Lost Phone Exposes Offline Patient Data
Harbor Health's nurse scheduling app stores patient name, date of birth, appointment reason, and address in local entities for offline visits. Nurses sign in with a 4-digit PIN kept in a Client Variable; the app auto-locks after 15 minutes. A phone was lost in a parking lot. Security review found the local database is readable on a rooted device and included in device backups; logout clears Session Variables but leaves local entities and a 24-hour REST response cache intact. The app runs on 600 nurse phones, some shared clinic tablets, Android and iOS. Compliance requires no PHI after logout and protection at rest. Nurses still need today's visits offline. The team proposes lengthening the PIN to 6 digits and calling it done. The app also caches full appointment responses, including notes, in local storage.
1. Assess the team's proposal and identify the actual gaps against the compliance requirement.
Read the worked answer
A 6-digit PIN is still a weak local secret, and it does not encrypt anything. The local database remains readable on a rooted device, and backups still contain PHI. The PIN change improves brute-force resistance slightly but does not address data at rest, backup exposure, or logout residue.
The gaps are concrete. First, local entities holding name, DOB, appointment reason, and address are not encrypted by the app. Second, logout clears Session Variables but not local entities, local storage, or the REST response cache. Third, the 24-hour cache stores full appointment notes, which is more PHI than the offline requirement needs. Fourth, auto-lock is a UI state; it does not wipe or re-protect data. Fifth, device backups can copy the local database off the device.
So the proposal is insufficient. The fix must combine data minimization, encryption or secure key storage, and a logout that actually removes PHI. PIN length can be part of authentication, but it is not the control that satisfies 'no PHI after logout' or 'protected at rest'.
2. Design logout and at-rest protection so compliance can be demonstrated on both Android and iOS.
Read the worked answer
Minimize first. Store only today's visit fields needed offline, and drop appointment notes from the cache. Replace the full REST response cache with a short-lived, field-limited projection. Data you never store cannot leak.
For data at rest, do not rely on Client Variables or plain local storage. Use the platform secure store (Keychain on iOS, Keystore-backed storage on Android) through a plugin to hold an encryption key or token, and encrypt sensitive attributes before writing them to local entities. If the platform provides file or database encryption, verify it covers the app's local database and excludes it from backups. Set the backup exclusion flag where the platform allows it.
Logout must be a wipe, not a screen reset. Delete all local entities containing PHI, clear local storage and the REST cache, remove the secure-store key, cancel pending sync, and revoke the session token server-side. Verify by inspecting the device database after logout on a rooted test device. Auto-lock should re-authenticate and, for shared devices, trigger the same wipe when a different user signs in.
3. How should shared clinic tablets be handled differently from personally assigned nurse phones?
Read the worked answer
Shared tablets should not persist PHI between users by default. On a shared device, treat offline data as belonging to a session and a user, not to the device. At minimum, wipe local PHI on sign-out and after a short idle timeout, and require re-authentication and a fresh sync before the next nurse can see visits. If the clinic has reliable connectivity, consider online-only mode for shared tablets, with a clearly labeled degraded mode when offline.
For personally assigned phones, encryption plus a device-level or app-level unlock can be acceptable, but logout and remote wipe still matter. The lost-phone scenario is exactly where remote revocation and local wipe on next launch or push should be designed in, even if the device never comes back online.
Separate the policies by role and device registration. A tablet that is not assigned to a single nurse should not receive the full offline cache. Test the switch-user path, the idle-lock path, and the remote-wipe path on both platforms. Also make sure the REST cache and any downloaded files follow the same wipe rule, because those are the places PHI usually survives.