July 1 in teaching hospitals: thousands of joiners, movers and leavers in one week

The week

Every summer, US teaching hospitals turn over a large part of their medical workforce in the space of a few days. Thousands of newly minted doctors arrive for their first jobs. Others step up a rung. Still others pack up and leave. The patients in the beds do not change, and neither does the need to care for them.

The last days of June and the first days of July are when the US graduate medical education year turns over. Graduate medical education is the formal name for residency, the years of supervised hospital training that follow medical school. New interns, matched through the National Resident Matching Program in March, attend orientation in late June and begin clinical duties around July 1. The Match is the national system that pairs graduating medical students with residency programs, and the NRMP described the 2026 Main Residency Match as its largest ever, filling 41,482 of 44,344 positions offered.

At the same time, senior residents graduate and leave for fellowships, practice or other institutions. Residents who stay move up a year, change rotations or start fellowships in the same hospital. So a teaching hospital is welcoming new doctors, changing the roles of familiar ones and saying goodbye to others, all in the same week.

In the week of June 29, 2026, teaching hospitals were in the middle of it. No single news event marked the week. Its significance is that this scheduled surge tests a teaching hospital’s identity, access and credentialing processes harder than anything else in its calendar, while patient care continues at full volume.

“Identity and access” sounds dry, but it is the hospital’s answer to three everyday questions: who a person is, what they are allowed to see and do, and when that should change. For a new intern, the answers decide whether they can open a patient’s chart, order a test or send a prescription on their first morning. For a departing graduate, they decide whether their login still opens patient records weeks after they have gone.

Most of the year, hospitals handle these questions one person at a time. In this one week, they must handle them for an entire cohort at once, under time pressure, with patients waiting. July is worth understanding even for a leader who never touches a computer system.

Graduate medical education offices plan the changeover as a clinical and educational event, and they plan it well. On the technology side it is often handled as a pile of tickets: accounts, badges, EHR training, phones. That framing hides how much is happening at once.

Within a few days a hospital adds a large cohort of new prescribers, changes the roles of many existing ones and removes those who are leaving. The work separates into four parts that do not overlap, each with a different failure: joiners, movers, leavers, and the supervision record that ties trainees to the physicians responsible for them. Security professionals call the first three “joiners, movers and leavers,” and the phrase is a useful one for any leader to borrow.

The systems behind a doctor’s first day

Several pieces of technology have to line up before a new resident can safely treat a patient. Six terms come up repeatedly.

• The EHR, or electronic health record, is the hospital’s central clinical system. It holds patients’ charts, test results, medication lists and notes, and it is where doctors place orders. Access to it is controlled by roles: an intern on internal medicine sees and does different things from a cardiology fellow or a pharmacist.
• Identity proofing is the process of confirming that a person is who they claim to be, usually by checking a government ID, before giving them credentials. It is the digital equivalent of a bank checking your passport before opening an account.
• Two-factor authentication means logging in with two different kinds of proof, typically something you know, such as a password, and something you have, such as a phone app or a small hardware key.
• Phishing-resistant authenticators are a stronger form of that second factor. Phishing is the use of fake emails or websites to trick people into revealing their login details. A phishing-resistant authenticator, such as a hardware security key, is designed so that it will not work on a fake site, even if the user is fooled.
• Mobile device management, or MDM, is software that lets the hospital apply security settings to phones that hold hospital data, and remove that data if the phone is lost or its owner leaves.
• Identity governance is the system, and the discipline, of keeping track of who has which accounts and permissions, and making sure they change when a person’s job changes.

Prescribing adds another layer. Prescribers also need credentials that satisfy DEA rules for electronic prescribing of controlled substances. Controlled substances are medicines with potential for misuse, such as opioid painkillers, and the Drug Enforcement Administration regulates who may prescribe them. Those rules require identity proofing and two-factor authentication before a prescriber can sign controlled substance orders electronically. Many residents prescribe under the hospital’s DEA registration using an internal code, which federal rules permit, and state rules add their own conditions.

How the changeover runs inside a hospital

Take an academic medical center welcoming a new class of interns. The residency programs know who is coming from the Match in March. Human resources processes their hiring paperwork. The medical staff office handles credentialing, the formal verification that a doctor is qualified and permitted to practice in that hospital. IT creates accounts and issues badges. EHR trainers run classes. Each office holds part of the picture, and each works from its own list.

In a good year, these lists agree and the handoffs are smooth. In a typical year, there are gaps. A resident’s start date changes and only one office hears about it. A fellow’s new specialty is recorded in the residency management system, the software programs use to track their trainees, but not in the EHR. A graduate’s departure is known to the residency program but not to IT. Every gap becomes either a doctor who cannot work or an account that should not exist.

