# Standards and Regulatory References

## Primary Legislation

### HIPAA Security Rule — Mobile Device Provisions
- **45 CFR §164.310(b)**: Workstation use — policies for proper functions and physical surroundings of workstations (includes mobile devices as workstations per OCR guidance).
- **45 CFR §164.310(c)**: Workstation security — physical safeguards restricting access to authorized users.
- **45 CFR §164.310(d)**: Device and media controls — receipt, removal, disposal, and re-use of electronic media containing ePHI.
- **45 CFR §164.310(d)(2)(iii)**: Accountability — maintain record of movements of hardware and electronic media and any person responsible.
- **45 CFR §164.312(a)(1)**: Access control — technical policies and procedures for access to ePHI.
- **45 CFR §164.312(a)(2)(iii)**: Automatic logoff (addressable) — terminate electronic session after inactivity.
- **45 CFR §164.312(a)(2)(iv)**: Encryption and decryption (addressable) — encrypt ePHI on mobile devices.
- **45 CFR §164.312(d)**: Person or entity authentication — verify identity for mobile access.
- **45 CFR §164.312(e)(1)**: Transmission security — guard against unauthorized access to ePHI transmitted over wireless/cellular networks.

### HIPAA Privacy Rule
- **45 CFR §164.502(a)**: Permitted uses and disclosures — applies to all PHI regardless of the medium (paper, electronic, oral), including mobile.
- **45 CFR §164.530(c)**: Safeguards — covered entity must have appropriate administrative, technical, and physical safeguards to protect PHI, including on mobile devices.

### HIPAA Breach Notification Rule
- **45 CFR §164.402**: Definition of breach — acquisition, access, use, or disclosure of unsecured PHI in violation of the Privacy Rule. Unsecured = not encrypted per HHS guidance.
- **HHS Guidance on Securing ePHI (74 FR 42740, August 24, 2009)**: Encryption renders PHI unusable, unreadable, or indecipherable; encrypted devices are excluded from breach notification if encryption meets NIST standards.

### FTC Health Breach Notification Rule
- **16 CFR Part 318**: Applies to vendors of personal health records not covered by HIPAA. Expanded by FTC in May 2023 (88 FR 37819) to cover health apps and connected devices.
- **FTC Act §5**: Prohibition on unfair or deceptive acts — applies to health app privacy practices and representations.

## Regulatory Guidance

- **OCR Mobile Device Guidance (2012, updated)**: "Your Mobile Device and Health Information Privacy and Security" — guidance for healthcare providers on securing ePHI on mobile devices.
- **OCR Cybersecurity Newsletter — Mobile Devices (2017)**: Reinforces that Security Rule applies to ePHI on all electronic media including personal mobile devices used for work.
- **NIST SP 800-124 Rev. 2 (2023)**: Guidelines for Managing the Security of Mobile Devices in the Enterprise — comprehensive framework for mobile device security management.
- **NIST SP 800-111 (2007)**: Guide to Storage Encryption Technologies for End User Devices — encryption guidance applicable to mobile devices.

## Enforcement Actions

- **Lifespan Health System (2020, $1.04M)**: Unencrypted stolen laptop; systemic failure to encrypt mobile devices despite prior incidents and risk analysis findings.
- **Children's Medical Center of Dallas (2017, $3.2M)**: Unencrypted BlackBerry lost in 2009 and unencrypted laptop stolen in 2013; failure to implement encryption after risk analysis.
- **CardioNet (2017, $2.5M)**: Stolen unencrypted laptop; insufficient risk analysis for mobile devices and inadequate device/media controls.
- **Concentra Health Services (2014, $1.725M)**: Stolen unencrypted laptop; OCR found entity had previously identified lack of encryption as a risk but failed to remediate.

## FDA Guidance

- **FDA Policy for Device Software Functions and Mobile Medical Applications (2019)**: Describes FDA's approach to regulating mobile apps that meet the definition of a medical device.
- **FDA Software as a Medical Device (SaMD) Framework (2017)**: International Medical Device Regulators Forum (IMDRF) framework adopted by FDA for risk categorization of SaMD.

## ISO/IEC Standards

- **ISO/IEC 27001:2022 — A.8.1**: User endpoint devices — policies for securing mobile devices accessing organizational data.
- **ISO/IEC 27002:2022 — 8.1**: Implementation guidance on mobile device management including containerization, remote wipe, and encryption.