A Physician’s Guide to Onboarding and Managing Medical Practice Staff

Executive summary · approximately two minutes

Orientation gives information. Onboarding proves readiness.

A signed handbook and training certificate do not establish that a person can perform the job safely or consistently. The practice must connect policies to the worker’s actual duties, provide supervised practice, verify competency, monitor early performance, and close gaps. Management then continues through clear outcomes, regular feedback, resources, accountability, documentation, and fair application of policy.

Decision rule: No employee performs unsupervised work until required records, screening, access, safety, privacy, security, role training, and competency evidence are complete for that work.

Reviewed 2026-07-30
Moderate with privacy, safety, employment, and program-integrity exposure
Annual and upon law, role, workflow, or incident change

What is it?

Onboarding is a controlled transition from candidate to accountable role owner.

Four phases create a usable 90-day path instead of a first-day paperwork event.

Preboarding: The conditional-offer-to-start period used for lawful checks, work authorization, payroll, equipment, access approvals, schedule, and readiness.

Role-based training: Instruction and supervised practice tied to the employee’s actual workflows, systems, risks, boundaries, and escalation duties.

Competency verification: Evidence that the employee can perform defined work to the practice’s standard before independent assignment.

Performance management: Ongoing role clarity, feedback, coaching, resources, measurement, documentation, recognition, correction, and decisions.

Why should I care?

Early ambiguity becomes permanent workarounds.

Access, habits, handoffs, patient communication, documentation, and escalation patterns form quickly. The practice should design them before the employee improvises them.

Before day one

Complete lawful offer conditions, I-9 process, payroll, records, checks, credentials, exclusions, schedule, equipment, access approvals, and manager preparation.

Day one

Set purpose, role outcomes, boundaries, safety, privacy, security, policies, communication, escalation, schedule, and the 90-day plan.

Weeks one to four

Train by workflow with demonstration, supervised practice, observation, correction, and competency evidence.

Days 30 to 60

Transfer defined ownership, review measures, reinforce controls, close gaps, and confirm role fit and workload.

Days 60 to 90

Evaluate independent performance, judgment, reliability, learning, teamwork, and the next development priorities.

Ongoing management

Maintain weekly and monthly rhythms, document feedback, apply policies consistently, review access, recognize performance, and act on gaps.

Show me

Use a 90-day evidence plan for every new employee.

The plan should state what the employee will know, demonstrate, own, and improve at each checkpoint.

Decision area	Evidence to collect	What a defensible answer looks like	Pause or escalate when
Preboarding	Offer conditions, I-9 plan, payroll, screening, credentials, equipment, access approvals	Start readiness is complete or unresolved items are controlled	The person starts because the schedule is full
Day 1	Role outcomes, policies, safety, privacy, security, escalation, training plan	The employee can explain expectations and where to get help	Orientation is a document-signing race
Day 30	Completed modules, observed workflows, competency checks, feedback, early measures	Core work is safe under defined supervision	Certificates exist but performance has not been observed
Day 60	Transferred ownership, workload, quality, service, attendance, access review	The employee owns defined results with declining support	Duties expanded without training or access review
Day 90	Outcome measures, competency, judgment, reliability, gaps, development	Confirm, redesign, support, or separate based on evidence	The decision is delayed because expectations were never written

Important limitation: Training and introductory-period rules vary. Completion of a module does not prove competence, and a 90-day label does not override at-will limits, contracts, discrimination law, leave rights, accommodation duties, or state requirements.

Put me in the chair

A new employee receives broad access because the practice is busy.

On day one, the employee is given shared credentials to the EHR, payer portals, email, files, and banking tools. Training consists of shadowing the departing employee for two days.

Known factsWhat is actually supported

Access modelBroad and shared
TrainingTwo-day shadow
Competency checksNone
Departing employeeAccess still active
Performance planNot written

Decision workWhat must be resolved

Stop and correct access. Use unique accounts, minimum necessary roles, approvals, MFA, logs, and prompt termination of old access.
Rebuild workflow training. Document tasks, boundaries, practice, observation, verification, and escalation before independent work.
Set evidence checkpoints. Define 30/60/90-day outcomes, feedback, support, records, and decision responsibility.

Defensible conclusionThe employee is not ready for independent work.

