Purpose

LifeCare uses a Bring Your Own Device (BYOD) model for all therapists to support business operations, including documentation, communication, scheduling, and delivering therapy services in patients' homes and community settings.

Using personally owned smartphones, tablets, laptops, and other mobile devices creates additional risks to the confidentiality, integrity, and availability of Electronic Protected Health Information (ePHI). This policy establishes security requirements to protect patient information and ensure compliance with HIPAA and LifeCare security standards.

Policy

All workforce members who access, create, store, transmit, or receive LifeCare information using a personal mobile device are responsible for protecting patient information and maintaining the security of their device.

Mobile devices used for LifeCare business must comply with this policy at all times.

Risks Associated with Mobile Devices

Because mobile devices are portable and frequently used in the community, they present unique security risks, including:

• Loss or theft of a device containing patient information.

• Unauthorized access by family members, friends, or other individuals.

• Inadvertent disclosure of patient information through text messages, email, photographs, or applications.

• Downloading malware, viruses, ransomware, or other malicious software.

• Use of unsecured public Wi-Fi networks.

• Syncing patient information to unsecured cloud storage services.

• Improper disposal or resale of devices containing patient data.

• Viewing patient information in public locations where unauthorized individuals may observe the screen.

Any of these events may result in a HIPAA violation, data breach, financial penalties, reputational harm, and potential disciplinary action.

General Security Responsibilities

All LifeCare workforce members shall:

• Complete all required HIPAA, privacy, security, and mobile device training.

• Follow all LifeCare policies and procedures regarding electronic communications and patient information.

• Exercise sound professional judgment when accessing patient information outside of a secure office environment.

• Immediately report any suspected privacy or security incident.

Remember:

If you suspect a breach, loss, theft, or unauthorized access, report it immediately. Do not wait to determine whether a breach actually occurred.

Device Security Requirements

The following safeguards are required on any device used for LifeCare business purposes.

Authentication and Password Protection

Users must:

• Enable password, passcode, fingerprint, facial recognition, or other approved authentication methods.

• Use strong passwords that cannot be easily guessed.

• Configure devices to automatically lock after a period of inactivity.

• Change passwords immediately if they are suspected to be compromised.

Users Must Never

• Share passwords or authentication credentials with anyone.

• Store passwords in unsecured locations.

• Allow family members, friends, or others to use a device that contains or can access patient information.

Encryption

All devices used to access or store LifeCare information must have encryption enabled whenever available.

Encryption protects information by making it unreadable to unauthorized individuals if a device is lost or stolen.

Remote Wipe and Device Location Services

Whenever possible, users must enable:

• Remote device location services

• Remote lock capabilities

• Remote wipe capabilities

If a device is lost or stolen, these features can help prevent unauthorized access to patient information.

Security Software

Devices should include:

• Current operating system updates

• Antivirus or anti-malware software when applicable

• Firewall protection when available

Users are responsible for promptly installing security updates and software patches.

Never

• Ignore security warnings.

• Delay critical security updates.

• Disable security software required to protect the device.

Approved Use of Applications

Applications installed on devices may create significant privacy and security risks.

Before downloading or using an application:

• Verify it comes from a trusted source.

• Review requested permissions.

• Ensure the application is necessary for business use.

Never

• Install applications from unknown or untrusted sources.

• Use unauthorized file-sharing applications.

• Use applications that automatically upload patient information to personal cloud storage accounts.

• Use consumer messaging applications to transmit PHI unless specifically approved by LifeCare.

Protecting Patient Information

Access Only What You Need

Users shall access only the patient information necessary to perform assigned job duties.

Patient records should be viewed only when required for treatment, operations, or other authorized purposes.

Screen Privacy

When working in patients' homes, vehicles, public locations, or other non-office settings:

• Position screens to prevent unauthorized viewing.

• Be aware of individuals nearby.

• Lock the screen whenever leaving the device unattended.

Users must use only approved methods to communicate patient information.

Before transmitting information electronically:

Confirm the recipient.

Send only the minimum necessary information.

Verify that the communication method complies with LifeCare requirements.

Never

Send PHI through personal email accounts unless specifically authorized.

Text patient information through unsecured messaging platforms.

Forward patient information to personal accounts or devices.

Wi-Fi and Network Security

Public wireless networks present significant security risks.

Examples of high-risk networks include: 

• Free public Wi-Fi in restaurants

• Hotel guest networks

• Airport Wi-Fi

• Retail store Wi-Fi

• Open community networks

Always

• Use secure, password-protected Wi-Fi networks whenever possible.

• Verify network legitimacy before connecting.

• Disconnect from public networks when business use is complete.

Never

• Access patient information over unsecured public Wi-Fi.

• Connect to unknown wireless networks.

• Conduct patient-related activities on networks that appear suspicious or unsecured.

Device Loss, Theft, or Security Incidents

The loss, theft, or suspected compromise of a device must be treated as a potential security incident.

Immediately report:

• Lost devices

• Stolen devices

• Unauthorized access

• Malware or ransomware infections

• Suspicious activity

• Accidental disclosures

• Misdirected emails or messages containing patient information

Prompt reporting allows LifeCare to assess risks and meet regulatory reporting requirements.

Disposal and Replacement of Devices

Before selling, trading, recycling, discarding, or reassigning a device, users must ensure all LifeCare-related information has been permanently removed.

This includes:

• Patient records

• Emails

• Text messages

• Photographs

• Downloads

• Cached information

• Cloud synchronization data

When in doubt, consult LifeCare before disposing of the device.

Prohibited Activities

The following activities are strictly prohibited:

❌ Sharing device passwords or authentication credentials

❌ Allowing unauthorized individuals to access devices containing LifeCare information

❌ Storing PHI on unsecured devices

❌ Sending unencrypted patient information through unauthorized methods

❌ Ignoring security updates or software patches

❌ Downloading unapproved applications from untrusted sources

❌ Leaving mobile devices unattended in public areas or vehicles

❌ Accessing patient information over unsecured Wi-Fi networks

❌ Failing to report a suspected privacy or security incident

❌ Disposing of devices without first removing all LifeCare-related information

❌ Violating LifeCare privacy, security, HIPAA, or BYOD policies