July 1 in teaching hospitals: thousands of joiners, movers and leavers in one week
The annual residency changeover is the largest identity event a US teaching hospital runs. Joiners, movers, leavers and the supervision record each fail differently, and each needs its own control and measure.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
The last days of June and the first days of July are when the US graduate medical education year turns over. New interns, matched through the National Resident Matching Program in March, attend orientation in late June and begin clinical duties around July 1. The NRMP described the 2026 Main Residency Match as its largest ever, filling 41,482 of 44,344 positions offered. Senior residents graduate and leave for fellowships, practice or other institutions. Residents who stay move up a year, change rotations or start fellowships in the same hospital. In the week of June 29, 2026, teaching hospitals were in the middle of it. No single news event marked the week. Its significance is that this scheduled surge tests a teaching hospital’s identity, access and credentialing processes harder than anything else in its calendar, while patient care continues at full volume.
Graduate medical education offices plan the changeover as a clinical and educational event, and they plan it well. On the technology side it is often handled as a pile of tickets: accounts, badges, EHR training, phones. That framing hides how much is happening at once. Within a few days a hospital adds a large cohort of new prescribers, changes the roles of many existing ones and removes those who are leaving. The work separates into four parts that do not overlap, each with a different failure: joiners, movers, leavers, and the supervision record that ties trainees to the physicians responsible for them.
Joiners: access on day one, and not before
New residents need EHR access with the right role, secure messaging, remote access and badge access. Prescribers also need credentials that satisfy DEA rules for electronic prescribing of controlled substances. Those rules require identity proofing and two-factor authentication before a prescriber can sign controlled substance orders electronically. Many residents prescribe under the hospital’s DEA registration using an internal code, which federal rules permit, and state rules add their own conditions.
The usual failure is timing. Identity proofing and authenticator enrollment cannot be done for hundreds of people on the first morning without a queue that delays patient care. Hospitals that avoid it move the steps earlier. They complete remote identity proofing in the weeks before arrival, issue phishing-resistant authenticators during orientation and verify that each account works before the first shift. Personal phones, which residents will use for secure messaging and authentication apps, are enrolled in mobile device management at the same session.
The counterweight is dormancy. Accounts created in May for a July start sit open and unused for weeks, which is attractive to attackers. Provisioning accounts early but activating them close to the start date resolves the tension. A useful measure is the share of new residents with working EHR and prescribing access at the start of their first shift.
Movers: changing roles without accumulating access
Residents who move from intern to second year, change services or begin a fellowship need different access. In many hospitals new permissions are added and old ones are rarely removed, so senior trainees accumulate access well beyond their current role. That widens the records any single compromised account can reach. It also weakens privacy monitoring, because inappropriate access is harder to spot when many users can see everything.
The structural fix is to drive EHR roles from the residency management system. A change in program year, rotation or fellowship status then changes roles automatically, removing as well as adding. Access to record categories with extra legal protection, such as substance use disorder treatment records, needs particular care at each change. Where that integration does not exist, a reconciliation each July between the program rosters and actual EHR roles is a reasonable interim control. The measure is the number of trainees whose roles do not match their current assignment.
Leavers: graduates who still have accounts
Graduating residents leave in late June, but their situations differ. Some move to another hospital. Some stay as attending physicians, which means their account should change rather than close. Some leave medicine. Their EHR accounts, remote access, secure messaging, prescribing credentials and enrolled devices should change on the day their status changes.
Delays are common because departure dates vary and three offices hold the data: graduate medical education, the medical staff office and IT. When those systems do not share a status feed, accounts stay active after the person has gone. Corporate data stays on personal phones too. A departure feed from the residency management system to identity governance, with a follow-up review a few weeks after graduation, closes most of the gap. The measure is how many departed trainees still have active access after a fixed number of days.
One legitimate exception needs a rule of its own. Graduates often have charts left to complete after they leave. Rather than leaving full accounts open, hospitals can grant time-limited access restricted to their own incomplete documentation, with an expiry date set at departure. That keeps the record complete without turning an exception into a standing account.
The supervision record
The fourth part is the least visible. Supervision of residents is documented in the EHR through attestations, co-signatures and teaching physician notes. Those records matter for patient safety, accreditation and Medicare billing rules for teaching physicians. When residents and attending physicians change at the same time, the rules that route notes for co-signature must change with them.
Errors here do not show up as access problems in July. They show up in August as unsigned notes, billing holds and documentation queries. Updating routing tables alongside role changes, and reviewing the unsigned-note queue by service in the first weeks of July, catches most of them. The measure is the volume of supervision documentation still unsigned after the hospital’s own deadline.
Each part has a different owner, which is why a hospital should give the changeover one plan, one accountable lead and four measures reviewed together. The same discipline improves onboarding for every other clinical group hired during the year.
With hindsight
From October 2026, the July changeover is three months behind teaching hospitals and the next one is nine months away, which makes autumn the right time to review it. Little about the problems described here is specific to 2026. They follow from the structure of the event: a fixed date, a large cohort and three offices holding the status data. That is the case for running the changeover as a standing program with its own measures. The NRMP’s figures show the Match grew again in 2026, so the volume pressure is not easing. Remote identity proofing and phishing-resistant authenticators make the joiner side easier where hospitals have adopted them. The mover and leaver sides still depend on status data flowing reliably between graduate medical education, the medical staff office and IT. A review this autumn against the four measures gives the 2027 plan a baseline, and shows which fixes need system integration and which need only a better calendar.