To govern ABA mobile devices, BYOD, and shared workstations, inventory every endpoint that can create, receive, maintain, or transmit practice information. Define ownership, approved users, data and apps, authentication, encryption, updates, local storage, messaging, network use, session locking, remote action, backup, support, accessibility, loss reporting, evidence, and retirement. Test the actual configured device and remove access when its user, purpose, or security state changes.

Define Darius's mobile device, BYOD, and shared-workstation governance

Darius distinguishes practice-owned phones and tablets, personally owned devices, shared clinic workstations, kiosks, home computers, removable media, and vendor support devices. The same application can leave different traces through downloads, notifications, screenshots, caches, keyboards, backups, browsers, and connected accounts.

Build the device and endpoint control register

The register captures device ID; owner and custodian; device class and operating system; serial or managed identity; approved users and purpose; client, workforce and business data; apps and browser; local storage and cache; authentication, MFA and session lock; encryption; updates; network; messaging; camera and microphone; copy, print and screenshot; backup and cloud sync; mobile management; accessibility; lost or stolen response; remote lock or wipe; return; deletion; retirement; exception; and review. Structured fields support routing, comparison, evidence expiry, monitoring, alerts, and validation. Narrative preserves clinical reasoning, client and family experience, accessibility, uncertainty, disagreement, legal deferral, source limits, and why an accountable owner approved, restricted, repaired, deferred, or rejected the item.

Run Darius's workflow

Darius maps endpoint use by role and setting, applies the approved baseline, and tests real permissions and data remnants. Shared workstations receive rapid user switching, attribution, privacy-screen, timeout, print, download, and accessibility checks. BYOD enrollment states what practice controls apply, what the user can expect, and how work data leaves the device at separation.

Protect the mobile device, BYOD, and shared-workstation governance boundary

A device policy cannot silently claim control over all personal health data. HHS explains that HIPAA generally protects PHI handled by covered entities and business associates, while many personal-device activities fall outside that scope. The practice separately assesses employment, consumer-health, monitoring, consent, contract, and state-law issues.

Keep authority and evidence attributable

Darius assigns every clinical, privacy, security, accessibility, technical, records, financial, workforce, and operational decision to the qualified owner. Software and vendors can surface evidence, automate an approved step, or propose an action. They cannot grant professional authority, accept the practice's risk, replace client involvement, or approve their own control effectiveness.

Keep unknowns, workarounds, and failures visible

Darius records each unknown, assumption, exception, dependency, workaround, failed or skipped test, owner, deadline, escalation, and retest. Conditional approval states the exact scope, safeguard, operating restriction, evidence, expiry, and result if remediation misses its date. Raw failures stay in the denominator.

Work through Darius's fictional example

Darius reviews 38 fictional endpoints. Twenty-nine initially match approved ownership, access, encryption, update, storage, messaging, loss, accessibility, and retirement controls. Two former staff tablets stay active, one shared browser retains a client download, one phone backs up to a personal cloud, one workstation lacks rapid locking, one device misses updates, and three have no owner. Six repair. Three remain restricted. The scenario is synthetic and tests workflow and denominator logic. It establishes no clinical, privacy, security, accessibility, contract, payer, employment, records, financial, or legal conclusion for a real person, practice, product, or vendor.

Calculate Darius's measures honestly

Initial endpoint alignment is 29 of 38, or 76.3%. Thirty-five reach validated use, revocation, or retirement, or 35 of 38, or 92.1%. Devices, users, accounts, applications, records, sessions, findings, and remediation attempts remain separate units.

Address the main mobile device, BYOD, and shared-workstation governance risk

An approved application can still expose information through a device's notification preview, unmanaged backup, shared browser session, screenshot, print queue, or former user's active token.

Test Darius's control against hard cases

Darius tests new device, shared login, user switch, session timeout, notification, download, offline cache, screenshot, personal backup, lost device, staff transfer, termination, remote action, and retirement. Every case retains product and version, configuration, data, user, starting state, expected safeguard, observed result, defect, owner, retest, and disposition. Test passage applies only to the named configuration and conditions.

Run Darius's independent acceptance test

Darius asks a reviewer to inspect one device of each class, verify its actual configuration, find stored work data, simulate loss, and complete offboarding. An ownerless endpoint, unattributed session, unremovable work copy, or inaccessible required workflow fails.

Maintain the device and endpoint control register

Darius assigns a review cadence and change triggers for requirement, product, version, configuration, workflow, integration, vendor, subprocessor, data use, law, contract, incident, staffing, access, and ownership changes. This mobile device, BYOD, and shared-workstation governance page remains draft until every named external review finishes.

Use organizational guidance within its public scope

Darius uses the CASP Organizational Guidelines public overview only for high-level business, clinical-operations, and risk-management context. CASP sells the detailed guidelines. The device and endpoint control register is this article's editorial operating model; CASP has not approved the specific workflow or technology.

Map vendor and cloud roles from actual functions

Current HHS Business Associates guidance classifies roles by functions and data relationships, including subcontractors and exceptions. HHS cloud guidance explains that a cloud provider handling ePHI for a regulated customer can be a business associate even when it holds encrypted data without the key. Darius records the actual role and agreement chain for the deployed system.

Keep the current Security Rule boundary visible

HHS risk-analysis guidance covers all ePHI a regulated entity creates, receives, maintains, or transmits. The current Security Rule page still identifies the January 2025 cybersecurity update as proposed as of August 19, 2026, so current eCFR text governs. The HHS guidance index provides current risk, remote-use, mobile-device, and ransomware resources. Darius labels proposals and readiness ideas separately from operative requirements.

Apply current administrative, technical, and documentation safeguards

Current 45 CFR 164.308 supplies administrative-safeguard duties, 45 CFR 164.312 supplies technical-safeguard duties, and 45 CFR 164.316 supplies policy, procedure, documentation, and specified six-year retention rules. Darius evaluates each applicable standard and implementation specification without claiming HIPAA requires one product, architecture, or control label.

Separate medical records, devices, and documentation retention

HHS states in its medical-record retention FAQ that HIPAA sets no general medical-record retention period. State and other sources often control those records, while HIPAA retains specified rule documentation. HHS's personal mobile-device page also explains that many personal-device health-data activities fall outside HIPAA's covered-entity and business-associate scope. Darius maps entity, data, device, and record status instead of applying one rule everywhere.

Review consumer-health and AI promises separately

The FTC Health Breach Notification Rule guidance requires its own entity and qualifying PHR analysis. FTC staff also tells AI companies to uphold privacy and confidentiality commitments, including promises about model training and undisclosed uses. Darius treats that post as enforcement-oriented staff guidance and checks other law, contracts, and settings independently.

Use voluntary frameworks as organizing aids

The NIST Cybersecurity Framework 2.0 organizes outcomes across Govern, Identify, Protect, Detect, Respond, and Recover. The NIST AI RMF page says AI RMF 1.0 is voluntary and being revised. NIST SP 800-34 Rev. 1 is final federal information-system contingency guidance that private practices may adapt. The OIG General Compliance Program Guidance is voluntary and nonbinding. Darius uses them to organize endpoint and BYOD controls; none creates a legal safe harbor.

Test accessibility and communication in the real workflow

Darius checks the DOJ Title III overview and web-accessibility guidance within their scopes. The ASHA AAC Practice Portal says AAC users should always have access to their communication tools. Testing covers real tasks, alternative channels, privacy, support, and the person's ability to ask questions, correct information, assent, dissent, and report a problem.

Related resources

Sources