In the first hour: have the staff member try to locate or lock the phone, remove their user from the work chat and every other work app, change their passwords, and write down the time of each step. Then do a short risk assessment. If the phone was locked, the chat app locks on its own, and the account was removed quickly, the chance that patient information was actually seen is usually low. Document that conclusion either way.
Why this is the most common incident in small practices
Small practices run on personal phones. Staff open work chat on the same device they use for everything else, which HIPAA allows with reasonable safeguards. The result is that the most likely security incident is not a hacker. It is a phone left in a taxi, a gym locker or a patient's bathroom. How you handle the next sixty minutes decides whether it is a paperwork exercise or a reportable breach.
Two terms first. Protected health information (PHI) is any information that identifies a patient and relates to their health or care. A Business Associate Agreement (BAA) is the contract in which a vendor, like your chat provider, promises to protect PHI the way HIPAA requires. The BAA matters here because a BAA-covered tool gives you the admin controls you are about to use.
The first-hour checklist
- Minute 0: the staff member tells the office manager or owner the moment they notice. Any hour, any day. Calling in is never punished.
- Minute 0 to 5: the staff member uses their phone's find-my-device feature to locate, lock or erase the phone. If a lock is possible, do it now; a remote erase can wait a few minutes while you confirm it is really gone.
- Minute 5 to 10: an admin removes the staff member's user from the work chat workspace. In Yodl, a workspace admin does this from the admin panel; once the user is gone, the phone cannot open anything. Do the same in the EHR, email and any other work app.
- Minute 10 to 20: the staff member changes the passwords on their work accounts and their personal email from another device.
- Minute 20 to 30: check the chat tool's audit log for activity from that account after the phone went missing. Export it.
- Minute 30 to 60: write down what was on the phone, whether it was locked, what time it was lost, what time each step above happened, and who did it. This is the start of your risk assessment.
The risk assessment: four questions
HIPAA's Breach Notification Rule asks you to assess whether PHI was probably compromised. The assessment has four factors, and you answer each in writing:
| Factor | What to write down |
|---|---|
| What PHI was involved | What the chat and other apps on the phone could show: names, chart numbers, clinical detail, photos |
| Who could have it | Unknown finder, a known person, or nobody (phone found or confirmed erased) |
| Was PHI actually viewed | Phone locked with a passcode? App locked by inactivity? Audit log shows no activity after the loss? |
| How much the risk was reduced | Remote lock or erase, user removed within X minutes, passwords changed |
If the honest answers show a low probability that PHI was compromised, you document that conclusion and keep the record with your HIPAA documentation. If you cannot say that, the Breach Notification Rule requires you to notify the affected patients and HHS without unreasonable delay, and no later than 60 days after discovery. Talk to a healthcare attorney before you decide either way; the point of the first hour is to give them good facts.
When it probably is not a breach, and when it probably is
Probably not a breach: the phone had a passcode, the chat app was locked or signed out, the user was removed within the hour, the audit log shows nothing, and the phone was later found or erased. Each of those facts lowers the probability, and together they usually settle it.
Probably a breach: no passcode, the chat app stays open indefinitely, PHI was in screenshots or photos on the phone itself, the loss was reported a week late, or the audit log shows activity after the loss. Any one of those makes the low-probability conclusion hard to defend.
The setup that makes the first hour easy
- A passcode or Face ID on every phone that opens work chat. Put it in the policy and check it at onboarding.
- A chat app that locks on its own. Yodl locks after 15 minutes of inactivity and supports passkeys (Face ID or Touch ID).
- Notifications without message content on the lock screen, so a found phone shows nothing.
- A web app rather than a local copy of the history: messages stay on the server, and the phone only displays them while signed in.
- Invite-only membership and an admin who can remove a user in seconds.
- An audit log you can read and export, so you can prove what did not happen.
- A one-line rule: no screenshots or clinical photos in the camera roll.
What to tell the staff member
Say thank you for reporting it fast, because that is the behavior you need next time. Walk through the checklist with them rather than at them. If the phone turns up, sign them back in, and make sure they sign in with the passkey from then on. If it does not, help them set up the new phone with the same rules. Blame produces late reports; late reports produce breaches.
After the dust settles
- File the written timeline and the four-factor assessment with your HIPAA documents.
- Add the incident to your incident log, even if you concluded it was not a breach.
- Check every other phone for a passcode and app lock.
- Fix whatever made it harder than it should have been: a missing admin, no audit export, a policy nobody had read.
If you want a chat tool where removing a user and exporting the audit log are both in the admin panel, Yodl is $10 a month for 5 people with a signed BAA, on the pricing page.
Report, lock, remove the user, change passwords, document the times, then answer the four factors in writing. With a passcode and a self-locking app, most lost phones end as a filed note rather than a breach.
Frequently asked questions
Is a lost phone automatically a HIPAA breach?
No. It is a security incident that requires a risk assessment. If the assessment shows a low probability that PHI was compromised, and you document it, it is not a reportable breach.
Do we have to tell patients?
Only if the assessment cannot show a low probability of compromise. Then the Breach Notification Rule requires notice to affected patients and to HHS. Involve an attorney.
What if the staff member finds the phone the next day?
Keep the record anyway. Note when it was found, whether it was still locked, and whether anything changed. Sign them back in with a passkey.
Should we require remote wipe on personal phones?
Require the find-my-device feature to be turned on and the staff member to use it. A forced wipe policy on personal phones is harder to enforce; a strong app lock and fast user removal do most of the work.
Does this apply if the app was only a browser tab?
Yes. A signed-in browser tab can show PHI until the session locks or the user is removed. That is why the inactivity lock and the removal step matter.