HIPAA and mobile devices — phones and tablets in patient care

Phones are convenient—and easy to lose. HIPAA does not ban them, but your practice must control how they touch patient data.

Baseline protections

• Screen lock with a strong PIN or biometrics.
• Full-disk encryption turned on (most modern phones support it).
• Remote wipe capability for organization-owned devices.

Apps and photos

Do not store patient photos in personal albums. Use approved clinical photo workflows if imaging is part of care.

Lost device playbook

Report immediately. IT may wipe the device; leadership decides if breach analysis is required depending on encryption and what was on the phone.