Control every device
That Can Open Patient Photos
See every device connected to CureCast, end sessions remotely, and revoke a former employee's access to patient photos across their devices.
Control Every Device That Can Open Patient Photos
Device management starts with visibility. Patient records and clinical photos may be accessed from clinic computers, shared iPads, staff phones, and other authorized devices. CureCast gives practices visibility into devices connected to their account, including the associated staff member or login, device platform, operating-system version, app version, current status, login time, and last recorded activity.
If a device is lost or no longer trusted, an authorized administrator can review the associated device record and end that device’s active CureCast session. If a staff member leaves, deactivating the staff account ends active CureCast sessions associated with that staff account.
See Devices Connected to Your Practice
The CureCast Devices screen gives administrators a practical view of device records associated with their account.
Each device record can show
The Devices screen shows both active and expired device records, helping practices review current access as well as previously recorded sessions.
Administrators can use the available search and filter controls to find device records using account, staff, device, platform, operating-system, app-version, status, login-time, and last-activity information.
Why This Matters
This gives administrators a clearer view of device access to CureCast. Administrators can review:
Review Current and Expired Device Records
Not every device record represents current access.
CureCast shows the current status of each device record, including whether it is active or expired. This helps administrators distinguish devices with an active CureCast session from device records that are no longer active.
For each record, login time and last recorded activity provide useful context when reviewing a device associated with a staff member, clinic computer, phone, or tablet.
This is especially useful when:
- A clinic device is reassigned
- A staff member leaves the practice
- A device appears unfamiliar
- A practice is reviewing a suspected privacy incident
- A device is lost or no longer trusted
The Devices screen shows both active and expired device records, helping practices review current access as well as previously recorded sessions.
Administrators can use the available search and filter controls to find device records using account, staff, device, platform, operating-system, app-version, status, login-time, and last-activity information.
Re-register a Device Through a New Device Record
When a device is registered again, CureCast creates or displays a new device record in the Devices screen. The new entry can show the associated login, staff member where applicable, device details, platform, app version, status, login time, and last recorded activity.
The previous device record and its historical audit activity remain separate from the new device entry. Practices can continue reviewing historical activity in the Audit Trail according to the account’s retention arrangement.
Respond When a Device Should No Longer Have Access
A device can become a concern for many reasons:
- A staff member leaves the practice
- A clinic iPad is misplaced
- A staff phone is lost or stolen
- A shared workstation should no longer be used
- An unfamiliar device appears in the account
- A staff member changes roles
- A device is no longer approved for clinical work
When that happens, an authorized administrator can review the device record and take appropriate action from the CureCast Devices screen.
My staff photograph patients on their personal phones. What should I do?
Stop the capture happening outside the app rather than trying to police the phones. Photos taken with the native camera land in the camera roll and sync to a personal cloud account you cannot see into or delete from. Photos taken in CureCast touch neither. Set the policy, then remove the reason to break it.
Can I store patient photos in Dropbox or Google Drive?
You can, but it is difficult to defend. Neither offers a Business Associate Agreement on a personal account, neither records who viewed or downloaded an image, and files sync to every device the account is signed in on. The gap is not encryption, it is accountability: when a patient asks who has seen their photographs, a Drive folder cannot answer.
How do I wipe patient photos from an ex-employee’s phone?
Honestly, you usually cannot. No photo app can remote-wipe a personal phone it does not manage, and CureCast does not claim to. If the images were only ever viewed in CureCast there is nothing on the phone to wipe. If they were taken on the native camera or shared over WhatsApp, that is a legal and HR matter, not a technical one.
Do patient photos get saved to my staff’s phone?
No. Photographs taken in CureCast are written to the patient record, not the device camera roll, so they never reach a staff member’s personal iCloud or Google Photos backup. Nothing is left on the phone when they leave, and there is nothing on it to find if the phone is lost.
What happens to patient photos when a staff member leaves?
When a staff member leaves the practice, access should be removed promptly. HIPAA’s workforce security standard includes termination procedures at 45 CFR 164.308(a)(3)(ii)(C), which covers removing a workforce member’s access when their employment ends.
Deactivating a staff account ends active CureCast sessions associated with that staff account. This helps practices remove CureCast access across the former employee’s active phone, tablet, computer, and browser sessions.
Administrators can also review the device records associated with that staff account as part of the offboarding process and use the audit trail to review recorded activity before and during offboarding.
A staff phone with patient photos was lost. What do I have to do?
Act in this order: end that device's CureCast session, run a documented breach risk assessment, then notify only if the assessment requires it. Because CureCast never writes patient photos to the device camera roll, a lost phone usually means a lost session rather than lost images, which materially changes the assessment in every market.
The first six steps, in order
End the session for that device. Open the CureCast Devices screen and end the active session for the lost device. Minutes matter, because in several jurisdictions prompt remedial action changes whether the incident is notifiable at all.
Export the audit trail before anything else changes. Filter by device, staff or login, patient, event and date range, then export to CSV or PDF. This is your evidence record and it is easiest to gather now.
