By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: MDM (Mobile Device Management)
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
The HIMSS Dictionary describes mobile device management (MDM) as software used to deploy, secure, monitor, integrate, and manage smartphones, laptops, tablets, and other mobile devices in the workplace. Its purpose is to make the devices as useful and secure as possible while protecting the organization’s network.
NIST’s Special Publication 800-124 Revision 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise (May 2023), gives the context. The publication notes that mobile devices began as personal consumer communication devices but are now permanent fixtures in enterprises, used to reach modern networks and systems and to process sensitive data. It describes technologies and strategies for managing and securing them, explores the security concerns that come with mobile use, and gives recommendations for deployment, use, and disposal across the device life cycle. Its scope covers mobile devices, centralized device management, and endpoint protection, for both organization-provided and personally owned devices.
In a hospital, MDM typically handles enrolling a device, applying security settings such as a passcode and encryption, pushing approved apps, separating work data from personal data, locating or wiping a lost device, and retiring a device at end of life. It also supports shared devices that move from one nurse to another each shift. MDM does not replace other controls such as network segmentation, authentication, or user training.
| MDM Function | Purpose | Example |
|---|---|---|
| Enrollment | Register the device with the organization | Nurse phone set up with work profile |
| Policy enforcement | Apply required security settings | Passcode and encryption |
| App management | Control which apps are installed | Approved EHR and messaging apps |
| Separation of data | Keep work and personal data apart | Work container on a personal phone |
| Remote lock or wipe | Protect data on lost devices | Wipe after theft |
| Lifecycle management | Retire devices safely | Reset and remove from inventory |
⚠️ Exam Alert: Mobile device management (MDM) is software that deploys, secures, monitors, and manages mobile devices in the workplace. It supports both organization-owned and personally owned (BYOD) devices. MDM enforces policy and can lock or wipe a device, but it does not by itself provide authentication, network security, or user training. Do not confuse MDM with master data management, which uses the same acronym in a different context.
🌐 Why It Matters: Real-World Healthcare IT Context
Mobile devices have moved from convenience to core clinical equipment. The studies below show how they are used and how organizations manage the risk.
A 2025 survey in Advances in Health Information Science and Practice by Gellert and colleagues gathered perceptions from 204 respondents at US health care delivery organizations. Almost half (47.5 percent) said mobile devices were more efficient than workstations for clinical work. Most (61.7 percent) deployed 500 or fewer devices, and 33.7 percent said clinicians accessed 5 to 14 applications per shift. Clinical communications (69.2 percent) and the EHR (66.7 percent) were the most used applications. About two-thirds estimated applications were opened more than 10 times per shift, and half reported that a lost device delays patient care. The authors note that security measures can impede usability and adoption, and that shared devices are hard to manage as they pass between users. Responses came from organizations’ representatives, so they show perceptions and not measured performance.
Bring-your-own-device policies add a human layer. A 2025 study in JMIR Human Factors by Wani and colleagues developed and piloted a maturity model for BYOD security in hospitals using mixed methods action research. Surveys and interviews with IT managers and clinicians shaped a model with three dimensions, technology, policy, and people, each with five maturity levels. It started with 22 domains and, after feedback at a public metropolitan hospital in Victoria, Australia, ended with 21. The authors argue that existing frameworks are often technology-centered and overlook clinician behavior, workflow, and culture.
Adoption is not only about rules. A 2025 cross-sectional study in PLoS One by Alipour and colleagues surveyed 620 healthcare workers in five teaching hospitals in southeastern Iran. Perceived usefulness, ease of use, cost-effectiveness, trust, and facilitating conditions were each positively correlated with intention to adopt a BYOD policy, and overall intention was partial. The authors point to secure access and device support as factors that could raise acceptance. The data reflect one region’s teaching hospitals.
