Beginnerproviderpractice manager
HIPAA and Mobile Devices: Phones and Tablets in Patient Care
Protect pocket-sized computers like the laptops they are.
TL;DR
Use PINs or biometrics, encrypt devices, avoid personal apps for PHI, and report losses immediately.
Updated 2026-04-21
Phones are convenient, and easy to lose. HIPAA does not ban them, but your practice must control how they touch patient data.
Baseline protections
- Screen lock with a strong PIN or biometrics.
- Full-disk encryption turned on (most modern phones support it).
- Remote wipe capability for organization-owned devices.
Apps and photos
Do not store patient photos in personal albums. Use approved clinical photo workflows if imaging is part of care.
Lost device playbook
Report immediately. IT may wipe the device; leadership decides if breach analysis is required depending on encryption and what was on the phone.
Not legal advice. Educational overview only; consult qualified counsel for your situation.