Suite #1130, 189 Queen St, Melbourne
+61-361-613-320
info@terusolutions.com.au
Book a free assessment Book a free assessment Book a free assessment

Mobile & In-Home Care

"Prevention is cheaper than a breach"

Project Overview

An NDIS registered provider delivering in-home and community supports engaged TERU Solutions to secure its field workforce. 68 support workers visited participants in their homes each week, recording progress notes, incident reports, medication records and photographs on mobile devices, most of them staff members’ own phones.

None of those devices were managed. Participant information left the office every morning on hardware the provider had no visibility of, no control over, and no way to recover. Shift handovers ran through WhatsApp. Photographs of wounds, incidents and participants’ homes sat in personal camera rolls, syncing automatically to private cloud accounts.

Under the NDIS Practice Standards the provider was required to protect participant information and uphold participant privacy and dignity. In practice, the most sensitive records it held were the least protected and if a phone was lost, nobody would know what had gone with it.

Challenges

1
Support workers recorded progress notes and incident reports on personal phones with no PIN, encryption or device management.
2
Participant photographs: wounds, incidents, home environments saved to camera rolls that synced automatically to staff members' personal cloud accounts.
3
Shift handovers and participant updates ran through WhatsApp and personal SMS, outside any system the provider controlled or could produce on request.
4
A lost or stolen phone meant participant data left with it, with no way to revoke access or wipe work data remotely.
5
Staff who resigned retained access to participant systems for weeks, with no offboarding process connected to their devices.

Solutions

1
Mobile device management deployed across 74 devices, enforcing biometric or PIN unlock, encryption and operating system patch compliance before any participant system can be reached.
2
App protection policies containerise work data, photographs captured in the managed app cannot be saved to the camera roll or synced to a personal cloud account.
3
An approved, auditable channel replaced WhatsApp for handovers and participant updates, with records retained inside the provider's own systems.
4
Selective remote wipe: a lost device is cleared of work data within minutes, leaving the staff member's personal photos and messages untouched.
5
Conditional access tied to offboarding access to participant systems is revoked the same day someone leaves, across every device they used.
Scroll to top