BYOD Policies For Allied Health Practices

Priya runs a busy physiotherapy clinic in Melbourne. Her practitioners use the clinic software on their own laptops, reception staff sometimes text patients from work mobiles, and a contractor occasionally takes clinical photos on a personal phone so they can update treatment notes later.

It all feels practical until one phone goes missing after a home visit. Suddenly, Priya needs to know what patient information was on the device, whether she has to notify anyone, and whether her team had clear rules in the first place.

If you allow staff or contractors to use personal phones, tablets or laptops in your allied health practice, you need more than a casual understanding of good cybersecurity. You need a clear BYOD policy that tells your team what they can do, what they can't do, and what happens when something goes wrong.

Can Staff Use Personal Phones And Laptops In A Health Clinic?

Yes, you can allow staff to use personal devices in your clinic, but you need clear controls because health information is highly sensitive under Australian privacy law.

BYOD stands for bring your own device. In an allied health setting, that might include a team member using their own:

• mobile phone to contact patients or take clinical photos
• laptop to access your practice management software
• tablet to write treatment notes during appointments
• home computer to finish admin work after hours

The main issue isn't the device itself. The real risk is what the device can access, store, copy, screenshot, download or send.

For example, a personal phone might contain appointment reminders, patient names, screenshots of referral letters, messages about treatment plans, or photos of an injury. If that phone is lost, shared with a family member or backed up to a personal cloud account, your clinic may have a privacy and data security problem.

A well-drafted BYOD policy helps you keep the convenience of personal devices while setting boundaries that protect your patients and your business.

What Laws Apply To Patient Information On Personal Devices?

In most allied health practices, the Privacy Act 1988 and the Australian Privacy Principles will apply because you provide a health service and handle health information.

Many small businesses with annual turnover of $3 million or less are exempt from the Privacy Act. However, health service providers that hold health information are generally covered, even when they're small. This often includes physiotherapy, psychology, occupational therapy, speech pathology, podiatry, dietetics and similar allied health clinics.

Health information is also treated as sensitive information. That means you need to be especially careful about how you collect, use, store and disclose it.

Your BYOD rules should sit alongside your broader privacy and records obligations, including:

• Privacy Act 1988 and the Australian Privacy Principles, especially APP 11, which requires reasonable steps to protect personal information
• Notifiable Data Breaches scheme, which may require notification to the Office of the Australian Information Commissioner and affected individuals after an eligible data breach
• state and territory health records laws, such as the Health Records Act 2001 in Victoria and the Health Records and Information Privacy Act 2002 in New South Wales
• professional registration or accreditation requirements that apply to your practitioners, such as AHPRA obligations for registered health practitioners
• workplace surveillance and monitoring laws, which vary between states and territories

If you use My Health Record, secure messaging systems, NDIS portals or funder platforms, you may also have extra access and security requirements under those systems.

The practical point is simple: if patient information is accessible on a personal device, your clinic still needs to manage that information properly. You can't treat it as outside your responsibility just because the phone or laptop belongs to a team member.

What Should A BYOD Policy For A Clinic Cover?

Your BYOD policy should clearly say who can use personal devices, what they can access, how patient information must be protected, and what happens if the rules aren't followed.

Templates can be a useful starting point, but health clinics usually need tailored rules because treatment notes, patient photos, referrals and appointment data carry higher privacy risks than ordinary business information.

Who The Policy Applies To

Start by making it clear that the policy applies to everyone who may access your systems or patient information, including:

• employees
• contractors and consultants
• students, interns and volunteers
• practice managers and reception staff
• remote workers and practitioners doing home visits

Contractors are easy to miss, especially when they bring their own laptop and work across several clinics. Your policy should apply to them too, and your contractor agreement should back this up.

Which Devices Are Allowed

You can choose to allow some devices and prohibit others. For example, you might allow current iPhones and business-grade laptops, but not shared family computers or unsupported older devices.

Your policy can require personal devices to have:

• a strong passcode or biometric lock
• automatic screen locking after a short period of inactivity
• up-to-date operating systems and security updates
• anti-malware protection where suitable
• multi-factor authentication for clinic systems
• encryption, especially for laptops
• remote wipe or remote lock capability

You should also say that jailbroken or rooted devices can't be used for clinic work, as they can bypass security controls.