Urgency does not replace access governance or competency. The practice should immediately correct credentials and access, retain supervision, complete required training and screening, and verify performance before transferring ownership.

What would change the answerIndependent responsibility begins only as each workflow’s access, training, competency, and escalation criteria are demonstrated.

Three-question decision exercise

Can you defend the decision—not merely prefer it?

Choose the strongest answer. Feedback teaches the reasoning; it does not make an individualized legal, tax, employment, payer, privacy, or clinical determination.

Teaching progress0/3 decisions defended

Question 1 of 3

What best proves onboarding is complete for a workflow?

Question 2 of 3

What access should a new employee receive?

Question 3 of 3

What is the strongest 90-day decision?

You defended all three decisions. Carry the same evidence discipline into the written decision record.

Expandable 12-question checklist

Can the practice prove the employee is ready and accountable?

Expand each question and identify the evidence that belongs in the practice’s decision file.

01Are offer conditions and role terms finalized?

Evidence to retain: Signed offer, job description, compensation, schedule, contingencies, policies, and start details.

02Are employment records and tax forms complete?

Evidence to retain: I-9 process, W-4, payroll, state new-hire, required notices, and secure personnel records.

03Are credentials, licenses, and exclusions verified?

Evidence to retain: Primary-source or appropriate verification, LEIE check, payer or role requirements, and renewal tracking.

04Are safety risks and required training identified?

Evidence to retain: Hazard assessment, exposure controls, emergency duties, reporting, and role-specific OSHA requirements.

05Are privacy and security duties role-specific?

Evidence to retain: Minimum necessary, permitted use, incident reporting, phishing, devices, messaging, and sanction expectations.

06Is access unique, approved, and minimum necessary?

Evidence to retain: Access request, role matrix, MFA, logs, periodic review, and termination procedure.

07Are workflows documented enough to teach?

Evidence to retain: Current procedures, system steps, decision boundaries, quality checks, and escalation paths.

08How will competency be demonstrated?

Evidence to retain: Observation, simulation, work sample, audit, return demonstration, or other role-appropriate evidence.

09What must be achieved by days 30, 60, and 90?

Evidence to retain: Written knowledge, skill, ownership, quality, service, reliability, and development outcomes.

10How often will feedback occur?

Evidence to retain: Scheduled check-ins, immediate coaching, employee questions, support commitments, and documentation.

11How are performance gaps handled?

Evidence to retain: Clear expectation, evidence, employee input, resources, timeline, follow-up, consistency, and legal review.

12What happens when duties or employment end?

Evidence to retain: Same-day access change, property return, records, patient or workflow handoff, payroll, benefits, and communication.

Defend the decision

Build one continuous record from offer through performance.

The file should show what the practice promised, what the employee was taught, what was verified, what feedback was provided, and why management decisions were made.

Readiness record

Offer, screening, I-9, payroll, credentials, exclusions, policies, safety, privacy, equipment, and access approvals.

Training and competency

Curriculum, trainer, dates, supervised practice, evidence, gaps, remediation, approval, and recheck triggers.

30/60/90-day plan

Role outcomes, measures, ownership transfer, feedback, employee questions, support, and checkpoint decisions.

Ongoing management file

Regular feedback, recognition, changes, accommodations, leave, coaching, performance, access reviews, and final actions.

Common mistakes and hidden risks

The decision usually fails at the boundaries.

Paperwork equals readiness

Forms and certificates exist, but the employee has not demonstrated the work.

Shared credentials

Accountability, minimum necessary access, monitoring, and prompt termination are undermined.

Shadowing without standard

The new employee inherits workarounds and cannot distinguish preference from requirement.

Access before approval

The employee receives unnecessary clinical, financial, payer, or administrative authority.

No escalation boundary

The employee either acts outside authority or sends every decision back to the physician.

Silent performance gaps

Managers wait for a formal review instead of giving timely specific feedback and support.

Probation myth

An introductory period is treated as removing legal, policy, contract, leave, or discrimination obligations.

Late offboarding

Access, equipment, records, patients, payroll, benefits, and work remain exposed after separation.

The MedCBO perspective

“A new hire becomes safe and productive when expectations, access, training, evidence, and feedback all point in the same direction.”

