Mobile Device Policy Checklist for a Spontaneous Coronary Artery Dissection Clinic

A mobile device policy helps your spontaneous coronary artery dissection (SCAD) clinic support timely care while protecting patient information. Use this checklist to define which devices and apps staff may use, how they must be secured, and what to do if something goes wrong. Adapt it to your clinic’s risk analysis, workflows, and applicable policies; it is not a substitute for legal or compliance advice.

Which devices and apps may access patient information?

List the clinic-approved phones, tablets, laptops, and other mobile devices that may access electronic health records (EHRs), scheduling systems, clinical images, or other protected health information (PHI). Identify the approved app or web portal for each purpose, and name who is responsible for approving devices and apps.

• Allow access only through clinic-approved EHR apps, secure web portals, and other reviewed clinical tools.
• Require staff to register devices before they access patient information. Record the device owner, assigned user, operating system, and approved apps.
• Set a clear bring-your-own-device (BYOD) rule. If personal devices are allowed, specify required security settings, support expectations, and whether clinic management software may remove clinic data.
• Prohibit unapproved apps, personal email, consumer file-sharing services, and social media for handling patient information.

Personal devices are not automatically prohibited by HIPAA, but the clinic must decide whether their use can be appropriately safeguarded. HHS advises users to follow their organization’s mobile-device policies, including its rules for BYOD, registration, storage, backups, and remote wiping. See the HHS guide to mobile-device policies.

How should mobile devices protect patient health information?

Require a strong passcode or other approved screen lock, a short automatic-lock interval, and encryption for devices that store or access PHI. Enable multi-factor authentication (MFA) for EHR and other sensitive accounts where available. Give each staff member a unique account; prohibit shared logins and the reuse of another person’s credentials.

Configure electronic health record access controls so each user receives access appropriate to their role and job duties. The Security Rule requires access controls, unique user identification, authentication, and audit controls for systems containing ePHI. Encryption is an addressable implementation specification: the clinic must assess whether it is reasonable and appropriate and document its decision and any applicable alternative safeguards. Read 45 CFR § 164.312 and HHS guidance on encryption.

• Keep operating systems, apps, and security protections updated according to clinic procedures.
• Disable lock-screen previews of messages or patient information.
• Use mobile device management (MDM) where appropriate to enforce security settings, maintain device status, and support remote locking or wiping.
• Train staff on clinic-specific rules, including how to report suspected phishing, unauthorized access, and other security incidents.

Which networks and data transmission methods are permitted?

Permit patient-information access only through network connections and services approved by the clinic. Use encrypted connections for EHR access and other electronic transmission of ePHI. A virtual private network (VPN) may be required by clinic policy for remote access, but HIPAA does not prescribe a VPN as the one required technology; the clinic must select safeguards based on its risk analysis and applicable Security Rule requirements.

• Use clinic-managed Wi-Fi or another network the clinic has approved and secured.
• Do not send PHI through public Wi-Fi unless the connection and application are protected by clinic-approved safeguards.
• Do not use ordinary text messaging, personal email, or unapproved chat apps to transmit PHI.
• Use approved secure messaging or EHR communication tools, and confirm the recipient before sending information.

The Security Rule requires technical measures to guard against unauthorized access to ePHI transmitted over an electronic network. Its encryption specification is addressable, so the clinic should document its risk-based decision and safeguards. See 45 CFR § 164.312 and HHS guidance on Security Rule risk analysis.

What steps should staff take if a device is lost or stolen?

Require staff to report a lost or stolen device immediately to the clinic’s designated supervisor, privacy officer, or security contact—even if they believe it is locked or encrypted. Staff should not wait to determine whether PHI was viewed or accessed.

1. Notify the clinic’s designated contact and provide the time, location, device details, and any known patient information accessible from it.
2. Follow the clinic’s instructions to lock, locate, disable, or remotely wipe the device through approved MDM tools. Do not use unapproved services or attempt actions that could interfere with an investigation.
3. Change affected credentials or revoke active sessions when directed, and preserve relevant device, account, and access records.
4. Document the incident and cooperate with the clinic’s investigation and risk assessment.

A lost device does not automatically mean a reportable HIPAA breach occurred. The clinic must assess the facts, including what information was involved and whether effective encryption or other safeguards protected it. HHS explains that breaches involving unsecured PHI are subject to the Breach Notification Rule and that the covered entity must evaluate the circumstances. See the HHS Breach Notification Rule overview and HHS guidance on encryption and lost devices.

