This policy establishes guidelines for the secure use of personally owned devices when accessing or handling electronic Protected Health Information (ePHI) on behalf of BK Healthcare Management LLC.
Purpose
To provide principles and guidelines for the secure use of personally owned devices (BYOD) by workforce members when accessing, storing, transmitting, or processing electronic Protected Health Information (ePHI).
Scope
This policy applies to all employees, contractors, and workforce members who use personal devices such as smartphones, tablets, laptops, or desktops to access or handle sensitive or protected information belonging to the organization.
Policy
The organization permits the use of personal devices for business purposes only if such use complies with the security standards outlined in this policy. All devices used to access ePHI must implement appropriate administrative, physical, and technical safeguards.
BYOD Security Requirements
- Authentication and Locking
- Devices must be secured with a strong password, passcode, or biometric authentication.
- Devices must automatically lock after no more than 15 minutes of inactivity.
- Software and Updates
- Devices must run up-to-date operating systems.
- Security patches must be installed promptly.
- Antivirus and Endpoint Protection
- Devices must have active antivirus or endpoint protection installed and maintained.
- Encryption
- Devices must support full-disk encryption.
- Any stored ePHI must be encrypted using FIPS 140-2 compliant standards.
- Multi-Factor Authentication (MFA)
- MFA is required for accessing systems that handle ePHI.
- Prohibited Activities
- Jailbroken or rooted devices are not allowed.
- ePHI must not be stored in personal cloud services (e.g., iCloud, Google Drive, Dropbox).
- Devices used for work must not be shared.
- Public Wi-Fi may only be used with a secure VPN connection.
- Permitted Access Methods
- Access to ePHI is allowed only through secure, TLS-encrypted portals or approved applications.
Incident Reporting and Breach Response
- Loss, theft, or compromise of a device must be reported immediately.
- The organization will follow its Incident Response procedures.
- Remote wipe may be initiated if necessary.
Acknowledgment and Compliance
- All workforce members must complete HIPAA Security Awareness Training.
- A signed BYOD acknowledgment form is required before device use.
Review and Revision
This policy will be reviewed annually or when significant changes occur in technology, regulations, or risk environment.
Related Policies
- Data Security Policy – Access Control
- Data Security Policy – Information Access Management
- Data Security Policy – Incident Response and Reporting
- HIPAA Security Rule Basics
Relevant HIPAA Regulations
- 45 CFR §164.308(a)(3) – Workforce Security
- 45 CFR §164.312(a)(1) – Access Control
- 45 CFR §164.312(d) – Authentication
- 45 CFR §164.310(d)(2) – Device and Media Controls