Dental contractor created hidden admin account accessing 4,000 patient files before quitting

While reviewing the IT systems of a dental practice, security consultant Chris Kirksey discovered three administrative accounts on the patient database, including one tied to a scheduling contractor that had stopped working with the practice in 2021. The concealed account remained active for a minimum of three years, exposing the personal health information of roughly 4,000 patients. The contractor who established the login never informed the practice and left the organization, so the office manager never knew the account existed.

Recognizing the HIPAA compliance danger, Kirksey promptly disabled all three admin accounts and introduced a rule that any terminated vendor relationship triggers immediate access termination, with a full access list audited twice yearly. Since that incident, he has identified comparable security gaps at six additional healthcare providers, underscoring how forgotten "zombie" accounts can persist unnoticed for years.