What should I do when I replace my handset and need to recheck work settings?

A new phone can look ready for work before it is actually safe to use for work. Email may have signed in automatically, old notification settings may have returned, and apps may be asking for access to contacts, photos, or location. A familiar screen is not proof that your work setup has carried over correctly.

Use a new device review to check the basics before you open, store, or send patient or organizational information. Start with your employer’s bring-your-own-device (BYOD) and device policies. Then confirm that you are using approved systems, review every work account, and test what appears on the lock screen.

This is a practical check, not a substitute for local policy or your organization’s security team. The Information Commissioner’s Office (ICO) provides guidance on working securely and working from home securely. Its guidance is useful context for protecting personal data, but your employer’s approved setup and instructions should determine what you install and how you use it.

Start with your employer’s device policy

Before transferring work data or signing in, check whether your organization allows work access from the new handset. A device that is technically capable of running work apps may still be unapproved. Your employer may require a managed device, a particular operating system version, device-management software, or specific security settings.

Look for the current BYOD policy, mobile-device policy, remote-working guidance, and any instructions from your IT or information-governance team. If you cannot find them, ask your manager or service desk before using the phone for work. Do not treat a previous phone’s setup as proof that the new one is permitted.

Confirm what “approved” means in your organization

• Is this handset model and operating-system version allowed?
• Must the phone be enrolled in mobile device management (MDM) or another work-management service?
• Which apps and sign-in methods are approved for email, messaging, documents, and remote access?
• Are there restrictions on using personal backups, shared devices, or biometric unlock?
• What should you do if the device is lost, stolen, or no longer supported?

Do not bypass a management prompt, use an unapproved app because it is convenient, or copy work information into a personal account to get around a setup problem. If the organization does not support work access on the handset, use an approved alternative.

Keep patient and organizational data in approved systems

Use only the systems your employer has approved for the information involved. That may include an organization-managed email account, clinical application, secure messaging service, or managed document platform. The important point is that patient and organizational data should remain within systems selected and configured by your organization.

A personal cloud account, consumer messaging app, photo library, notes app, or backup service is not a safe workaround just because it is already on the phone. Avoid copying work content into these services. Also avoid saving screenshots or documents to a personal gallery or downloading files to a general-purpose folder unless your policy explicitly permits it.

Folders and labels can help you organize information, but obgynkey they do not provide security by themselves. A folder called “Work” does not prevent a personal app from syncing its contents, and a separate home screen does not make an account or file store work-approved. Rely on the controls and systems your organization has authorized.

Check app permissions and data sharing

During setup, apps may request access to contacts, photos, files, location, microphone, or nearby devices. A permission prompt is not a reason to grant access automatically. Follow your employer’s instructions and grant only what is needed for an approved work function. If a work app appears to need broad access or behaves differently from the instructions, ask IT rather than guessing.

Review system settings that can expose information outside the work app, including automatic cloud backups, cross-device synchronization, and sharing suggestions. Your organization may configure these through device management. Do not change managed settings without approval; ask the service desk if a setting appears inconsistent with policy.

Complete an account sign in audit

Moving to a new handset is a good moment to do an account sign in audit. The aim is to identify which work accounts are active, confirm that each is legitimate, and remove access from the old handset when appropriate. Do this through your organization’s normal account and device-management tools.

1. List the work services you need. Include email, clinical systems, secure messaging, calendars, and document services. Compare the list with your employer’s approved-app guidance.
2. Use the official sign-in route. Install apps from the approved source and sign in through your organization’s usual authentication process. Do not follow a sign-in link from an unexpected text or email.
3. Check the account shown in each app. Confirm that work apps use your work identity, not a personal account with a similar name or saved password.
4. Review active sessions and registered devices. If your organization provides an account-security page or device portal, check that the new handset is listed correctly and identify any old or unfamiliar sessions.
5. Complete multifactor authentication as instructed. Keep authentication methods current, but do not approve a sign-in request you did not initiate.
6. Remove the old handset through approved controls. Follow IT’s process for removing the device, signing out, or arranging a managed wipe. Do not assume deleting an app removes the organization’s access or data from the old phone.