Guidance for clinicians is thin. A 2024 scoping review in Frontiers in Digital Health by John and colleagues examined guidance in the UK and Ireland on clinical communications using personal devices, instant messaging, and third-party apps. They found 18 papers that recognized the importance of secure communication but gave little information on choosing or configuring the technologies, and most emphasized general data protection standards rather than clear, actionable recommendations. The authors call for guidelines that specify secure platforms, features, and configuration. Because the review is limited to two countries, details of regulation will differ elsewhere, but the gap it describes is likely to be familiar.
Together, the sources suggest that device management has to cover the technical settings and the daily habits of clinicians who use the devices under time pressure.
Common mobile device management problems:
- Shared devices passed between users without clear sign-out
- Lost or stolen devices that cannot be located or wiped quickly
- Personal phones used for clinical messages without a policy
- Security settings that slow clinicians and encourage workarounds
- Apps installed outside approved lists
- Retired devices that are not wiped or tracked
What supports effective mobile device management:
- Written policies for owned and personal devices
- Enrollment, encryption, and remote wipe on every device that holds data
- Approved messaging and clinical apps with usable sign-in
- Separation of work and personal data on BYOD phones
- Maturity assessment that covers technology, policy, and people
- Clear steps for reporting a lost device
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses carry and share mobile devices more than most staff, and a device that fails or goes missing affects care right away.
At the Bedside
A phone or tablet that is signed out, charged, and loaded with the right apps supports medication scanning, secure messages, and photos. A lost device should be reported at once so that it can be locked and the patient information on it protected.
In Clinical Workflow
Nurse informaticists help define how shared devices are assigned, cleaned, charged, and signed in and out at shift change. They also test whether security settings, such as time-outs and passcodes, are workable during emergencies.
In EHR Implementation (Go-Live Perspective)
Mobile devices are enrolled and tested with the EHR mobile apps before an Epic Go-Live. At-the-elbow support analysts handle sign-in problems, missing apps, and dead batteries in the first days, and they report patterns to the mobile team.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Mobile device management appears in security, infrastructure, and policy questions:
| CAHIMS Domain | How MDM Appears |
|---|---|
| Healthcare & Technology Environments | HIPAA, privacy, device policy |
| Clinical Informatics | Mobile clinical workflows, secure messaging |
| Healthcare Information & Systems Management | Enrollment, policy enforcement, device lifecycle |
| Management & Leadership | BYOD governance, budget, risk management |
Key Terms to Know Alongside Mobile Device Management
- BYOD — bring your own device, the use of personal devices for work
- Endpoint Protection — security controls installed on end-user devices
- Remote Wipe — command that erases data from a lost or stolen device
- Containerization — separating work data and apps from personal ones on a device
- Encryption — transforming data so only authorized parties can read it
- Device Lifecycle — stages from purchase and deployment through retirement
HIMSS Organizational Position
HIMSS supports healthcare cybersecurity through its Healthcare Cybersecurity Community. Members can find related information on the HIMSS Healthcare Cybersecurity Community page.
🔗 Explore Further: External References
- NIST — SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise https://csrc.nist.gov/pubs/sp/800/124/r2/final
- Gellert et al. (2025), Advances in Health Information Science and Practice — A Survey of Clinicians in US Healthcare Delivery Organizations on Mobile Device Use in Care Delivery https://pubmed.ncbi.nlm.nih.gov/41185645/
- Wani et al. (2025), JMIR Human Factors — A Sociotechnical Approach to Bring-Your-Own-Device Security in Hospitals: Development and Pilot Testing of a Maturity Model Using Mixed Methods Action Research https://pubmed.ncbi.nlm.nih.gov/40802372/
- Alipour et al. (2025), PLoS One — Factors Influencing the Adoption of the BYOD Policy in Teaching Hospitals: A Cross-Sectional Study from Southeastern Iran https://pubmed.ncbi.nlm.nih.gov/40743237/
- John et al. (2024), Frontiers in Digital Health — Navigating the Wild West: A Review of Guidance on Clinical Communications Using Personal BYOD, IM and Third-Party Apps in the UK and Ireland https://pubmed.ncbi.nlm.nih.gov/39834840/
- HIMSS — Healthcare Cybersecurity Community https://www.himss.org/networking/communities/healthcare-cybersecurity/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply