Password Management Policy Checklist for School-Based Mental Health Programs

A password management policy helps protect student and family information, clinical records, and the systems staff rely on to provide care. Use this checklist to define clear responsibilities, reduce unnecessary access, and respond consistently when accounts or credentials may be at risk.

Define Policy Scope and Accountability

Specify which people, systems, and credentials the policy covers. Include employees, clinicians, contractors, interns, volunteers, administrators, and third-party providers who access program devices, email, scheduling tools, electronic health records, or other sensitive systems.

Assign responsibility for maintaining the policy, approving access, and responding to suspected credential exposure. Coordinate these duties among program leadership, human resources, IT or security staff, and system owners. Clarify how the policy works alongside applicable organizational privacy, security, and incident-response procedures.

Document how identity and access management decisions are made, including who may approve access and how access is matched to job duties. For vendors and partner organizations, define third-party account governance: name an internal owner, limit access to approved services and data, and review the account when the relationship or service changes.

Assign Unique User Accounts

Give each staff member a separate account for every system they use. Individual accounts make it easier to grant role-appropriate access and determine whose account performed an action. Avoid shared staff logins; where a technical or operational need makes a shared or service account necessary, restrict it, assign an accountable owner, and document how its credentials are secured and rotated.

Use role-based access control to assign the permissions needed for a person’s current responsibilities, rather than giving broad access by default. Ensure that privileged administrative accounts are separate from routine accounts when feasible, and protect them with stronger controls, such as multifactor authentication.

Set a clear account provisioning process: verify the person’s identity, obtain required approval, provide only authorized access, and securely deliver initial credentials. Require the user to replace temporary credentials at first sign-in. Track account ownership, system access, and approval so accounts can be reviewed and changed when needed.

Set Password Strength and Storage Requirements

Require long, unique passwords or passphrases for each account. Block passwords that are common, predictable, or known to have been compromised. Avoid rules that encourage predictable substitutions, such as requiring a specific mix of character types when users respond by making only minimal changes.

Encourage use of an organization-approved password manager to create and store distinct credentials. Protect the password manager itself with a strong master passphrase and multifactor authentication where available. Do not allow passwords to be shared through email, chat, unsecured documents, or other channels that expose them to unauthorized people.

Systems that store passwords must protect them using appropriately secure salted password hashing—not plaintext or reversible storage. Remediate vendor-supplied and other default credentials before a system is used; replace default usernames where feasible, and disable accounts that are not needed.

Establish Password Change Procedures

Do not require routine password changes on an arbitrary schedule when there is no sign of compromise. Instead, require a prompt change when a password is exposed, suspected of being exposed, reused on a breached service, or otherwise at risk. Staff should report suspected exposure immediately, even if they have already changed the password.

Provide a secure, clearly communicated reset process that verifies the requester’s identity and avoids sending passwords in plain text. Instruct staff to use a new, unique password after a reset and to update it anywhere it may have been reused. When a password manager’s master credential may be compromised, follow the organization’s incident-response process to secure the vault and affected accounts.

For systems that cannot support individual credentials, establish documented procedures for limiting who can access shared or service credentials, securely handing them off, and changing them when access changes or compromise is suspected. Keep a record of the responsible account owner and the actions taken.

Protect Devices and Applications

Require staff to lock screens when devices are unattended and use approved device protections, such as encryption and automatic locking. Protect access to work applications on both organization-managed and approved personal devices. Staff should not save passwords on shared or public devices, and should sign out when using a device they do not control.

Enable multifactor authentication for sensitive systems when available, especially email, remote access, administrative tools, and systems containing clinical or student information. Keep operating systems and applications updated, and use organization-approved security controls. If a device is lost, stolen, or suspected of compromise, staff should notify the designated contact promptly so accounts and sessions can be secured.

Review application settings that affect authentication, including account recovery, saved credentials, session timeouts, and failed-login protections. Apply default credential remediation before deployment and disable unused accounts or authentication methods that create avoidable risk.

Manage Account Access Throughout the User Lifecycle

Connect account changes to hiring, onboarding, transfers, leave, contract changes, and separation. When a staff member changes roles, review their existing access and promptly remove permissions they no longer need before granting new ones. Do not assume that a job-title change automatically updates access in every application.

When employment or another work arrangement ends, promptly disable accounts and revoke sessions, tokens, keys, badges, and other access methods as appropriate. Recover organization-owned devices and access-control items, and update shared or service credentials if the person had access to them. Coordinate timing with the responsible program, HR, and IT contacts.

Maintain an inventory of accounts and their owners, including accounts for contractors and vendors. Review third-party access when a contract, service, or assigned role changes, and remove it when it is no longer required. This access deprovisioning process should include cloud services and other systems that may not be managed through a central login.

Review and Enforce the Policy

Train staff when they receive accounts and periodically afterward. Make the reporting path for suspected password exposure easy to find, and explain that prompt reporting is more important than trying to investigate an incident independently. Apply the policy consistently and document exceptions, approvals, and corrective actions.

Check that accounts have an owner, access matches current job duties, default credentials have been replaced, and separated users no longer have access. Use these checks to identify inactive, shared, orphaned, or unnecessarily privileged accounts. Review relevant account activity in line with the organization’s security procedures.

Perform a periodic policy review and whenever systems, staffing practices, or identified risks change. Record the review date, responsible approvers, and any revisions. A clear policy—supported by training, account oversight, and timely access changes—helps protect sensitive information while enabling staff to deliver services.

FAQs

Should every staff member have a unique account?

Yes. A unique account helps ensure access is assigned to the right person and makes it easier to review account activity. If a shared or service account is necessary, document its owner, restrict its use, and secure its credentials.

How should staff protect passwords from disclosure?

Use a distinct password for each account and store it in an organization-approved password manager. Do not share passwords through email, chat, or unsecured files. Protect devices, use multifactor authentication where available, and report suspected exposure promptly.

When should default passwords be changed?

Change or disable default credentials before putting a device, application, or account into service. Replace default usernames where feasible, and confirm that unused default accounts are disabled.

What account procedures should apply when staff roles change or end?

When a role changes, review access and remove permissions that are no longer needed. When employment or another work arrangement ends, promptly disable accounts and revoke related sessions and access methods. Include vendor and shared-account access in the review, and change shared credentials when needed.