TL;DR
Device compliance for healthcare teams does not get easier or harder in principle when people work from home. What goes away is the building that used to deliver half of it, so the controls move onto the hardware and the evidence has to be produced per device.
- The obligations are unchanged. Your ability to observe is not.
- Encryption carries most weight and needs a record made at issue.
- Three facts per device: who held it, was it encrypted, what happened to it.
- Agency and locum staff rarely fire the leaver trigger.
- A disposal certificate with no serial numbers evidences nothing.
- Recovery is where the trail stops, and it has no technical fix.
When this is lighter than you think
Four stages, and the first two are genuinely manageable.
No clinical data on endpoints. Staff work entirely inside a hosted system with nothing stored locally. Your position is far simpler, and the useful step is verifying that is actually true.
Best tools for HR Operations
Administrative staff only. Rostering, billing, correspondence. Still personal data, still serious, but the sensitivity tier is different and the controls can be proportionate.
Clinical staff working remotely. Patient information reaching devices outside any building. This is where the full set applies and where most organisations find their gap.
Multi-country or heavy agency use. Short engagements, varied jurisdictions, devices in places you have no presence. Recovery becomes the dominant problem rather than configuration.
Why device compliance for healthcare teams gets harder remotely
A hospital or clinic delivers a lot of security without naming it. Doors, badge readers, a colleague who notices an unattended screen, a locked room for equipment awaiting disposal. None of that appears in a policy because none of it had to.
Move the work into homes and every one of those disappears at once. The policy that governed it did not change, so on paper nothing happened. In practice a whole layer of control was removed and nothing replaced it, which is why the first remote audit after such a move tends to go badly.
The substitutions are mostly known. Encryption replaces the locked door. A short screen lock replaces the colleague. Device management replaces the person who used to walk round and patch things. What has no building-free equivalent is the last step, because collecting hardware from a former staff member’s home is a logistics problem rather than a control.
The frameworks assume you can close that loop. Asset handling in ISO/IEC 27001 expects equipment to be accounted for and recovered, and media sanitisation guidance in NIST SP 800-88 is written for devices you hold. Neither has anything to say about a laptop you cannot reach.
The five controls that travel
- Full disk encryption, recorded. Not just enabled. Recorded per device at issue, because the record is what you will be asked for.
- Short automatic lock. The cheapest replacement for the colleague who used to notice an open screen.
- Managed configuration. Patching and settings enforced centrally, so compliance does not depend on somebody’s attention.
- Local storage limits. What may be held on the device and for how long. Clinical teams download things; pretending otherwise weakens the whole position.
- Recovery and sanitisation. A route that works from a home address, producing a per-serial wipe record. This is the control that fails.
Four of those are configured once and apply everywhere. The fifth has to happen individually, every time, which is why it is the one that slips.
Five questions to diagnose your position
Does clinical data reach local storage? Ask someone to look at their own downloads folder rather than assuming.
Can you prove encryption for a named device on a named date? That is the question an assessor asks, almost word for word.
Who is in scope besides permanent staff? Agency, locum, students, contractors. Each needs naming or each is excluded by default.
How many devices are with people who have left? If the number is unknown, it is not zero.
Do your disposal certificates carry serial numbers? If they carry counts, they cannot be reconciled with anything.
How teams handle it, and the trade-offs
Keep everything in hosted systems. Best position available, because the device holds nothing worth recovering. It struggles against reality, since exports, attachments and screenshots happen in every clinical workflow.
Device management with enforced policy. Best for configuration, patching and proving a control was active. It struggles with devices that go offline permanently, which is exactly the leaver case.
Virtual desktops. Best for keeping data off the endpoint entirely and genuinely strong where it fits. It struggles on cost, on connectivity in rural settings, and on clinical tools that assume local hardware.
Personal devices with application controls. Best for agency and short-term staff, where issuing hardware is impractical. It struggles on sanitisation, because you cannot wipe a device you do not own, and that limitation should be stated rather than glossed.
A lifecycle service handling issue and recovery. Disclosure: RemoAsset is owned by the same people who publish this site. It handles delivery, retrieval and certified wiping across 80 or more countries, which addresses the one control with no technical substitute. Where it struggles: it is not a clinical system, not a compliance programme, and will not configure or monitor anything. The narrow part it covers is whether devices reach staff and come back with a record.