Establish what was actually exposed. Session access to a photo library is not the same as a copy of that library. Write down which of the two applies, because the rest of the assessment turns on it.
Run the risk assessment and document it. Do this even when you conclude no notification is required. In the United States the written assessment under the HIPAA Breach Notification Rule is itself the compliance artefact.
Deactivate the staff account if the device cannot be recovered and you want every session for that person ended rather than just the one on the missing device.
Secure everything else the device could reach: email, your EMR, messaging apps, cloud drives and any saved passwords.
How long do I have to report it?
The clock differs by market, and in most of them it starts when you become aware of the incident rather than when it happened. These are the headline deadlines for a practice holding patient photographs.
| Market | Regulator | Deadline to report | Notify patients when |
|---|---|---|---|
| United States | HHS Office for Civil Rights | Without unreasonable delay and no later than 60 calendar days from discovery (45 CFR 164.404). Breaches affecting 500 or more individuals also require notice to HHS (164.408) and prominent media (164.406) within 60 days; smaller breaches are logged and reported annually. | Unless the four-factor assessment under 45 CFR 164.402 demonstrates a low probability that the information was compromised. |
| United Kingdom | ICO | 72 hours from becoming aware, under UK GDPR Article 33, unless the breach is unlikely to result in a risk to individuals. | Without undue delay where there is a high risk to rights and freedoms, under Article 34. |
| Australia | OAIC | Where you suspect but cannot confirm an eligible breach, a reasonable and expeditious assessment within 30 days. Once you believe it is eligible, notify as soon as practicable. See the Notifiable Data Breaches scheme, Part IIIC of the Privacy Act 1988. | Where the breach is likely to result in serious harm and remedial action has not removed that likelihood. |
| Canada (Ontario) | IPC Ontario | Report to the IPC in the circumstances prescribed under PHIPA. | Notify the individual at the first reasonable opportunity under PHIPA s. 12(2) where personal health information is stolen, lost, or used or disclosed without authority. |
| United Arab Emirates | DHA, DoH or MOHAP | No single published clock equivalent to the above. | Federal Law No. 2 of 2019 Article 4 requires protection against unauthorised access, and the licensed facility remains accountable for the incident. |
Does encryption mean this is not a reportable breach?
Often it changes the answer, and this is the fact practitioners most need and least often find. It is also why step one is step one.
- United States. Protected health information that has been rendered unusable, unreadable or indecipherable to unauthorised persons is not "unsecured PHI" (45 CFR 164.402, see also HHS guidance), and the breach notification obligation does not attach to it. A lost phone holding no local copies, where access requires authentication against an encrypted service, sits in a very different position from a phone with a camera roll full of patient images.
- Australia. The Notifiable Data Breaches scheme contains an explicit remedial action limb. If you act quickly enough that serious harm is no longer likely, the breach is not notifiable at all. Ending the session promptly is exactly that action.
- United Kingdom. Encryption does not remove the Article 33 assessment, but it bears directly on whether there is a high risk to individuals, and therefore on whether you must notify patients under Article 34.
None of this is automatic. The assessment still has to be carried out and written down, whatever conclusion you reach. CureCast gives you the session control and the audit record the assessment depends on. It does not make the judgment for you, and your practice remains responsible for its own notification decisions. This page is general information, not legal advice.
End an Active Session
Ending a session stops CureCast access for the selected device/session only. Other active CureCast sessions for the same staff account remain active. The user on the selected device must authenticate again before continuing to use CureCast.
This can be useful when:
- A staff member leaves or changes roles
- A clinic device is handed to a different team member
- An administrator wants to stop current access while reviewing activity
- A device may have been left signed in
To remove CureCast access across all active sessions for a single staff member, deactivate that staff account instead.
End a Session, Deactivate Staff, or Use MDM
Historical Device Activity Remains Searchable
A device record and its audit history are not the same thing.
The Devices screen helps administrators review and manage device records associated with CureCast access. The Audit Trail preserves recorded activity separately.
If a device session becomes expired or a device record is deleted from the Devices screen, the recorded historical audit activity associated with that device can still be searched in the Audit Trail using the recorded device information.
This helps practices investigate past activity involving a device, including after the device is no longer listed in the Devices screen.
For example, if a clinic removes an old browser session or device record, it can still review recorded activity associated with that device, including patient-record views, clinical-photo activity, downloads, shares, bulk downloads, timestamps, and available IP-address context.
This is highly useful for:
Review Activity From a Device
Device management works together with CureCast’s
audit trail, helping your practice review recorded activity associated with staff devices and sessions.
If a device is lost, unfamiliar, expired, deleted from the Devices screen, or related to a suspected privacy incident, your practice can still review recorded activity associated with that device in the Audit Trail.
The Devices screen is used to review and manage device records. The Audit Trail preserves historical recorded activity separately, including the device information associated with each event.
Filter the activity you need
Recorded activity can be reviewed using available filters for:
What the audit trail can help you review
Practice responsibility
The audit log records what happened in CureCast. Your practice remains responsible for deciding whether access was appropriate and whether any additional incident-response action is required.
