What should I check at the end of a shift on my phone?

Your phone can make a busy shift easier: you may use it to check an approved rota, receive an urgent message or access a clinical system. But a screen left open, a notification shown on a lock screen or a file saved to the wrong place can expose information after you have finished work.

A reliable end of shift routine does not need to be complicated. It should help you finish the work safely, complete the handover process through the right channels and leave your phone in a state that matches your employer’s rules. The steps below are a practical starting point—not a replacement for your organization’s policy.

Start with your employer’s BYOD and device policy

Before changing settings or using your phone for work, check your employer’s policy on bring-your-own-device (BYOD), mobile phones and approved applications. Some organizations allow limited access on personal phones; others require a managed device or prohibit certain uses. A setting that seems sensible may conflict with local requirements for monitoring, remote wipe, screen locking or data storage.

Ask your manager, IT service desk or information-governance team if the rules are unclear. In particular, find out:

• Which devices and operating-system versions are allowed.
• Which apps and sign-in methods are approved for work.
• Whether work access must use a managed profile, secure workspace or mobile-device-management app.
• What to do if your phone is lost, stolen, shared or replaced.
• How to report a suspected data breach or security incident, and how quickly to report it.
• Whether you may use the phone for photos, voice notes, messaging or document storage.

Do not assume that a work folder makes information secure. A folder can help organize files, but it does not necessarily stop an app from backing them up, sharing them or displaying them in search results. Follow the controls your employer has approved.

Use approved systems for patient and organizational data

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 set requirements for handling personal information. The Information Commissioner’s Office (ICO) provides practical guidance on information security, including its guidance on working securely and working from home securely. These sources support a basic principle: use appropriate security measures and follow your organization’s arrangements for protecting information.

For day-to-day work, that means patient and organizational information should stay in approved systems. Use the designated clinical record, secure messaging service, email system or other platform your employer has authorized. Do not move information into a personal account or consumer app to make it easier to access later.

At the end of the shift, check whether you have left work information in places that are not part of the approved system:

• Personal email drafts, inboxes or sent items.
• Text messages or chat apps that are not approved for work.
• Downloads, photo libraries, notes apps or voice-memo apps.
• Clipboard history, recent files or app previews.
• Personal cloud storage or automatic device backups.

If you find information in an unapproved location, do not secure phone habits clinicians simply forward it elsewhere or assume that deleting one copy fixes everything. Follow your employer’s incident or information-governance process for that situation. Some systems retain backups, message history or deleted items, so ask for advice when needed.

Complete the handover process before you close the work

Closing an app is not a handover. Before leaving, make sure outstanding tasks, concerns and follow-up actions have been communicated through the channel your team uses. A secure system does not help if the next person is left without essential information.

Use your normal handover process and local guidance. Depending on your role and setting, that may include recording information in the clinical record, speaking directly to a colleague or using an approved handover tool. Check that the right person has received the information; do not rely on an informal personal message as a substitute for documentation or escalation.

Before you finish, consider:

• Are urgent concerns and time-critical actions clearly handed over?
• Have you recorded relevant information in the correct system?
• Is the next person aware of tasks that remain outstanding?
• Have you followed local escalation steps for anything that cannot wait?

Keep the handover proportionate and relevant. Share information with people who need it for their role, using the approved route. If you are unsure whether an issue has been safely handed over, contact the appropriate colleague or supervisor rather than assuming that a notification was seen.

Close sensitive screens and sign out where required

Once work is handed over, close sensitive screens so patient or organizational information is not left visible if someone picks up your phone. Start with the apps you used for clinical or administrative work. Sign out when your employer’s policy or the system’s instructions require it; some managed apps may use a secure session that locks automatically.

1. Save or submit any work that belongs in the approved system.
2. Check that entries or messages have completed successfully; do not leave a half-finished form open.
3. Close the clinical or organizational screens you no longer need.
4. Sign out or lock the work app if required by policy.
5. Return to the phone’s home screen and lock the device.

Do not leave a patient record open just because the phone is in your pocket or on a desk. A short screen timeout and a strong device lock reduce the time information is exposed, but they do not replace closing a sensitive screen or following the app’s sign-out requirements.