The decision table
| Situation | Scale | Setup | Primary pain | Recommended starting point |
|---|---|---|---|---|
| Nothing stored locally | Any | Hosted systems | Verify the assumption | Check one real device |
| Administrative staff only | Under 50 | Part time owner | Proportionality | Encryption plus lock screen |
| Clinical staff remote | 50 plus | IT owner | Building controls gone | All five travelling controls |
| Heavy agency use | Any | Any | No leaver trigger | Name the populations in scope |
| Assessment approaching | Any | Governance owner | No per device evidence | Produce the three facts |
| Devices not recovered | Any | Any | Trail stops at exit | Fix the recovery route |
What the evidence gap costs
The first cost is the assessment you cannot pass on a technicality rather than a weakness. Your encryption is fine. Showing it was fine on the specific laptop somebody asks about requires a record created months earlier, and the absence of that record reads identically to an absence of the control.
The second is the open incident you never opened. A device with patient information on it, never returned by somebody who left eighteen months ago, is an unresolved exposure. It is not tracked as one because it came through offboarding rather than through an incident process, so it sits in neither system.
The third is the reporting position. Asked how many devices hold clinical data and where they are, a team without an accurate register answers with an estimate. The estimate is what gets written down, and it is the thing that will be checked.
The fourth lands on the people doing the work. Clinical staff asked to follow controls nobody can support, with no practical way to return a device, improvise. The improvisation is reasonable each time and indefensible in aggregate.
So the useful test is not whether your policy meets the standard. It is whether you could pick one person who left last year and say, with evidence, where their device is now.
The step with no technical fix
Four of the five controls are solved by configuration. You set them once and they apply to every device, including ones you have never physically seen. That is why they are rarely the finding.
Recovery is different. It needs somebody to arrange a collection from a residential address, in whichever country that person lives, and then to produce a record. No console does that, and no policy produces it either.
Three signals say this is where you are exposed. You cannot list devices currently held by former staff. Collections from outside your main area stalled or never completed. And you hold no wipe certificate for a meaningful share of last year’s leavers.
It is worth measuring before the next assessment, because it is the one gap that cannot be closed quickly once somebody has asked. Seeing how issue, recovery and certified wiping sit in one record shows what closing it actually involves.
See how per device wipe records are produced
Read our guide to equipment compliance evidence
Related reading
- Evidencing equipment compliance
- The data protection policy
- The asset management policy
- The incident response policy
- Fixed-term staff and interns
Frequently Asked Questions
What changes when healthcare staff work remotely?
The obligations do not change. What changes is your ability to observe the device, so controls that relied on a building, such as a locked room or a supervised screen, have to be replaced by controls that travel with the hardware. That substitution is the whole exercise.
Is encryption enough on its own?
It carries more weight than any other single control and it is not sufficient by itself. You also have to be able to demonstrate it applied to a specific device on a specific date, which is a record made at issue. Without that record the control exists and the evidence does not.
Can clinical staff use personal devices?
Decide it explicitly and write it down, because silence is read as permission. Where personal devices are permitted, the practical approach is to keep data inside applications you control and off local storage, and to be honest that you cannot sanitise a device you do not own.
What records do assessors actually ask for?
Which device a named person held, whether it was encrypted, and what happened to it when they left. Three facts per device. Most organisations can answer the first, guess at the second and cannot evidence the third, which is where reviews concentrate.
How should devices be disposed of?
Sanitised to a recognised method with a verification step, evidenced per serial number, and recorded against the asset rather than deleted from it. For devices that held patient information the evidence requirement is the whole point, so a certificate listing a quantity does not help you.
Does agency and locum staff change this?
It makes it harder, because short engagements rarely fire the leaver triggers built for permanent staff. If somebody works three weeks and returns the device to nobody in particular, the gap is in your process rather than in their conduct. Name those populations in scope explicitly.
Where do most remote healthcare teams fall short?
Recovery. Encryption and access controls are usually adequate because they are configured once and apply everywhere. Getting a device back from somebody who has left, in a country where you have no office, is the step with no technical solution and it is where the evidence trail stops.
