Almost every employee in your building carries a smartphone. Staff check schedules, swap shifts, receive messages from supervisors, take photos, and sometimes handle resident-related communication on their personal devices. Banning phones entirely is rarely realistic, and ignoring the issue leaves PHI scattered across devices you do not control. A thoughtful bring-your-own-device (BYOD) policy is a middle path that protects residents while respecting employees' privacy and budgets.
Resident photos and videos stored on personal phones and backed up to personal cloud accounts.
Messages containing PHI sent through standard texting or consumer apps.
Lost or stolen phones with no passcode or remote wipe.
Malicious apps that can read data on the phone.
Departing employees who keep work data on their devices.
Privacy and dignity concerns, since residents in senior living have the right to privacy, and photos taken without proper permission can create serious problems.
The HIPAA Security Rule's device and media controls and workstation security standards apply to ePHI on devices, including personal ones used for work.
There are three broad options.
Prohibit personal devices for any work use involving PHI, and supply organization-owned devices where needed. This is the simplest to defend, but it costs more and requires enforcement.
Allow personal devices with a managed work container, so work apps and data are separated from personal content and can be removed without touching personal information. This is a common compromise.
Allow unrestricted use. This is the riskiest option and is not recommended where PHI is involved.
Many facilities choose a hybrid: personal phones may be used for approved apps such as a secure messaging tool and scheduling, but not for resident photos, with organization-owned devices available for clinical photography when needed.
Who may use a personal device for work, for what purposes, and who approves it? Include agency staff and volunteers if relevant.
A screen lock with a passcode or biometric.
Operating system and app updates installed in a reasonable time.
Device encryption, which is on by default on most modern phones.
No jailbroken or rooted devices.
Approved apps only for work data, with secure messaging rather than standard texting.
Enrollment in mobile device or app management if offered.
Sending PHI through personal text messages, social media or consumer chat apps.
Taking photos or recordings of residents on personal phones, except as your policy specifically allows. Many organizations prohibit this entirely and provide a facility device for approved clinical purposes.
Posting anything about residents or the workplace on social media in ways that could identify residents.
Storing PHI in personal cloud storage.
Require immediate reporting to IT or the privacy officer, and explain what will happen, such as removal of the work profile or remote wipe of work data. If you reserve the right to wipe an entire device, say so clearly, since employees may be more cautious about enrolling.
Be transparent about what the organization can and cannot see. A managed work container can usually see only work apps and data, not personal photos, messages or browsing. Employees are more willing to participate when they know their personal content remains private.
Say whether you provide a stipend, and what support the helpdesk offers for personal phones. Make clear that the organization may limit support to work apps.
When someone leaves, work data is removed from their device. Include confirmation in your offboarding checklist.
Explain that violations can lead to disciplinary action, consistent with the sanction policy HIPAA requires.
Draft the policy with input from nursing leadership, HR and IT.
Have counsel review, particularly for wage and hour or privacy issues related to employees using personal devices for work.
Explain it in staff meetings with real examples, and be ready to answer why photos are restricted.
Collect signed acknowledgments.
Provide a quick-start guide for enrollment.
Review the policy annually, and after any incident.
Policies work best when staff have something easier than the risky shortcut: a secure messaging app that is quick, a facility phone or tablet at each station for approved photos, and a simple way to see schedules.
UnityCare IT helps care facilities draft BYOD policies, deploy mobile device management and choose secure messaging tools. If you are unsure how many personal phones are connected to your email today, we can help you find out.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172