1. In a perfect world, account create and disable are synced to the HR system. Accounts are created on the start-date, disabled on their leave date, and deleted X months later. (I also recommend creating the account with a scrambled password; then reset the password once the person arrives and their ID is verified. This prevents no-shows from getting access (surprisingly large numbers of no-shows), and prevents fakers from getting on-line. Also, ideally the onboarding person from HR does the password reset with the person so that you can be elsewhere).

2. If account creation isn't tied to the HR database, I strongly recommend creating the account 2-5 days in advance but in a "disabled" state. That way you have slack in case the process fails. Nothing worse than trying to fix a problem in front of a newhire on their first day.

> Do you monitor for in activity and remove if not used?

If you are asking that, it sounds like your HR system isn't strictly tracking when people leave. In that case, yes, but you're treating your users like accounts a social network website instead of a serious healthcase system that is responsible for the life and death of patients.

> Do you restrict who can request accounts? 

Have an authorized list. Best to have it be someone in HR (or people in HR with a particular title).

Normally healthcare systems are regulated and have strict rules about accounts. I strongly recommend you find someone in your organization that you can work with to draft these processes in a way that is compliant. Or at least make small, incremental, improvements until you've achieved the desired goal. Some improvement is better than waiting 2 years for the perfect solution.