Mobile Device Management: Securing Phones Without Owning Them

Clinical staff use their phones for work. They photograph wounds, message colleagues about patients, look up drug references and check rotas. Much of this happens on personal devices, and a policy prohibiting it does not stop it — it only stops you seeing it.

The workable position is to provide a sanctioned path that is easier than the unsanctioned one, and to manage the data rather than the device.

MDM or MAM

For a personal phone, MAM is almost always the correct answer. It protects the organisational data, leaves personal data untouched, and removes the objection that stops adoption. Full MDM belongs on corporate-owned hardware.

What to enforce in the work container

• Separate passcode or biometric for the managed app
• No copy, paste or share out of the container into personal apps
• No backup of container data to personal cloud accounts
• Block screenshots where the platform supports it
• Conditional access — device not jailbroken, OS reasonably current
• Automatic container wipe after a period of inactivity or on offboarding

The clinical photography problem

Wound photography, dermatology images and pre-operative documentation are clinically valuable and routinely captured on personal phones straight into the camera roll — which syncs to a personal cloud account, where it stays.

The fix is a sanctioned capture path: a managed application that photographs directly into the record, never touching the camera roll. Where that does not exist, the realistic alternative is a small number of shared corporate devices for the purpose, and clear guidance.

Prohibition alone fails here, because the clinical need is real and immediate.

Lost and stolen devices

That last point matters. A remote wipe is queued and applies when the device next comes online. An attacker who keeps it offline never receives it. Revoking tokens and sessions server-side is what actually ends the access — see SSO and session management.

If PHI was cached inside the container and you cannot confirm the wipe completed, that is a disclosure assessment, not an IT ticket.

Offboarding and app inventory

Two operational gaps close most of the remaining risk.

Offboarding must reach the container. When someone leaves, the managed container is wiped and the account's sessions revoked. On a personal device this is the only removal step available, and it must be driven by the HR feed rather than a ticket — see contractor identity governance.

Know which apps hold PHI. Staff install clinical reference tools, dictation apps, secure messengers and AI assistants. Some are sanctioned, most are not, and several transmit data to third parties. Maintain an approved list, make it genuinely useful, and review what appears outside it in the managed inventory.

Generative AI assistants warrant explicit treatment here. Pasting a clinical note into one is a disclosure to a third party, and it is happening on phones more than on desktops because it is easier.

Where to start

Find out what clinical staff currently use for messaging about patients. In most hospitals the honest answer includes a consumer messaging app. That is your requirement specification — provide something equally convenient inside a managed container, and the problem largely resolves itself.

GuardsArm assesses mobile and BYOD posture in clinical settings, including sanctioned clinical photography paths. Book a scoping call.