What Staff Can And Cannot Do

This is where your policy becomes useful day to day. You should be specific about whether staff can:

• save patient files to a device
• take screenshots of your practice management system
• download referral letters, reports or care plans
• use personal email to send patient information
• use SMS, WhatsApp, Messenger or other messaging apps for clinical discussions
• take photos or videos for treatment purposes
• access clinic systems while travelling or using public Wi-Fi

For most clinics, the safer rule is that patient information should stay inside approved clinic systems wherever possible. If there are exceptions, write them down and keep them narrow.

How Should You Handle Treatment Notes And Messaging Apps?

You should require treatment notes and clinical communications to be stored in your approved clinic systems, not scattered across personal apps, camera rolls or private inboxes.

This is one of the biggest practical issues with BYOD in healthcare. Staff often do what is fastest in the moment: take a photo, send a message, dictate a note or screenshot a document. The problem is that these habits can create unofficial patient records that your clinic can't properly manage.

Treatment Notes

Your policy should make it clear that treatment notes must be entered into the clinic's approved record system as soon as practicable. If a practitioner makes a temporary note on a personal device during a home visit, your policy should explain:

• when it must be transferred into the official record
• how the temporary note must be deleted
• whether screenshots or local downloads are allowed
• who checks that records are complete

For example, you might allow a mobile practitioner to draft a short note on a locked tablet during a home visit, but require them to upload it to the practice management system before the end of the day and delete any local copy.

Clinical Photos And Videos

Photos and videos can be very useful in allied health, especially for wound care, movement assessment, posture, mobility or progress tracking. They're also sensitive patient information.

Your BYOD policy should address:

• when clinical photos or videos can be taken
• whether patient consent is required, including through a consent form, and how it's recorded
• whether personal phone cameras are allowed
• where the image must be stored
• how quickly it must be deleted from the device's camera roll
• whether automatic cloud backup must be turned off

A practical rule might be: clinical photos can only be taken through the approved app connected to your patient record system. If that isn't available, photos must not be taken on personal devices unless a practice manager approves it and the image is uploaded and deleted promptly.

Messaging Apps

Messaging apps are convenient, but they can be risky for patient information. Group chats may include former contractors, messages can be forwarded, and files may sit in personal backups long after the appointment is over.

If your team needs to discuss patient care, set approved channels. This might be your practice management system, secure clinical messaging, or another tool you have assessed and configured properly.

Your policy should say that staff must not discuss identifiable patient information through unapproved personal messaging apps, unless you have a carefully controlled exception for a specific workflow.

What Happens If A Phone Or Laptop Is Lost?

If a device is lost or stolen, you need a fast reporting and response process so you can protect patient information and work out whether you have a notifiable data breach.

Your information security policy should require staff and contractors to report a lost device immediately, even if they think the device is locked or the risk is low. Waiting until the next business day can make it harder to contain the issue.

Your response process should include steps to:

1. record what happened, when it happened and whose device was involved
2. identify what clinic systems and patient information the device could access
3. remotely lock or wipe the device where possible
4. change passwords and revoke active sessions
5. remove the device from approved access lists
6. check whether any files were stored locally or synced to a personal cloud account
7. assess whether the incident is an eligible data breach under the Notifiable Data Breaches scheme
8. document your decision and any notifications made

Under the Notifiable Data Breaches scheme, you generally need to notify the Office of the Australian Information Commissioner and affected individuals if there has been unauthorised access, disclosure or loss of personal information that's likely to result in serious harm, and you can't prevent that harm with remedial action.

If you suspect an eligible data breach but need to investigate, you should carry out a reasonable and expeditious assessment. The Privacy Act expects that assessment to be completed within 30 days.

Because health information is sensitive, the threshold for serious harm can be easier to meet than with less sensitive business data. That doesn't mean every lost phone is automatically notifiable, but it does mean you should take the assessment seriously.

How Do You Manage Contractors And Shared Access?

You should give contractors and temporary staff individual, limited access to your systems, and remove that access as soon as their work with your clinic ends.