Export Activity for a Lost or Suspicious Device
If a phone, tablet, computer, or browser session is lost, unfamiliar, expired, deleted from the Devices screen, or involved in a suspected privacy incident, authorized users can still review related recorded activity in the CureCast Audit Trail.
Use available filters for device, staff/login, patient, event, IP address, and date range to narrow the results. Authorized users can then export matching recorded activity in CSV or PDF format using a custom date or month range.
The exported activity can help a practice review the device-associated record of access, including recorded patient activity, clinical-photo actions, downloads, shares, bulk downloads, staff or login identity, device context, IP address, and timestamps.
The audit log records activity in CureCast. Your practice remains responsible for assessing whether access was appropriate and whether further incident-response or compliance action is required
Device Management Works With Staff Access Controls
Staff access controls determine what a person is permitted to access. Device management helps your practice review when a particular phone, tablet, computer, or session is associated with CureCast access.
For example:
Device Management Is Not Full Mobile Device Management
CureCast helps practices manage CureCast application access from connected devices. It is not a replacement for a practice’s wider device-security program.
For US practices, the HIPAA Security Rule includes a device and media controls standard at 45 CFR 164.310(d)(1) and an addressable encryption specification at 45 CFR 164.312(a)(2)(iv). Practices decide how to meet them in their own device policies.
Your practice may also need its own policies and tools for:
- Clinic-owned versus personal devices
- Device passcodes and biometric security
- Operating-system updates
- Mobile device management (MDM)
- Device encryption
- Remote wipe
- Camera-roll and local-file policies
- Workforce training
- Lost-device reporting
- Broader incident-response procedures
Device controls are one part of a HIPAA-compliant workflow, not the entire workflow.
Personal Phones and Clinic Device Policies
Whether staff may use personal phones to access CureCast is a decision for each clinic’s device, privacy, and security policy.
If a clinic permits personal-device access, administrators can still control the staff member’s CureCast permissions and review recorded in-app activity through the Audit Trail. The clinic remains responsible for its rules regarding device passcodes, encryption, local storage, screenshots, downloads, camera-roll access, and lost or stolen personal devices.
A clinic can use a shared iPad for CureCast when each staff member signs in with their own individual account.
Before another staff member uses the iPad, the previous user should log out. The next staff member should then sign in with their own credentials. This keeps application access and recorded activity associated with the correct staff account.
Shared clinic devices should use separate individual sign-ins for each person, not a shared account. HIPAA’s Security Rule requires unique user identification at 45 CFR 164.312(a)(2)(i).
Built for HIPAA-Compliant Workflows
CureCast is built to support HIPAA-compliant workflows for US healthcare practices.
Device management helps practices identify devices connected to CureCast, review active and expired device records, end one selected device/session when needed, and deactivate a staff account to end active CureCast sessions associated with that staff account. Your practice remains responsible for its own compliance obligations, including device policies, workforce procedures, physical-device security, and incident-response decisions.
These controls are part of CureCast's seven security controls. See how they work together in the Security & Compliance overview .
Frequently asked Questions
Can I see which devices are connected to CureCast?
Yes. The Devices screen shows device records associated with your account, including login identity, associated staff member where applicable, device name, platform, operating-system version, app version where applicable, status, login time, and last recorded activity.
Can I see both active and expired device records?
Yes. The Devices screen shows device records with active or expired status, helping administrators review current and previously recorded sessions.
Can I find devices associated with a particular staff member?
The Devices screen includes staff-member and login-identity information, along with search and filter controls to help administrators locate device records using available account and device details.
Can I end an active CureCast session remotely?
Yes. Authorized administrators can select End Session for an active device record from the Devices screen. The user must authenticate again before continuing to access CureCast.
Does ending a session log a staff member out of every device?
No. Ending a session affects the selected device/session only. Other active CureCast sessions for the same staff account remain active.
How do I remove CureCast access from all devices used by a former employee?
Deactivate the staff account. Deactivating a staff account prevents further authenticated access on the next request, and active CureCast sessions associated with that account can also be ended as part of offboarding.
What should I do if a clinic phone, iPad, or computer is lost?
Review the device record, end any active CureCast session, and review related activity in the audit trail. Your practice should also follow its own lost-device and incident-response procedure for other systems and data that may be accessible from the device.
Can I review activity from a specific device?
Yes. CureCast’s audit trail can be filtered using device information, together with staff/login, patient, event, IP address, and date range, to review recorded CureCast activity.
Is CureCast device management the same as MDM or remote wipe?
No. CureCast helps administrators manage CureCast access from device records and end active sessions. It does not replace a full mobile-device-management system, remote-wipe capability, or the practice’s broader physical-device security program.
Does deleting a device record remove its audit history?
No. Deleting a device record removes it from the Devices screen, but recorded historical activity remains available in the Audit Trail for review.
See How CureCast Fits Your Practice
Discuss how CureCast fits into your clinical photo workflow, from capturing and organizing patient photos to securely managing them across your practice.
Prefer email? [email protected]