A Forgotten Admin Login, 4,000 Records

A dental practice's patient database had three administrator-level logins, and the office manager who used the system every day had no idea one of them existed. The account belonged to a scheduling company the practice had stopped working with years earlier, and it was still live, still privileged, and still pointed at 4,000 patient records.

The discovery came during a routine look at the practice's systems by Chris Kirksey, founder and CEO of Direction, a digital marketing and SEO company that works in the healthcare industry and also performs security audits for clients. What he found was not a sophisticated intrusion but a piece of administrative debris that nobody had bothered to sweep up.

A login nobody remembered

Kirksey was reviewing the dental practice's environment when he noticed three accounts holding admin access to the patient database. One of them traced back to a scheduling vendor the dentists had stopped using in 2021.

The account had been active for at least three years, according to the account of the incident. During that time it retained the ability to reach protected health information for thousands of patients.

The office manager responsible for operating the system did not know the login was there. A contractor had created it, never mentioned it to anyone, and then left the company. Because no one knew the account existed, no one knew to disable it.

Why stale access lingers

Access that outlives its purpose is easy to create and easy to overlook. A vendor is brought in, an account is provisioned so the work can proceed, and the relationship eventually ends. The account does not necessarily end with it.

In this case the scheduling company was no longer engaged, but the credential it had been given remained valid and privileged. The gap between the end of the business relationship and the end of the technical access stretched for years.

The exposure carried potential HIPAA compliance risk, particularly because someone no longer authorized to view the data could still reach it. The problem was not that an outsider had broken in. It was that a door everyone had forgotten about had never been locked.

Cleaning up the accounts

Kirksey moved to remove all three admin accounts he found on the practice's system. He then put new policies in place for the client so the same situation would not recur.

“I built a permanent rule after that,” he said. “Every vendor relationship that ends now triggers an automatic access shutdown and the full list gets reviewed twice a year no matter what.”

— Chris Kirksey, founder and CEO of Direction

The rule addresses both halves of the problem: the moment access should be revoked, and the periodic check that catches whatever the first mechanism misses. A shutdown tied to the end of a vendor relationship closes the obvious window. A twice-yearly review of the full list provides a backstop for accounts that were never tied to a formal relationship in the first place.

The pattern repeats elsewhere

The dental practice was not an isolated case. Since the incident, Kirksey has found similar security holes at six other healthcare practices he has worked with.

That figure matters because it suggests the problem is not a single contractor's lapse but a recurring gap in how small healthcare operations track who can see patient data. Each instance involved access that had survived past its reason to exist, and each was found by someone looking specifically for it rather than through an alert.

Healthcare settings tend to accumulate these accounts because clinical and administrative work is frequently handed to outside vendors — scheduling, billing, records, marketing — and each engagement can bring its own login. When the engagement ends, the login may not.

The accounts nobody audits

Kirksey's assessment of why these gaps persist is blunt. Attention tends to go to the more visible failures, the ones that make for a clear cautionary tale, while the invisible ones sit untouched.

“Everyone worries about the sticky note with a password on it or the file just called passwords.xls, because those get caught fast and make a good story,” he told us. “Nobody worries about the login they forgot even exists, and that is usually the one still wide open years later, causing real, unseen damage.”

— Chris Kirksey, founder and CEO of Direction

A password on a sticky note is discoverable by anyone who walks past the desk. A dormant admin account is discoverable only by someone who goes looking through the access list. The failure modes differ in how long they can persist undetected, and the dormant account has the advantage of leaving no physical trace.

What an access review has to cover

The practical lesson from the dental practice case is that knowing which accounts exist is a prerequisite for controlling them. An account with no owner and no current purpose is still an account with whatever privileges it was granted.

Reviewing access means checking not only the accounts a departing employee or contractor used, but also the accounts they created while doing the job. A contractor who sets up a login for a vendor relationship may be the only person who ever knew it was there, and when that contractor leaves, the knowledge leaves with them.

Regular audits matter even when nothing appears to be wrong. The dental practice's office manager had no reason to suspect a problem, which is precisely why the account survived for years.

• The dormant account had been active for at least three years.
• It could reach 4,000 patient records.
• The vendor relationship behind it ended in 2021.
• Kirksey found similar holes at six other healthcare practices.

Where the risk actually sits

The incident touches a category of exposure that compliance frameworks care about but that ordinary operations tend to miss. Protected health information that remains reachable by an unauthorized party is a problem regardless of whether anyone has actually accessed it.

Leaving an unnecessary account with access to protected health information created a potential HIPAA compliance risk, particularly if someone no longer authorized to view the data could still get to it. The account was not merely idle; it was a live credential with privileged reach into patient records.

The removal of all three admin accounts closed the immediate hole. The policies Kirksey implemented afterward were aimed at the process that allowed the hole to open and stay open.

What this means for smaller practices

For dental offices, clinics, and other small healthcare operations, the lesson is less about sophisticated threats than about administrative housekeeping. The systems holding patient data are often managed by a small number of people, and vendor relationships come and go without a formal offboarding step for access.

This suggests that the accounts most likely to be overlooked are the ones created for a specific project or vendor and then forgotten once that work ended. An access review that only asks “who works here now?” will miss them. An access review that asks “what logins exist, and why?” is more likely to catch them.

The dentist's office did not learn about the account through an alert or an incident. It learned because someone auditing the system asked a question nobody had asked in years. For readers running similar environments, the takeaway is that the answer to that question can sit unchanged for a long time, and that the only way to find it is to look.

Reporting based on original coverage from The Register.