Shared logins are common in busy clinics, but they create real problems. If three practitioners use the same login, you may not know who accessed a record, who changed a note, or whether a former contractor still has access.

Your BYOD policy and contractor agreements should work together. For contractors, you should cover:

• confidentiality obligations for patient and clinic information
• privacy obligations and compliance with your policies
• approved systems and devices
• minimum security settings
• restrictions on copying, downloading or storing patient records
• what happens to information when the engagement ends
• your right to suspend or remove system access
• incident reporting obligations for lost devices, suspected unauthorised access or accidental disclosure

Access should be based on what the person needs for their role. A receptionist may need appointment and billing information, but not full treatment notes. A locum practitioner may need access to their own patients, not the entire database.

When someone leaves, your offboarding checklist should include:

• disable their user account
• remove their device from approved access
• recover clinic-owned devices, tokens or keys
• confirm deletion of any locally stored clinic information
• remove them from team chats and shared drives
• change shared passwords if any were used

If you require employees to use personal devices for work, check whether any modern award, enterprise agreement, employment contract or workplace policy creates reimbursement or device use obligations. Under the Fair Work Act 2009, you also need to be careful with deductions or arrangements that leave employees out of pocket in a way the law doesn't allow.

Can You Monitor Staff Devices?

Sometimes, but monitoring personal devices is sensitive and the rules depend on what you're monitoring, where your clinic is located and how clear you have been with your team.

You might want to use mobile device management software to enforce passcodes, remotely wipe work data, or check whether a device meets minimum security standards. These controls can be reasonable where they're limited to work data and clearly explained.

However, you should be cautious about monitoring personal messages, photos, browsing history or location data on a personal device. Your policy should draw a clear line between clinic information and the team member's personal information.

Workplace surveillance laws differ across Australia. New South Wales and the ACT have specific workplace surveillance laws that can require advance notice before certain types of computer, camera or tracking surveillance. Other states and territories also have privacy, listening device and surveillance device rules that may be relevant.

If your BYOD setup involves tracking, screenshots, keystroke monitoring, call recording or remote access to personal devices, get tailored advice before rolling it out. The safest approach is to use security tools that protect clinic data without unnecessarily intruding into personal use.

Common Mistakes To Avoid

The most common mistake is allowing personal devices because it's convenient, but not writing down the rules until after something goes wrong.

In allied health, a good BYOD setup usually avoids these issues:

• Using personal messaging apps for clinical discussions: This can make patient information hard to control, retrieve and delete.
• Letting staff save files locally: Downloaded reports, referrals and care plans can remain on devices long after they're needed.
• Forgetting cloud backups: Photos and documents may sync to personal iCloud, Google or other accounts without anyone realising.
• Using shared logins: You lose visibility over who accessed or changed patient records.
• Not training your team: A policy sitting in a folder won't help if staff don't know what it says.
• Missing contractor access: Contractors can create the same privacy risks as employees, especially if they work across multiple clinics.
• No lost device process: If your team doesn't know who to call, your response will be slower and messier.

Your BYOD policy doesn't need to be complicated. It just needs to match how your clinic actually works. If your practitioners do home visits, say how notes are handled on the road. If reception texts patients, say which platform is approved. If contractors use their own laptops, say what security standards apply.

You should also review your related documents and allied health service terms so they don't contradict each other. Your privacy policy, employment contracts, contractor agreements, acceptable use policy, data breach response plan and confidentiality clauses should all point in the same direction.

Key Takeaways

• Personal phones and laptops can be used in allied health clinics, but patient information needs strong privacy and cybersecurity controls.
• Most allied health practices are covered by the Privacy Act because they provide health services and handle health information.
• Your BYOD policy should cover approved devices, security settings, treatment notes, clinical photos, messaging apps, lost devices and offboarding.
• Keep patient information inside approved clinic systems wherever possible, rather than personal apps, camera rolls or inboxes.
• Contractors need clear access rules, confidentiality obligations and offboarding steps, just like employees.
• If a device is lost or stolen, act quickly to lock access, assess the risk and decide whether notification is required under the Notifiable Data Breaches scheme.

If you'd like help with your BYOD policy, privacy documents, contractor access terms and data breach response process, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.