Mobile Device Management for Medical Practices: The Tablets Nobody Owns

/ Healthcare IT, Cybersecurity

Walk into most small medical practices and you will find tablets in the exam rooms. Staff use them all day. They hold a login to the EHR, they sit on the practice WiFi, and nobody can tell you how many there are. Mobile device management for medical practices is the part of the setup that almost never got done, usually because the tablets were bought one at a time out of the office supply budget and never treated as computers.

If a tablet walked out of your office tonight, could anyone wipe it? For most practices the honest answer is no, and nobody finds that out until the day it matters.

Why Mobile Device Management for Medical Practices Gets Skipped

Nobody decided to skip it. The iPads in exam rooms arrived the way office chairs arrive: one at a time, as needed, on somebody's card. A workstation gets set up by whoever handles IT. A tablet gets taken out of the box, handed to a nurse, and put to work in ten minutes.

So the practice ends up with a set of computers that hold patient data and were never enrolled in anything, never inventoried, and never patched on a schedule. They are not a security decision. They are a gap that formed quietly, and it is one of the most common things we find when we look at how a practice's IT is actually being handled.

What Unmanaged Actually Means, Day to Day

Unmanaged tablets are not a theoretical problem. They create specific, boring, recurring work that lands on your office manager.

Updates happen one device at a time, by hand. Someone walks around the office tapping Update on each tablet, or nobody does and they drift months behind. There is no way to see which ones are current without picking each one up. The same neglect shows up on the workstation side, where printers stop working after a Windows update and nobody knows why.
Nobody knows the real count. Ask how many tablets the practice owns and you usually get a number that turns out to be low. Devices get retired to a drawer, loaned out, taken home, replaced. An asset list that lives in someone's memory is not an asset list.
Personal and practice devices blur together. Somebody's own iPad ends up doing practice work because it was handy. Now patient data sits on a device the practice does not own and cannot touch.
Nothing enforces a passcode. On a managed device a passcode and an auto-lock are set centrally and cannot be turned off. On an unmanaged one it is up to whoever set the device up, on a busy morning, two years ago.

The Lost Tablet Problem

This is the one worth sitting with. A tablet leaves the building. It gets left in a car, taken home by someone who then leaves the job, or simply stops turning up. It has an EHR session on it and it is on your network.

On a managed device, that is a bad afternoon. You mark it lost, it locks, you push a remote wipe, and you have a record showing when. On an unmanaged one there is no console to open. The realistic options are calling the person and hoping, or changing credentials across the practice and hoping that was enough.

The difference between those two afternoons is not the tablet. It is whether anyone enrolled it before it went missing, and that decision gets made months earlier by somebody who was not thinking about lost tablets at all.

Where This Touches HIPAA, Briefly

A tablet with access to patient data is covered the same way a workstation is. The Security Rule expects you to know where patient data lives and to control access to it, and a device nobody has inventoried fails the first half of that before you get to the second.

We are not going to turn this into a compliance post. If you want the current state of the rules and what is actually enforceable today, that is covered in our 2026 HIPAA Security Rule explainer, and the practical side of access controls is in what small practices should do about MFA and encryption. The operational case for managing tablets stands on its own without any of it.

What to Do About It Without Replacing Anything

Start with a count. Physically walk the office and write down every tablet, who uses it, whether the practice bought it, and what it can reach. That takes an hour and it is the whole foundation. Most of the surprises show up here.

Then enroll them. Devices already in daily use can be brought under management without wiping them, which is the version to start with because it costs nobody any downtime. It gets you a single console showing every device, its update state, and an enforced passcode, and it kills the walk-around-and-tap-Update routine immediately.

Full remote wipe on a lost device needs a deeper level of enrollment, and on Apple hardware that generally means the device has to be set up fresh. That is real disruption, so it is worth doing deliberately: new tablets get set up that way from the box, and existing ones get converted when they are due for a reset anyway. Anyone telling you it is a five minute change is not telling you about the reset.

If you want a straight read on where your practice stands before anyone sells you anything, the PracticeReady assessment takes about ten minutes and gives you a prioritized list. Or take fifteen minutes and I will tell you what I would actually look at first.

Medical practice IT support Long Island. Serving small practices across Nassau and Suffolk County.