01Introduction
Securing 200 Unmanaged Devices for a Behavioral Health Network
02Problem Statement
- Multi-site behavioral health org: 200 devices (iOS, Android, macOS, Windows)
- Staff accessing PHI from personal devices with no MDM, no encryption enforcement
- HIPAA Security Rule: device-level safeguards required for all PHI access
- Challenge: enroll devices with zero disruption to clinical staff workflows
- Goal: full MDM within 8 weeks; pass HIPAA technical safeguards audit
03Proposed Solution
Phase 1
Apple Business Manager + Mosyle MDM Architecture
- Apple Business Manager configured for zero-touch iOS/macOS enrollment
- Mosyle Business deployed for supervised Apple device management
- Windows devices enrolled in Intune via Google Workspace + Entra ID federation
- Android devices enrolled via Android Enterprise Work Profile
- Conditional Access: PHI apps blocked on non-compliant or unenrolled devices
Phase 2
Policy Deployment & Compliance Enforcement
- FileVault encryption enforced on all Macs; BitLocker on Windows devices
- Screen lock: 5-minute timeout, 6-digit PIN minimum across all platforms
- Remote wipe capability tested and documented for HIPAA incident response
- Google Workspace DLP: PHI keyword rules on Drive, Gmail, Chat
- Monthly compliance reports auto-generated; non-compliant devices auto-quarantined
04Technologies
- MDM
- Mosyle Business (iOS/macOS)Microsoft Intune (Windows/Android)
- Identity
- Google WorkspaceEntra ID (federated)Apple Business Manager
- Security
- FileVaultBitLockerGoogle Workspace DLPConditional Access
- Monitoring
- Mosyle compliance dashboardIntune compliance reports
- Scripting
- Bash (macOS profiles)PowerShell (Windows policies)