How should local storage, backups, and cloud services be controlled?

Prefer EHR access that displays information without saving it to the device. If local storage is needed for an approved clinical purpose, limit the data and duration, protect it with encryption and access controls, and define when it must be removed. Do not save patient information to personal photo libraries, downloads, notes, or unmanaged removable storage.

Set clear cloud backup controls. Staff should not back up PHI to personal cloud accounts or consumer services. The clinic should approve the cloud service, understand what information it stores, configure access and security settings, and confirm that required contractual safeguards are in place. If a cloud service provider creates, receives, maintains, or transmits ePHI on the clinic’s behalf, HHS says the HIPAA Rules require an appropriate business associate agreement. See HHS guidance on mobile devices and cloud access.

Document how authorized backups are made, protected, retained, and restored. Test recovery procedures as appropriate, and make sure staff know which system is the official record. HHS’s Security Rule risk-analysis guidance identifies backup decisions as an area organizations should consider in their risk analysis.

How should the clinic manage device inventory and staff access?

Maintain an inventory of clinic-owned and approved personal devices that can access patient information. Record each device’s assigned user, approved apps, security status, and return or removal date. Update the inventory when a device is issued, replaced, reassigned, lost, or retired.

Assign access according to job responsibilities and remove or change it promptly when a staff member’s role changes or their employment ends. Review whether accounts are still needed, disable inactive accounts according to clinic policy, and use unique user IDs rather than shared credentials. HHS describes role-based access as a way to limit PHI access based on workforce members’ duties; treatment-related access is handled differently from uses subject to the Privacy Rule’s minimum-necessary requirement. See HHS guidance on the minimum-necessary requirement and 45 CFR § 164.312.

Establish an audit log review process. Review access reports and security alerts at intervals appropriate to the clinic’s risk, and investigate unusual access promptly. HIPAA requires mechanisms to record and examine activity in systems that contain or use ePHI, but the Security Rule does not specify one universal review frequency. See the HHS HIPAA audit protocol, which identifies review timing and documentation as factors to assess.

How can staff use and disinfect devices safely during patient care?

Use mobile devices in a way that protects both patient privacy and infection prevention. Position screens so visitors and other patients cannot see them, lock the device when stepping away, and avoid discussing identifiable information where others may overhear. Use only the patient information needed for the task at hand.

Set written procedures for cleaning and disinfecting shared or patient-care devices, including who is responsible and when cleaning takes place. Follow the device manufacturer’s instructions for compatible products and cleaning methods; do not spray liquid directly onto a device unless its instructions permit it. CDC advises healthcare settings to include computers and personal digital assistants used in patient care in cleaning and disinfection policies and to follow manufacturer instructions. See CDC guidance on patient-care equipment and CDC core infection-prevention practices.

In summary, approve devices and apps before use, secure access and transmission, control storage and backups, review activity, and give staff a clear incident-reporting and cleaning process. A practical checklist should fit your clinic’s risks and daily care workflow.

FAQs

Can staff use personal devices to access patient information?

They may do so only if the clinic’s policy allows it and the device and access method meet the clinic’s security requirements. Set conditions for registration, encryption, screen locking, MFA where available, approved apps, and remote removal of clinic data. HHS advises staff to determine whether their organization permits BYOD before using a personal device for work; HIPAA requires appropriate safeguards, not a universal ban on personal devices. See the HHS mobile-device policy guide.

What should staff do immediately if a mobile device is lost or stolen?

Report it immediately to the clinic’s designated supervisor, privacy officer, or security contact. Follow the clinic’s process to lock, disable, or remotely wipe it, and provide details that help the clinic assess what information may have been accessible. Do not wait for proof that someone viewed the data; the clinic will determine what investigation and any breach assessment are required.

Which apps and messaging channels may staff use for clinic communications?

Use only apps and messaging channels approved by the clinic for the information being shared. That may include the EHR’s secure messaging feature or another clinic-approved service configured for the clinic’s needs. Do not send PHI through personal email, ordinary text messages, or consumer chat or file-sharing apps unless the clinic has specifically approved the tool and safeguards for that use.

How often should mobile device access and security logs be reviewed?

The clinic should establish and document a review schedule based on its risk analysis, systems, and monitoring capabilities, and should investigate suspicious activity promptly. HIPAA requires audit controls to record and examine activity in systems containing ePHI, but it does not set one universal interval for reviewing every log. See the HHS audit protocol, which treats review frequency, documentation, and timeliness as relevant review factors.