Small practices cannot afford vague onboarding. A disciplined 90-day path reduces dependence on memory, gives the employee a fair chance to succeed, and lets the physician transfer responsibility with evidence rather than hope.

When a new employee must become dependable quickly

Talk through your practice plans.

If you are building preboarding, access, training, competency, or 90-day management workflows, a MedCBO discovery conversation can help identify operational gaps to review with your HR, privacy, safety, and employment advisors. The discussion is exploratory and focused on alignment.

Schedule a Discovery Call →

Companion resources

Continue the decision with the right supporting tools.

Frequently asked questions

Questions physicians ask about onboarding and managing medical-practice staff.

What should happen before a medical-practice employee’s first day?

Complete applicable offer conditions, work-authorization planning, payroll, lawful checks, credentials, exclusions, schedule, equipment, access approvals, manager preparation, and the 90-day plan.

Is HIPAA training required before access to PHI?

HIPAA training and security-awareness duties depend on the regulated entity, policies, role, and rules. As an operational control, provide role-appropriate privacy and security training and minimum necessary access before independent PHI use.

How do I verify competency?

Use evidence suited to the task—observation, return demonstration, simulation, work sample, audit, supervised practice, or other method—and document the standard, result, approver, and recheck trigger.

Can a new employee use a shared login while accounts are created?

Shared logins weaken accountability and access control. Provision unique approved access before the employee performs system work; use a controlled alternative if the system cannot support appropriate access.

What should a 90-day review include?

Review written outcomes, demonstrated competency, quality, service, reliability, judgment, learning, workload, feedback, support, access, role fit, and next priorities. Follow applicable law and policy.

How quickly should access be removed after separation?

Access should be removed or changed promptly based on the separation timing and risk, coordinated with property, records, patient or workflow handoffs, payroll, benefits, and legal requirements.

Sources and further reading

Evidence used in this guide.

IRS, USCIS, HHS OCR, OSHA, and OIG sources support federal employment records, work authorization, privacy and security, safety-program, and exclusion concepts. Role- and state-specific requirements require separate review.

Internal Revenue Service (accessed July 30, 2026). Hiring employees View authoritative source. Summarizes employer records and forms involving work authorization, Social Security numbers, and withholding.
U.S. Citizenship and Immigration Services (accessed July 30, 2026). Handbook for Employers M-274 View authoritative source. Provides current Form I-9 completion, retention, reverification, and nondiscrimination guidance.
HHS Office for Civil Rights (accessed July 30, 2026). Security Rule Guidance Material View authoritative source. Provides risk-management, access-control, workforce-security, and security-awareness resources.
Occupational Safety and Health Administration (accessed July 30, 2026). Recommended Practices for Safety and Health Programs View authoritative source. Supports management leadership, worker participation, hazard identification, training, and program improvement.
HHS Office of Inspector General (accessed July 30, 2026). Exclusions Program View authoritative source. States that healthcare entities should routinely check new hires and current employees against the LEIE.
Internal Revenue Service (accessed July 30, 2026). Employment tax recordkeeping View authoritative source. Provides current federal employment-tax recordkeeping guidance.

About the author

Christopher D. Poteet, DBA, FACHE

Christopher Poteet is the founder and Chief Executive Officer of MedCBO, a healthcare executive, Fellow of the American College of Healthcare Executives, and adjunct professor teaching graduate business and healthcare studies. His teaching approach connects business concepts to the decisions physicians must make in practice—without assuming prior business education and without speaking down to highly trained professionals.

About the author View Chris on LinkedIn Follow MedCBO on LinkedIn

This guide is for general educational and workforce-planning purposes. It is not legal, employment, immigration, wage-and-hour, tax, benefits, privacy, HIPAA, cybersecurity, OSHA, clinical, scope-of-practice, credentialing, payer, or patient-specific advice. Requirements vary by jurisdiction, employer size, role, duties, risk, service, worker status, plan, payer, program, and facts. Training completion does not itself establish competence or compliance. Obtain current advice from qualified employment counsel, HR, payroll, privacy, security, safety, clinical, credentialing, payer, and other appropriate professionals before granting access, assigning work, evaluating performance, changing duties, disciplining, or separating an employee.