The gaps reflect structure rather than carelessness. Three offices, the graduate medical education office, the medical staff office and IT, hold the status data, and their systems often do not talk to each other automatically. When the volume is low, people bridge the gaps with emails and phone calls. In the first week of July, the volume overwhelms that informal bridge.

Joiners: access on day one, and not before

New residents need EHR access with the right role, secure messaging, remote access and badge access, along with the prescribing credentials described above.

The usual failure is timing. Identity proofing and authenticator enrollment cannot be done for hundreds of people on the first morning without a queue that delays patient care. The result is a line of new doctors outside an IT office at 7 a.m., each waiting to show an ID and set up a security key, while their teams wait for them on the wards.

Hospitals that avoid it move the steps earlier. They complete remote identity proofing in the weeks before arrival, issue phishing-resistant authenticators during orientation and verify that each account works before the first shift. Personal phones, which residents will use for secure messaging and authentication apps, are enrolled in mobile device management at the same session.

The counterweight is dormancy. Accounts created in May for a July start sit open and unused for weeks, which is attractive to attackers. Nobody notices when an account that no one is using is suddenly used by someone else. Provisioning accounts early but activating them close to the start date resolves the tension. A useful measure is the share of new residents with working EHR and prescribing access at the start of their first shift.

A better timeline at the same medical center might run like this. In May, incoming interns receive an email inviting them to verify their identity remotely, by photographing an ID and taking a selfie that a service matches against it. Accounts are built in the EHR with the correct role but left switched off. At orientation in late June, each intern collects a hardware security key, enrolls it with help on hand, sets up the secure messaging app on their phone and logs in once under supervision to prove it works. The accounts go live a day or two before the first shift. On July 1, there is no queue at the IT office, and the interns are on the wards where they belong.

What separates the two versions of that first week is sequencing, not money or new technology: deciding which steps can happen early, and which should wait.

Movers: changing roles without accumulating access

Residents who move from intern to second year, change services or begin a fellowship need different access. In many hospitals new permissions are added and old ones are rarely removed, so senior trainees accumulate access well beyond their current role. Security teams call this “privilege creep,” and it is one of the most common findings in any access review.

It matters for two reasons. It widens the records any single compromised account can reach. If an attacker steals a senior resident’s login, they inherit every permission that resident has collected over the years. It also weakens privacy monitoring, because inappropriate access is harder to spot when many users can see everything. Hospitals watch for staff looking at records they have no reason to see, such as a celebrity’s chart or a neighbor’s. That monitoring depends on access matching the job.

The structural fix is to drive EHR roles from the residency management system. A change in program year, rotation or fellowship status then changes roles automatically, removing as well as adding. Access to record categories with extra legal protection, such as substance use disorder treatment records, needs particular care at each change. Where that integration does not exist, a reconciliation each July between the program rosters and actual EHR roles is a reasonable interim control. The measure is the number of trainees whose roles do not match their current assignment.

Consider a resident who spent her intern year on internal medicine, rotated through the emergency department and psychiatry in her second year and has now started a cardiology fellowship. In a hospital that only adds access, her account carries permissions from every stop along the way, including access to sensitive psychiatric records she no longer has any reason to open. She has done nothing wrong. But if her password were stolen, the attacker would inherit all of it, and if she were to look at a record out of curiosity, the monitoring team would struggle to tell whether it was part of her job. Matching access to her current assignment protects her as much as it protects patients.

Leavers: graduates who still have accounts

Graduating residents leave in late June, but their situations differ. Some move to another hospital. Some stay as attending physicians, the fully qualified senior doctors who supervise residents, which means their account should change rather than close. Some leave medicine. Their EHR accounts, remote access, secure messaging, prescribing credentials and enrolled devices should change on the day their status changes.

Delays are common because departure dates vary and three offices hold the data: graduate medical education, the medical staff office and IT. When those systems do not share a status feed, accounts stay active after the person has gone. Corporate data stays on personal phones too. A departure feed from the residency management system to identity governance, with a follow-up review a few weeks after graduation, closes most of the gap. The measure is how many departed trainees still have active access after a fixed number of days.

One legitimate exception needs a rule of its own. Graduates often have charts left to complete after they leave. Rather than leaving full accounts open, hospitals can grant time-limited access restricted to their own incomplete documentation, with an expiry date set at departure. That keeps the record complete without turning an exception into a standing account.

The phone deserves its own mention. Residents use personal phones for secure messaging, authentication apps and sometimes clinical reference tools. When a graduate leaves, the hospital needs to remove its data and apps from that phone, which is exactly what mobile device management makes possible. Without it, months of clinical messages about patients may simply travel with the graduate to their next job.

