# Can staff use personal devices to access clinical systems?

HIPAA allows it with safeguards. Treat each personal laptop or phone as a workstation, write a device policy, and protect both the device and the login.

Updated: October 16, 2026

HIPAA doesn't ban personal devices. A personal laptop, phone or tablet that staff use to reach your EHR or other clinical systems is a workstation under the Security Rule. Your practice has to protect patient data on it like any other workstation. In practice, that means a written device policy, settings you can check, and logins that belong to the person rather than the device.

## What HIPAA says about personal devices

HHS's Guidance on HIPAA & Cloud Computing answers the question for cloud systems directly. Providers may use mobile devices to reach patient data in a cloud. The condition is that the right administrative, physical and technical safeguards protect the data, both on the device and in the cloud. Any outside service provider with access to the data also needs a business associate agreement (BAA). HHS adds that the HIPAA Rules don't endorse or require a specific technology. Instead, they require you to analyze the risks each technology brings and put reasonable and appropriate safeguards in place.

The Security Rule's definitions (45 CFR 164.304) settle what counts. A workstation is a laptop, a desktop or "any other device that performs similar functions", plus the electronic media near it. The rule doesn't say who must own it. So a clinician's own laptop that opens your EHR is a workstation for your practice.

## Security Rule sections that apply

Several standards apply to a personal device that reaches patient data. The two workstation standards have no implementation specifications under them, so you must meet the standard itself. The implementation specifications under the others each carry a label. "Required" means you must put it in place. "Addressable" means you put it in place if it's reasonable and appropriate. If it isn't, you document why and use an equivalent measure where one is reasonable (164.306(d)).

| Section | What it asks for | Label |
| --- | --- | --- |
| 164.310(b) Workstation use | Policies on what a workstation may be used for, how, and in what surroundings | Required (standard) |
| 164.310(c) Workstation security | Physical safeguards so only authorized users can reach the workstation | Required (standard) |
| 164.310(d)(2)(i) Disposal | Procedures for the final disposal of patient data and the device or media it's on | Required |
| 164.310(d)(2)(ii) Media re-use | Removing patient data before media are reused | Required |
| 164.310(d)(2)(iii) Accountability | A record of where hardware and media go and who is responsible | Addressable |
| 164.312(a)(2)(i) Unique user identification | A unique name or number for each user | Required |
| 164.312(a)(2)(iii) Automatic logoff | Signing the user out after a set time of inactivity | Addressable |
| 164.312(a)(2)(iv) Encryption and decryption | A way to encrypt and decrypt patient data | Addressable |

The device and media controls standard (164.310(d)(1)) covers hardware and media that hold patient data coming into and leaving your facility. A personal device goes home with its owner every night. So decide which personal devices may hold patient data at all, and plan for how you'll know the data is gone when the person leaves.

## Write a personal device policy

HHS's 405(d) guide for small healthcare organizations includes a personal device policy in its table of policies that help reduce the risk of cyberattacks. The policy states the practice's position on personal devices and, if they're allowed, how they will be managed. A separate policy covers laptops, other portable devices and remote use.

A workable policy answers these points:

- Which roles may use a personal device, and for which systems.
- What the device must have before it's allowed, such as a screen lock, encryption and current updates.
- How you check the settings, and how often.
- What the owner does if the device is lost or stolen, and how fast.
- What happens to work data and saved logins when the person leaves.

Keep a list of approved devices and their owners. That list supports the accountability record in 164.310(d)(2)(iii). The 405(d) guide also warns against letting staff back up a work mobile device to a personal computer unless that computer meets your encryption and data security standards.

## Settings to require on phones and tablets

HealthIT.gov's fact sheet for clinicians lists 11 tips for any mobile device, whether personally owned or issued by the practice:

- Encrypt health information on the device.
- Require a password or other sign-in check.
- Turn on remote wipe or disabling in case the device is lost or stolen.
- Don't install or use file-sharing apps.
- Turn on a firewall.
- Install security software against malware.
- Keep that software up to date.
- Look into apps before you download them.
- Keep the device with you so no one else can use it.
- Use adequate security when sending health information over public Wi-Fi.
- Delete stored health information before you get rid of the device.

