SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-mobile-device-controls

How does the Security Rule treat phones that store ePHI?

They are subject to device and media controls and other safeguards.

Start playing free

  1. Mobile devices are exempt from HIPAA
  2. Treat phones storing ePHI under device and media controls ✔
  3. Only laptops are covered

Why: A smartphone that can access or store ePHI is an electronic device covered by the Security Rule, including device and media controls.

Huh, didn't know that: Lost or stolen phones should be reported as potential security incidents.

The dad joke
Why did the smartphone get a secure lock? To keep patient data from escaping at the coffee shop.
Like this card?
Play the game

References

Answer: Treat phones storing ePHI under device and media controls. A smartphone that can access or store ePHI is an electronic device covered by the Security Rule, including device and media controls.

  1. 45 CFR 164.310(d)(1) Device and media controls www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.310
    Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsWhat is electronic protected health information, or ePHI?Work SkillsWho must comply with the HIPAA Security Rule?Work SkillsWhat are administrative safeguards in the HIPAA Security Rule?

That's stuff everyone should know.