Your RBTs have PHI on their personal phones

Ask an ABA clinic owner whether staff use personal phones for work and you will usually get a careful answer. Ask an RBT and you will get the real one: yes, constantly. Texting the parent that they are running ten minutes late. Photographing a completed data sheet because the app was down. A quick video of a target behavior to show the BCBA. Looking up the address for the next home visit in an email thread with the client’s name in the subject.

None of that is misconduct. It is people solving problems with the computer in their pocket. But every one of those acts puts protected health information on a device your clinic does not own, does not control, and cannot search, and HIPAA has opinions about that which do not depend on who paid for the phone.

The rule does not care who bought it

A workstation is an electronic computing device, for example a laptop or desktop computer, or any other device that performs similar functions, and the electronic media stored in its immediate environment (45 CFR 164.304). Nothing in that definition mentions ownership. A personal phone that accesses ePHI is a workstation, which means the workstation use and workstation security standards apply to it (45 CFR 164.310(b) and (c)), and so do the technical safeguards: access control, automatic logoff, encryption as an addressable decision, transmission security (45 CFR 164.312).

This is the fact that reframes the whole problem. You are not deciding whether to let staff use personal phones. You are deciding whether the workstations already in your clinic are governed or ungoverned.

Where it actually goes wrong

The camera roll. This is the one that should worry you most, because it is automatic and invisible. An RBT photographs a data sheet or a target behavior. The phone’s photo library syncs to a personal cloud account seconds later. The photo you took to help a child is now in a consumer cloud account you do not control, under terms you never read, with no BAA behind it. That cloud provider is maintaining PHI on your behalf, which makes it a business associate under 45 CFR 160.103, and it has never signed anything with you, which makes the disclosure impermissible. Nobody did anything malicious. The default settings did it.

Texting. A message to a parent about their child is PHI in transit, and PHI at rest afterward: on the RBT’s phone, on the parent’s phone, in the carrier’s systems, and in whatever backup either phone runs. Consumer messaging is a transmission security problem (45 CFR 164.312(e)) with no BAA anywhere in the chain, and the message outlives the conversation.

“The photo you took to help a child is now in a consumer cloud account you do not control, under terms you never read, with no BAA behind it.”

The departure. An RBT leaves for graduate school. Their phone leaves with them, and everything on it: the texts, the photos, the cached app data, the email. Your termination procedures (45 CFR 164.308(a)(3)(ii)(C)) can kill the login. They cannot reach into a phone you have no rights to. If you never had an agreement, you have no mechanism, and the data is simply gone into someone’s personal life.

The lock screen that is not encryption. Most staff assume a passcode secures the phone. A passcode plus modern default encryption often does, on current iPhones and Android devices with a passcode set. But “probably fine by default” is not a record, and an unencrypted device that goes missing is a very different day.

The three honest options

There are exactly three, and the fourth thing clinics do is not an option, it is a posture.

Option one: issue devices. Clinic-owned tablets or phones, enrolled in management, encrypted, configured, wiped and reassigned on departure. It costs money and it solves the problem cleanly, because everything in the physical safeguards assumes a device you can control. For a clinic of any size, the math is closer than owners expect once you price a single unencrypted-device breach at scale.

Option two: a real BYOD program. Personal devices are allowed, under conditions that are written, agreed to, and technically enforced:

• A signed BYOD agreement: what may and may not be done on a personal device, your right to require configuration, and your right to remotely remove clinic data on departure or loss.
• Mobile device management, or at minimum a managed container or work profile, so clinic data lives in a space you can wipe without touching someone’s family photos. This distinction is what makes BYOD survivable for both sides.
• Approved apps only for PHI: the data collection platform, the practice management app, a BAA-covered messaging tool. Never the camera app, never consumer messaging, never personal email.
• Camera roll rule, absolute: no clinical photos or video on the personal camera. If capture is needed, it happens inside an app that stores to a BAA-covered system, never to the device’s photo library.
• Device requirements: passcode, encryption verified, automatic lock, current OS, no shared family devices.
• Departure procedure that actually runs: remove the work profile, revoke the accounts, confirm removal, record the date.

Option three: forbid it, and mean it. A clean rule (no PHI on personal devices, ever, and here is the clinic phone you use instead) is legitimate and defensible, and it only works if the alternative is genuinely available at the moment of need. A ban with no provisioned alternative is a rule against physics, and it produces exactly what it produces: staff quietly doing the work anyway, on the device in their hand, with nobody willing to tell you.

Whichever you choose, write it down

Every specification in play here is addressable (workstation surroundings, encryption, automatic logoff), and addressable means you assessed it and decided. So the decision is the deliverable: which option you chose, why it is reasonable and appropriate for a clinic your size with your field model, what you implemented, and what you told staff. That document is not bureaucracy; it is the difference between a clinic that made a judgment and one that never looked.

And keep it alive, because this decision decays faster than any other on the site. New staff arrive every month with new phones and new habits. New tools appear (the notetaking app someone downloaded, the AI assistant with a microphone). The policy that was true in January describes a clinic that no longer exists unless someone is asking, at every hire and every tool adoption, the only question that matters: where does this data actually land, and did anyone agree to protect it?