HIPAA was written in an era of locked filing cabinets and desktop terminals, but nothing in it chains PHI to an office. The Security Rule’s standard is “reasonable and appropriate safeguards,” and that standard travels — to kitchen tables, coworking spaces, and the spare bedroom a therapist now uses for telehealth. What changed with remote and hybrid work isn’t the rules; it’s the attack surface and the audit questions. This guide covers how to run a distributed team that handles PHI, and how to document it so the program survives contact with an OCR investigator or a customer’s security review.
The compliance problem remote work actually creates
In an office, a lot of HIPAA compliance is ambient. The network is managed, the doors lock, screens face inward, shredding bins exist, and IT can walk over to a misbehaving machine. Remote work strips all of that away and replaces it with hundreds of environments you’ve never seen: consumer routers with default passwords, family iPads, roommates within earshot of patient calls, and printers that hold copies of everything.
None of those environments is inherently non-compliant. The regulatory question — the one an investigator will ask after a breach involving a remote worker — is whether your risk analysis considered remote access and remote environments, and whether your safeguards and policies addressed what it found. “We went remote in 2020 and never updated the risk analysis” is one of the most common and most avoidable findings. Start there: if your current risk analysis doesn’t have a section on remote access, telework, and personally owned devices, it’s out of date by definition.
Devices: the single biggest decision
Everything downstream gets easier or harder based on one choice: corporate-managed devices versus BYOD.
The managed-device path (recommended where budget allows)
Issue laptops you control. That gives you, enforceably rather than hopefully:
- Full-disk encryption, verified centrally. This is the control that turns a stolen laptop from a reportable breach into a police report. Encryption consistent with HHS guidance means lost hardware generally isn’t “unsecured PHI” — the difference between a bad afternoon and a 60-day notification project, as we detail in the breach response guide.
- Automatic screen lock after a short idle period, with authentication to resume.
- Patch management and endpoint protection that don’t depend on the user clicking “remind me later” forever.
- Remote wipe for lost or stolen hardware, and clean recovery of equipment at offboarding.
BYOD, if you must
Plenty of organizations allow personal phones for email or an authenticator, and some allow more. BYOD can be compliant, but only with teeth:
- Mobile device management (MDM) or at minimum app-level protection that enforces encryption, passcode, and remote wipe of the work container.
- An approved-apps rule: PHI lives only in sanctioned applications, never in personal texting apps, personal email, or unapproved note-taking tools. Consumer SMS is not an approved PHI channel.
- A signed BYOD agreement acknowledging the controls, the wipe capability, and the employee’s obligations. Signature on file, dated, retained — this is evidence.
- A hard line somewhere: many organizations allow BYOD phones for messaging and MFA but require managed laptops for any real PHI work. That split is reasonable and defensible.
The indefensible position is the silent middle: BYOD happening in practice with no policy, no controls, and no signatures. That’s the version that shows up in breach investigations.
Home networks and connectivity
You can’t manage employees’ routers, and you don’t need to. You need to make the home network not matter:
- Encrypt everything in transit. VPN or zero-trust access to internal systems, TLS everywhere, no exceptions for “internal” tools. If the connection is encrypted end to end, a mediocre home network is an inconvenience, not an exposure.
- Require MFA on every PHI-touching system, without exception. Credential theft is the front door of healthcare breaches, and remote workers’ credentials are phished at the same rate as everyone else’s — a reason phishing drills belong in your training program.
- Set baseline expectations in policy: home Wi-Fi must use WPA2/WPA3 with a non-default password; work must not run through the neighbor’s open network. You won’t inspect this, but stating it makes expectations enforceable.
- Public Wi-Fi rule: allowed only through the VPN, or use the phone’s hotspot. Simple, memorable, trainable.
- Smart speakers and assistants: voice assistants in the workspace should be muted or removed during PHI conversations. It sounds paranoid until the first time a device lights up mid-session.
The physical side nobody thinks about
The Security Rule’s physical safeguards and the Privacy Rule’s “reasonable safeguards” against incidental disclosure apply at home too. The workable rules:
- Screens: position displays so household members and video-call backgrounds can’t read them; lock the screen every time the chair is left, even at home. Privacy filters for anyone working in shared or public spaces.
- Conversations: PHI phone calls happen where they can’t be overheard — behind a door, not in the household’s open kitchen. Headphones for the inbound audio.
