Can staff use personal devices to access clinical systems?

HIPAA doesn’t ban personal devices. A personal laptop, phone or tablet that staff use to reach your EHR or other clinical systems is a workstation under the Security Rule. Your practice has to protect patient data on it like any other workstation. In practice, that means a written device policy, settings you can check, and logins that belong to the person rather than the device.

What HIPAA says about personal devices

HHS’s Guidance on HIPAA & Cloud Computing answers the question for cloud systems directly. Providers may use mobile devices to reach patient data in a cloud. The condition is that the right administrative, physical and technical safeguards protect the data, both on the device and in the cloud. Any outside service provider with access to the data also needs a business associate agreement (BAA). HHS adds that the HIPAA Rules don’t endorse or require a specific technology. Instead, they require you to analyze the risks each technology brings and put reasonable and appropriate safeguards in place.

The Security Rule’s definitions (45 CFR 164.304) settle what counts. A workstation is a laptop, a desktop or “any other device that performs similar functions”, plus the electronic media near it. The rule doesn’t say who must own it. So a clinician’s own laptop that opens your EHR is a workstation for your practice.

Security Rule sections that apply

Several standards apply to a personal device that reaches patient data. The two workstation standards have no implementation specifications under them, so you must meet the standard itself. The implementation specifications under the others each carry a label. “Required” means you must put it in place. “Addressable” means you put it in place if it’s reasonable and appropriate. If it isn’t, you document why and use an equivalent measure where one is reasonable (164.306(d)).

The device and media controls standard (164.310(d)(1)) covers hardware and media that hold patient data coming into and leaving your facility. A personal device goes home with its owner every night. So decide which personal devices may hold patient data at all, and plan for how you’ll know the data is gone when the person leaves.

Write a personal device policy

HHS’s 405(d) guide for small healthcare organizations includes a personal device policy in its table of policies that help reduce the risk of cyberattacks. The policy states the practice’s position on personal devices and, if they’re allowed, how they will be managed. A separate policy covers laptops, other portable devices and remote use.

A workable policy answers these points:

• Which roles may use a personal device, and for which systems.
• What the device must have before it’s allowed, such as a screen lock, encryption and current updates.
• How you check the settings, and how often.
• What the owner does if the device is lost or stolen, and how fast.
• What happens to work data and saved logins when the person leaves.

Keep a list of approved devices and their owners. That list supports the accountability record in 164.310(d)(2)(iii). The 405(d) guide also warns against letting staff back up a work mobile device to a personal computer unless that computer meets your encryption and data security standards.

Settings to require on phones and tablets

HealthIT.gov’s fact sheet for clinicians lists 11 tips for any mobile device, whether personally owned or issued by the practice:

• Encrypt health information on the device.
• Require a password or other sign-in check.
• Turn on remote wipe or disabling in case the device is lost or stolen.
• Don’t install or use file-sharing apps.
• Turn on a firewall.
• Install security software against malware.
• Keep that software up to date.
• Look into apps before you download them.
• Keep the device with you so no one else can use it.
• Use adequate security when sending health information over public Wi-Fi.
• Delete stored health information before you get rid of the device.

NIST SP 800-124 Rev. 2 covers smartphones and tablets, not laptops. It says to treat every mobile device as untrusted until the organization has secured it and keeps checking it. For personal devices, NIST describes managing only the work apps and their data, which doesn’t require enrolling the whole phone in device management. NIST notes this may ease staff privacy concerns. These tools often tie into remote wipe for people who leave or change roles. NIST’s section on remote wipe says it can delete work data and apps on employee-owned devices as well.

What a device policy can’t fix

Some risks on a personal device sit with the login, not the device. If someone saves a work password in the browser on their own laptop, you can’t check that it’s gone after they leave. You don’t manage that browser. Records of who did what should also come from your systems, because you can’t rely on anything kept on a device you don’t manage (164.312(b), audit controls).

So give each person their own login, which the Security Rule requires anyway. Remove it when they leave, and keep logins out of personal browser storage where you can. For when browser password saving is and isn’t a good fit, see Should employees save work passwords in the browser?.