Your caregivers aren't sitting at desks in a secured office. They're in client homes, community centers, and transit—accessing schedules, documenting care, and clocking in from mobile devices.
That mobile-first reality is what makes home care work. It's also your biggest security vulnerability.
Why Mobile Devices Are the Primary Target
Simplify Your Home Care Operations
CareCade helps DDA and HCBS providers manage scheduling, EVV, and billing in one platform.
Security experts consistently identify mobile devices as the weakest link in home care security. Here's why:
Constant connectivity: Phones connect to home WiFi, coffee shop networks, and cellular—each with different security profiles.
Physical exposure: Devices travel everywhere caregivers go. They can be lost, stolen, or accessed by others.
Personal use mixing: Many agencies allow BYOD (bring your own device), meaning work data shares space with personal apps.
EVV data sensitivity: Every clock-in captures GPS coordinates and timestamps—location data that needs the same protection as medical records.
Authentication fatigue: Logging in repeatedly throughout the day leads caregivers to disable security features.
The Zero Trust Model for Home Care
The "Zero Trust" security model has become the gold standard for healthcare in 2026. The principle is simple: never trust, always verify.
In a home care context, this means:
- Every login attempt is verified, regardless of device or location
- Access is granted only to specific data needed for the current task
- Devices are continuously authenticated, not just at login
- Suspicious activity triggers additional verification
This isn't paranoia—it's recognition that threats can come from anywhere, including compromised devices that were previously trusted.
Essential Mobile Security Controls
1. Strong Authentication on Every Device
The absolute minimum:
- Biometric lock: Face ID, Touch ID, or fingerprint required to unlock
- No simple PINs: Four-digit codes can be shoulder-surfed or guessed
- Auto-lock timeout: Screen locks after 1-2 minutes of inactivity
- Failed attempt limits: Device wipes or locks after too many failed attempts
For accessing care management apps specifically:
- App-level authentication: Require login to the app, not just the device
- Passkey authentication: Eliminates phishing risk entirely
- Session timeouts: Automatic logout after inactivity periods
2. Encryption Everywhere
Data must be encrypted:
In transit: When moving between the caregiver's app and your servers (TLS 1.2+ minimum)
At rest: When stored on the device's local cache or your servers (AES-256)
On the device: Full-device encryption should be enabled (default on modern iOS and Android)
Why this matters: If a phone is lost and the device isn't encrypted, anyone who finds it can potentially extract data—even without knowing the passcode.
3. No Unencrypted PHI on Devices
Your care management app should be designed so that:
- Client PHI isn't stored in plain text on the device
- Cached data is encrypted or cleared regularly
- Screenshots of sensitive screens are blocked
- Copy/paste of PHI is restricted
If caregivers are texting client information, emailing care notes to themselves, or saving client data in personal apps—that's a breach waiting to happen.
4. Remote Wipe Capability
When a device is lost or stolen, you need to act immediately:
- Remote lock: Disable the device before it can be accessed
- Remote wipe: Erase all company data from the device
- Selective wipe: Remove work data while preserving personal content (important for BYOD)
Your care management system should have an admin console where you can revoke device access instantly.
5. Role-Based Access on Mobile
A caregiver's phone should only show:
- Clients they're assigned to see
- Schedules for their upcoming shifts
- Documentation for their visits
They shouldn't be able to browse all agency clients, access billing information, or view administrative functions. Mobile apps should enforce the same role-based access as desktop systems.
EVV Data Requires Special Attention
Electronic Visit Verification captures sensitive location data:
- GPS coordinates of clock-in/clock-out
- Timestamps of visits
- Client addresses
- Service verification details
This data must be handled with the same care as medical diagnoses. Agencies sometimes forget that location data is PHI when it identifies where a client with a specific condition lives.
EVV security requirements:
- GPS data transmitted over encrypted connections
- Coordinates not stored in plain text on devices
- Access to location history restricted to authorized roles
- Audit logging of who views visit location data
BYOD vs. Company-Issued Devices
BYOD (Bring Your Own Device)
Pros:
- Lower hardware costs
- Caregivers comfortable with their own devices
- No device management overhead
Cons:
- Limited control over device security
- Personal apps may create vulnerabilities
- Harder to enforce security policies
- Data separation challenges
If you allow BYOD:
- Require minimum OS versions (iOS 16+, Android 12+)
- Mandate biometric authentication
- Use mobile device management (MDM) for work apps
- Enable selective wipe capability
- Prohibit jailbroken/rooted devices
Company-Issued Devices
Pros:
- Full control over security configuration
- Consistent experience across all caregivers
- Clear separation of work and personal
- Easier compliance documentation
Cons:
- Hardware purchase and replacement costs
- Caregivers may carry two devices
- IT overhead for device management
If you issue devices:
- Pre-configure security settings
- Enable full device management
- Restrict app installations to approved list
- Implement automatic updates
Mobile Security Checklist
Device Configuration
- Biometric authentication required
- Auto-lock after 1-2 minutes
- Full-device encryption enabled
- Automatic OS updates enabled
- Find My Device / remote wipe enabled
App Security
- Care management app requires separate login
- Passkey or MFA enabled for app access
- Session timeout configured
- No PHI caching in plain text
- Screenshot blocking for sensitive screens
Network Security
- VPN required for accessing systems (optional but recommended)
- Public WiFi usage guidance provided
- Cellular data allowed for EVV submissions
Administrative Controls
- Remote wipe capability confirmed
- Offboarding procedure includes device wipe
- Device inventory maintained
- Lost device reporting procedure documented
Training Caregivers on Mobile Security
Security controls are only as good as the people using them. Train caregivers on:
Device security basics:
- Never share device passcodes
- Keep devices physically secure
- Report lost/stolen devices immediately
- Recognize phishing attempts
Safe practices in the field:
- Don't access client information on public WiFi without VPN
- Be aware of shoulder surfing in public places
- Lock device before setting it down, even briefly
- Don't leave devices visible in vehicles
What NOT to do:
- Don't text client information
- Don't email PHI to personal accounts
- Don't screenshot client records
- Don't save client data in personal apps
- Don't disable security features for convenience
Responding to Lost or Stolen Devices
Have a clear procedure:
- Immediate notification: Caregiver reports loss to supervisor
- Remote action: Admin locks/wipes device within 1 hour
- Access revocation: Disable the user's account access if device may be compromised
- Assessment: Determine what data may have been exposed
- Documentation: Record the incident and response
- Breach evaluation: Assess whether HIPAA breach notification is required
- Follow-up: New device setup with fresh credentials
The faster you act, the lower the risk. A device wiped within an hour of loss rarely becomes a breach. A device missing for days before anyone notices is a different story.
The Right Technology Makes This Easier
Choosing care management software with built-in mobile security reduces your burden:
Look for:
- Native mobile apps (not just mobile web)
- Biometric and passkey authentication support
- Automatic session management
- Encrypted local data storage
- Admin console for device management
- Role-based mobile access controls
- Audit logging of mobile access
Avoid:
- Systems that require disabling security features to work
- Apps that store unencrypted data locally
- Solutions without remote revocation capability
- Platforms that can't distinguish mobile from desktop access
Start Improving Today
You don't need to solve everything at once. Start with the highest-impact changes:
This week:
- Verify all caregivers have biometric device locks enabled
- Confirm your care management app requires authentication
- Test your remote wipe capability—make sure it actually works
This month:
- Review and update your mobile device policy
- Train staff on lost device reporting
- Enable passkey authentication for those who can use it
This quarter:
- Conduct a mobile security assessment
- Evaluate MDM solutions if using BYOD
- Update your risk analysis to include mobile-specific threats
Your caregivers' mobile devices are extensions of your office. Secure them accordingly.