Check lock-screen notifications in real conditions

Notifications can reveal names, message text, appointment details or other information even when the phone itself is locked. Turning off previews may reduce what appears on screen, but the exact controls vary by phone, operating-system version and app.

Set notifications according to your employer’s policy and the needs of approved work apps. You may be able to hide preview text, show notifications only after unlocking or disable lock-screen notifications for particular apps. Do not assume the setting worked because a menu says it is enabled.

Test it on the actual lock screen:

1. Lock your phone.
2. Ask someone to send a test notification from a permitted app, or use a harmless test notification if available.
3. Check what is visible without unlocking: sender, message text, subject line and any banner or preview.
4. Adjust the settings and repeat the test until the result matches policy.

Also check notifications on a connected watch, tablet, car display or other paired device. A phone setting may not control what a companion device shows. If you cannot tell what information is being shared, ask your IT team for device-specific instructions.

Keep work and entertainment separate

Separate work from entertainment as far as your employer’s device setup allows. Use approved work apps for work information and personal apps for personal activity. Avoid copying a work message into a personal notes app, saving a clinical document to your photo library or using a consumer messaging service because it is more familiar.

If your organization provides a managed work profile or separate work apps, use them as instructed. That separation can help apply work controls, but it does not make every action safe: check where downloads go, what is backed up and which apps can share files. If the arrangement is unclear, ask IT rather than experimenting with patient information.

Keep entertainment activity out of work sessions where practical. Streaming, games and personal social apps can make it easier to tap the wrong share option or miss a work notification. A common easy mistake is choosing “share” and selecting the first suggested contact or app without checking the destination. Before sharing any file, pause and verify both the content and recipient. Never use personal email as a workaround for blocked or unavailable work access.

Remove accidental leftovers carefully

Take a quick look for work-related leftovers, especially if you used a browser, camera or file viewer. Check recent downloads, open tabs, screenshots and the app switcher. The aim is to identify accidental copies—not to create a second record or delete information from an approved system.

If your policy permits a particular temporary file, handle it exactly as instructed. If you do not know whether a file is work data or whether it can be deleted, leave it alone and ask your organization’s support team. Avoid emptying shared folders or deleting records simply to make the phone look tidy.

Be especially cautious with screenshots. They can contain more than the detail you intended to capture, and may be included in photo backups or visible to other apps. Do not take screenshots of patient or organizational information unless your employer explicitly permits the use and explains how to store and remove them.

A practical end-of-shift checklist

Check What to do When to ask for help Policy and approved apps Use only the device setup and systems authorized by your employer. If you are unsure whether personal-phone access is allowed. Handover process Record and pass on outstanding work through the agreed channel. If urgent information has not reached the right person. Sensitive screens Finish, close or sign out of work apps as required, then lock the phone. If the app remains open or you cannot confirm work was saved. Notifications Hide sensitive previews where required and test the actual lock screen. If a paired device still displays work information. Files and sharing Check for accidental downloads, screenshots or copies in personal apps. If information may have gone to an unapproved location. Device incident Report a lost, stolen or compromised phone using local procedures. Immediately, following your organization’s reporting route.

If something has gone wrong

If you think patient or organizational information has been exposed—for example, a phone is lost, a message went to the wrong recipient or a file was saved to a personal account—report it promptly through your employer’s incident process. Include what happened, when it happened, what information may be involved and what steps you have already taken. Do not wait until the next shift to see whether the problem resolves itself.

Your organization’s information-governance or security team can advise on containment and reporting. The ICO’s guidance is useful background, but follow your employer’s procedures for an actual incident. Do not try to hide the mistake by deleting records or asking someone to use a personal email account.

Make the routine short enough to use

A good end-of-shift routine is repeatable: complete the handover, check that work is in approved systems, close sensitive screens, test notification privacy and lock the device. Keep the steps visible in a team checklist if that helps, and review them when your employer changes its BYOD rules, apps or device controls.

The safest routine is the one that fits local policy and works on your actual phone—not just the one that looks right in a settings menu.