If you see an unfamiliar device, cannot remove the old one, or receive unexpected authentication prompts, contact your service desk or security team promptly. Do not share a password or one-time code with someone who contacts you unexpectedly, even if they claim to be helping with the transfer.

Separate entertainment from clinical work

A personal handset often contains streaming apps, games, shopping accounts, social media, and work tools side by side. The goal is not to pretend that separate screens or folders create a security boundary. The goal is to keep work activity within approved apps and reduce accidental mixing.

• Open patient and organizational information only in approved work systems.
• Do not paste work details into a personal messaging thread, personal email, or consumer notes app.
• Check the destination before sharing a file or link. Similar-looking icons and adjacent share-menu options make wrong taps easy.
• Before sending, verify the recipient and the content, especially when autocomplete suggests a name or group.
• Keep entertainment apps from displaying sensitive work content in their notifications or widgets.
• Use any work profile or managed container only as your organization directs; do not assume it replaces the need to follow policy.

If you use the phone in a shared space, consider whether people nearby can see the screen. Lock it when you put it down, and avoid opening identifiable information where it can be overlooked. These are practical safeguards alongside, not substitutes for, your organization’s technical controls.

Make notification reset part of setup

A notification reset is one of the most important checks after a handset replacement. New phones may restore app preferences from a backup, or default to showing message text on the lock screen. A notification can reveal a patient name, appointment detail, or organizational information even when the app itself is protected.

Review lock screen previews and notification privacy

1. Open the phone’s notification and lock-screen settings.
2. Find the option that controls previews or sensitive content on the lock screen.
3. Set previews so message content is hidden while the phone is locked, if that matches your organization’s policy and the phone’s available controls.
4. Check work apps individually. Some phones let each app show or hide content separately.
5. Review banners, notification history, widgets, and voice-assistant or wearable-device displays if they can show work notifications.

Then test the setting on the actual lock screen. Lock the phone and trigger a harmless test notification, such as a message from a trusted colleague that contains no patient information. Check what a person looking at the screen would see. If text or identifying details remain visible, change the setting and test again. Do not use a real patient message as your test.

Some phones distinguish between hiding previews when locked and hiding them all the time. Choose a setup that meets your employer’s requirements and still works for your role. If your organization has a specific configuration, follow it rather than relying on a general recommendation.

Use the ICO guidance as a practical reference

The ICO’s UK GDPR guidance explains the importance of protecting personal data and using appropriate security measures. Its working securely guidance and working from home securely guidance are useful starting points for thinking about devices, access, and remote work.

These resources do not replace your employer’s local policy, risk assessment, or technical instructions. In a clinical setting, follow the organization’s rules for patient information, approved devices, and incident reporting. If guidance seems to conflict, ask your information-governance lead or IT team to clarify the correct local process.

New device review checklist

Check What to confirm What to do if it is not right Policy and approval The handset and operating system meet employer requirements. Pause work setup and ask your manager or service desk. Approved systems Work data is accessed through approved apps and accounts. Do not move data to a personal app or account; get advice. Account sign in audit Work accounts and registered devices are recognized and current. Report unfamiliar access or unexpected authentication prompts. Notification reset Lock-screen previews do not expose sensitive work information. Change the setting and test again on the real lock screen. Old handset Work access is removed using the approved offboarding process. Contact IT; do not assume deleting an app is enough.

If something has already gone wrong

If work information has reached a personal app, an unintended recipient, or an unapproved account, stop further sharing and follow your employer’s incident-reporting process immediately. Do not try to conceal the issue by deleting messages or files before seeking advice; your organization may need the details to assess and manage the incident.

Likewise, report a lost handset, suspicious sign-in, or unexpected disclosure promptly through the channel your employer specifies. Fast reporting gives the organization a chance to revoke access or take other appropriate action.

A short routine for future replacements

Before using a replacement handset for work, check policy, install only approved tools, sign in through official routes, review registered devices, and remove the old handset through the proper process. Keep clinical activity in approved systems, separate it from entertainment use in your daily habits, and complete a notification reset that you test on the actual lock screen.

That routine takes a few minutes, but it catches the common problems that are easy to miss during a rushed transfer. When a setting or app is unclear, pause and ask your organization rather than improvising with patient or organizational data.