The supervision record

The fourth part is the least visible. Supervision of residents is documented in the EHR through attestations, co-signatures and teaching physician notes. An attestation is a statement by the supervising physician confirming their involvement in a patient’s care; a co-signature is their sign-off on a resident’s note. Those records matter for patient safety, accreditation and Medicare billing rules for teaching physicians. When residents and attending physicians change at the same time, the rules that route notes for co-signature must change with them.

Errors here do not show up as access problems in July. They show up in August as unsigned notes, billing holds and documentation queries. A note routed to a supervisor who has left simply sits in a queue nobody is watching. Updating routing tables alongside role changes, and reviewing the unsigned-note queue by service in the first weeks of July, catches most of them. The measure is the volume of supervision documentation still unsigned after the hospital’s own deadline.

A small example shows how this unfolds. On July 1, a new intern on a general surgery service writes admission notes that the EHR automatically routes to the attending physician listed for that team. But the routing table still names last year’s attending, who has moved to a different hospital. The notes sit in an inbox that no one opens. Nobody notices for weeks, because the patient care itself went well; the gap is only in the paperwork. In August, the billing office flags dozens of encounters it cannot submit, and someone has to reconstruct who actually supervised what. Updating the routing table on the same day as the role changes would have prevented all of it.

What a rough July costs the hospital

For a chief executive, chief medical officer or board member, the changeover touches nearly every risk they worry about.

• Patient safety. A new doctor who cannot access the chart or prescribe on day one either delays care or finds a workaround, such as using someone else’s login, which undermines every safeguard the hospital has built.
• Security. Dormant accounts, accumulated permissions and leftover access for departed staff are exactly the openings attackers look for. Healthcare is a frequent target for ransomware, and stolen logins are a common way in.
• Privacy and regulators. Inappropriate access to patient records, especially records with extra legal protection, can bring regulatory scrutiny and damage patient trust.
• Revenue. Unsigned supervision notes and billing holds delay payment for care already delivered.
• Staff experience. A chaotic first week is many residents’ first impression of the institution. A smooth one tells them the hospital is well run.

One plan, one lead, four measures

Each part has a different owner, which is why a hospital should give the changeover one plan, one accountable lead and four measures reviewed together: day-one access for joiners, role mismatches for movers, departed trainees still active for leavers and unsigned supervision documentation. The same discipline improves onboarding for every other clinical group hired during the year.

The failures are easy to recognize.

• Treating it as a ticket queue. Hundreds of separate requests hide the shape of the event and the links between its parts.
• Doing everything on day one. Identity checks and security key enrollment pile up into a queue that delays patient care.
• Only ever adding access. Movers collect permissions year after year.
• Relying on email between offices. Without an automatic status feed, departures slip through.
• Forgetting the supervision record. Problems surface weeks later in billing, when they are harder to trace.

The numbers to ask for this autumn

• What share of our new residents could open the chart and prescribe at the start of their first shift this year?
• When a resident moves up a year or starts a fellowship, does their old access get removed automatically, or only new access added?
• How many trainees who left in June still had active accounts a month later?
• How large was our unsigned supervision note queue in August, and who owns it?
• Who is the single accountable lead for the changeover, and do they see all four measures together?

With hindsight

Three months on, the July changeover is behind teaching hospitals and the next one is nine months away, which makes autumn the right time to review it. Memories are still fresh, the data from July and August is available, and there is time to change systems and calendars before the next class arrives.

Little about the problems described here is specific to 2026. They follow from the structure of the event: a fixed date, a large cohort and three offices holding the status data. That is the case for running the changeover as a standing program with its own measures, rather than as a scramble that starts again each spring.

The NRMP’s figures show the Match grew again in 2026, so the volume pressure is not easing. Each year, the same offices must handle a cohort at least as large as the last, with the same date and the same patients to care for.

There is real progress on one side. Remote identity proofing and phishing-resistant authenticators make the joiner side easier where hospitals have adopted them, moving the slowest steps out of the first morning and making stolen passwords less useful to attackers.

The mover and leaver sides are harder. They still depend on status data flowing reliably between graduate medical education, the medical staff office and IT. That is an integration and governance problem rather than a technology purchase, and it tends to get less attention because its failures are silent: an account that should have been closed, a permission that should have been removed. Nobody notices until something goes wrong.

A review this autumn against the four measures gives the 2027 plan a baseline, and shows which fixes need system integration and which need only a better calendar. The practical step is to ask for the four numbers now, set a target for next July and make one person accountable for hitting it.