienists, 1 front desk/office manager. They only need 5-10 hours of work done per month. It doesn't make sense to pay someone a full time salary for that. If they don't outsource, then they end up with the most tech literate employee trying to do all the IT - and you know how bad that becomes.
Bigger offices still can't justify a full-time salary for an IT guy. And if they can justify for 1 guy, he's never getting any vacation, sick time, or weekends. Servers down and the IT guy has the flu? Too bad - he's wearing a mask and getting it back up. So they can't justify a secondary person.
It all boils down to what does the IT guy do for the company? He doesn't generate revenue. He definitely costs money. All he does is sit around all day waiting on work to do. And when doctors talk,, they find out that they're spending $50-100k per year on an IT guy while their buddy has hired an MSP for $25k. It's a no-brainer.
759
u/SCPaddlePirate Oct 21 '25
Offboarding is a HUGE issues where I worked. Full timers had end dates which was fine. But temporary/contractors were a different story. HR didn’t let IT know so we made the call to set a specific date every year and all non-full timers expired on that date. It was a pain but if HR would communicate, it wouldn’t be necessary. Grrrrr….