- Paper: the best home-printing policy is “don’t.” If printing PHI at home is genuinely necessary for a role, require a locking drawer and a cross-cut shredder, and say so in the policy. Untracked paper in home offices is unfindable during breach response and unrecoverable at offboarding.
- Household members: family are not workforce members. They don’t get to use the work laptop for homework, and they shouldn’t have the login. State it explicitly; it’s the most commonly broken unwritten rule in remote work.
Telehealth spaces deserve their own paragraph in your policy
For clinicians delivering care remotely, the “facility” is wherever the session happens, and patients can see it. Requirements worth writing down:
- A private, interruption-controlled room — door closed, household informed, sessions never conducted in shared spaces or cars in motion.
- A HIPAA-appropriate platform with encryption and, critically, a signed business associate agreement. The pandemic-era enforcement discretion for everyday video apps ended; the BAA requirement is fully back. Consumer video products without BAAs are off the table.
- Verify the patient’s context too — confirm identity at session start and ask whether they’re in a private place, especially for sensitive visits.
- No local recordings unless a specific, policy-governed reason exists, with storage in approved systems only.
The policy set that survives an audit
When an OCR investigator or an enterprise customer’s security team reviews a distributed organization, they ask for documents. The remote-work layer of your documentation should include:
- Remote work / telework policy — who may work remotely, from where, under what conditions, covering workspace privacy, screen lock, paper handling, and household access.
- BYOD policy with signed acknowledgments — or a statement that personal devices are prohibited, which is also a policy.
- Acceptable use and approved-channels policy — where PHI may live and travel, named tools, explicit prohibitions on personal email and consumer messaging for PHI.
- Access control and MFA policy — remote access architecture, VPN/zero-trust requirements, session timeout standards.
- Sanction policy — what happens when the rules are broken, applied consistently.
- Updated risk analysis — with remote access, telework, and mobile devices explicitly assessed.
Every one of these exists as a starting draft in our template library; the work is tailoring them to what your team actually does and getting real signatures. A beautiful policy nobody attested to is half a control. Note the word “survive” in this section’s promise: auditors don’t just read policies, they sample evidence. Expect requests like “show me the MDM enrollment list against your employee roster” and “show me this terminated employee’s access removal date.” Policies plus matching evidence is the whole game — the same pattern we describe in preparing for an OCR audit.
Offboarding: the remote-work failure mode
In an office, a departing employee hands over a badge and a laptop at a desk. Remotely, offboarding is where distributed organizations bleed:
- Same-day access termination across every system — identity provider, EHR, email, file shares, and the long tail of SaaS tools someone signed up for with a work email. An access inventory makes this possible; without one, you’re guessing.
- Hardware recovery with tracking — prepaid return labels, a deadline, and remote wipe if the deadline passes.
- BYOD wipe of work data, executed and logged.
- Attestation that no PHI remains in personal storage, downloads, or paper.
Terminated-but-active accounts are a staple of breach reports. A quarterly access review — comparing active accounts against the current roster — catches what offboarding missed and produces exactly the kind of periodic evidence auditors love.
A realistic rollout for a small team
You don’t need an enterprise security stack to do this well. A 90-day sequence for a small covered entity or health tech company:
- Weeks 1–2: Update the risk analysis for remote work. Inventory every device and every app touching PHI. You’ll find surprises; that’s the point.
- Weeks 3–5: Close the technical basics — verified disk encryption everywhere, MFA on everything, screen-lock policies pushed, VPN or equivalent for internal access.
- Weeks 6–8: Adopt the policy set above, tailored. Collect signed acknowledgments from every remote worker.
- Weeks 9–10: Train on the remote-specific behaviors — workspace setup, approved channels, telehealth room standards, incident reporting from home. Role-based, short, concrete.
- Weeks 11–13: Run the first access review, test remote wipe on a spare device, tabletop a “remote worker’s laptop stolen from a car” scenario, and file the evidence.
After that it’s maintenance: reviews quarterly, training on cadence, risk analysis refreshed when the environment changes.
The bottom line
Remote work doesn’t weaken HIPAA compliance; unmanaged remote work does. The organizations that get this right make the secure path the easy path — managed or contained devices, encrypted connections, approved tools that people actually like using — and then keep the paper trail that proves it. If you want to know how your current remote setup scores before someone else measures it for you, take the free HIPAA readiness assessment, or book a 20-minute call and walk through your device and policy gaps with a practitioner. Our workforce training service also runs the remote-specific modules if you’d rather not build them yourself.