NIST SP 800-124 Rev. 2 covers smartphones and tablets, not laptops. It says to treat every mobile device as untrusted until the organization has secured it and keeps checking it. For personal devices, NIST describes managing only the work apps and their data, which doesn't require enrolling the whole phone in device management. NIST notes this may ease staff privacy concerns. These tools often tie into remote wipe for people who leave or change roles. NIST's section on remote wipe says it can delete work data and apps on employee-owned devices as well.

## What a device policy can't fix

Some risks on a personal device sit with the login, not the device. If someone saves a work password in the browser on their own laptop, you can't check that it's gone after they leave. You don't manage that browser. Records of who did what should also come from your systems, because you can't rely on anything kept on a device you don't manage (164.312(b), audit controls).

So give each person their own login, which the Security Rule requires anyway. Remove it when they leave, and keep logins out of personal browser storage where you can. For when browser password saving is and isn't a good fit, see [Should employees save work passwords in the browser?](/guides/shared-accounts/browser-saved-passwords-at-work).


## Frequently asked questions

**Does HIPAA allow staff to use their own phones for patient data?**

Yes. HHS says providers may use mobile devices to reach patient data in the cloud if the right safeguards are in place on the device and in the cloud, and the needed BAAs are signed.

**Is a personal laptop a workstation under HIPAA?**

Yes, if it's used to reach patient data. The Security Rule defines a workstation as a laptop, desktop or similar device. The workstation use and workstation security standards apply to it.

**Do we have to install device management on staff phones?**

HIPAA doesn't require a specific technology. NIST notes that managing only the work apps, rather than enrolling the whole phone, may ease staff privacy concerns on personal devices.

**Is encryption required on personal devices?**

Encryption is addressable. You put it in place if it's reasonable and appropriate. If not, you document why and use an equivalent measure. HealthIT.gov lists encryption first among its tips for mobile devices.

## Sources

- [45 CFR 164.304, Definitions (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.304)
- [45 CFR 164.306, Security standards: General rules (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.306)
- [45 CFR 164.310, Physical safeguards (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.310)
- [45 CFR 164.312, Technical safeguards (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312)
- [HHS: Guidance on HIPAA & Cloud Computing](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html)
- [HealthIT.gov: Take Steps to Protect and Secure Information When Using a Mobile Device (fact sheet)](https://healthit.gov/wp-content/uploads/2019/07/fact-sheet-take-steps-to-protect-information.pdf)
- [NIST SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise (May 2023)](https://csrc.nist.gov/pubs/sp/800/124/r2/final)
- [HHS 405(d): Technical Volume 1, Cybersecurity Practices for Small Healthcare Organizations (2023 Edition)](https://hhscyber.hhs.gov/Documents/HICP/tech-vol1-508.pdf)

## How Junify handles this

**Doing this by hand** You give every clinician and staff member their own login, open and close access for each per-diem shift and vendor staff change, and keep a record of who used which system and when for someone to review.

**With Junify** Junify handles two personal device problems: passwords left on the device, and knowing who used the system. Staff verify on their own phone and sign in through the browser extension without seeing the password. Systems open in an incognito window, so closing it leaves no password or browsing history, and downloads can be blocked per account. Your practice still writes the device policy, keeps the device list and checks device settings.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=healthcare&from=guide&cluster=healthcare-access&slug=byod-for-clinical-systems)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [Who is responsible for user accounts in your practice's cloud software?](/guides/healthcare-access/clinic-saas-responsibility-split): The vendor secures its service. Your practice decides who gets a login and removes it when they leave. HHS says to sign a BAA and put the split in writing.
- [The HHS cybersecurity performance goals for accounts and logins](/guides/healthcare-access/hhs-cybersecurity-performance-goals-accounts): Four of HHS's 10 essential goals cover logins: MFA, revoking departing staff's access, unique credentials and separate admin accounts. HHS calls them voluntary.
- [What HHS asks to see about access control in a HIPAA audit](/guides/healthcare-access/hipaa-audit-access-control-evidence): OCR's audit protocol asks for policies plus proof, such as access approvals, unique user IDs, shared account lists, offboarding records, and reviewed logs.