How often should I review my phone setup if my role changes to on call?

A move to on-call work changes what your phone is asked to do. You may need to respond outside normal hours, receive alerts while away from your desk, or use approved work systems from home. That does not automatically mean your personal phone should hold more work information—or that every notification should appear on its lock screen.

Review your phone setup whenever your responsibilities, access, or working arrangements change. Then check it again at a regular interval set by your employer. If your organisation has no stated interval, a practical approach is to review it at least every three months while you are on call, and immediately after a significant change such as joining a new rota, changing devices, or receiving new system access. Your employer’s policy takes priority over that suggested timetable.

The main rule is straightforward: start with your employer’s BYOD and device policy, use only approved systems for patient and organisational data, keep clinical work separate from entertainment, and test notification privacy on the actual lock screen. A phone can look sensible in its settings menu but still reveal information when it lights up on a bedside table.

Start with policy, not the settings screen

Before changing anything, find your organisation’s policy for personally owned devices, remote working, and on-call communications. These may be separate documents. Ask your manager, IT team, information governance lead, or service desk if you cannot find them on the intranet.

Check whether personal phones are permitted for work at all. If they are, establish exactly what the permission covers. An employer may allow an approved app for rota alerts but prohibit storing patient details, downloading attachments, or using ordinary text messages for work. “BYOD is allowed” is not a blanket approval for every app or type of data.

• Which devices and operating-system versions are supported?
• Which work apps, email accounts, messaging tools, and authentication methods are approved?
• Can the organisation require a passcode, encryption, device-management software, or remote removal of work data?
• What should you do if the phone is lost, stolen, shared, or compromised?
• Are there restrictions on backups, screenshots, file downloads, or connecting to public Wi-Fi?
• How should you report a suspected data breach or a work message sent to the wrong person?

The Information Commissioner’s Office (ICO) provides guidance on working securely, including when working away from the usual workplace. Its working from home securely guidance is a useful reference for thinking about access, device security, and the surroundings in which you work. The ICO’s broader security guidance explains organisational security responsibilities. Use this guidance alongside local policy; it does not replace your employer’s approved procedures.

Review at the points when risk changes

A “role change review” is most useful when it is tied to a real change in what you do, rather than to a date on the calendar alone. On-call duties can bring new systems, new contacts, and different expectations about response times. Those changes can affect both what your phone receives and what someone else might see.

When to review What may have changed What to check Before your first on-call shift New rota, escalation route, or response expectations Approved apps, account access, notification rules, and who to contact for support When responsibilities or systems change New service, role, team, or access permissions Whether the phone is still an approved way to access the relevant work system After a phone, SIM, or operating-system change Different device settings, apps, backup, or authentication behaviour Security controls, sign-in, lock-screen previews, and work-app notifications At your employer’s review interval Policy updates, new threats, or changes in personal use Device configuration against current policy and the needs of your role After loss, suspected compromise, or a privacy incident Possible unauthorised access or exposure Follow the organisation’s reporting and response procedure promptly

Do not wait for a scheduled review if you have reason to think information has been exposed. Report the concern through your organisation’s incident route, even if you are unsure whether it meets the formal definition of a breach. Do not try to quietly fix a work-data incident by deleting a message and assuming the issue is closed.

Use approved systems only for work data

Patient and organisational information should stay in systems your employer has approved for that purpose. That might include a managed clinical application, secure remote access, or an approved work email or messaging platform. The right choice depends on local policy and the task.

Do not move work into a personal email account, consumer messaging app, personal cloud storage, or an unapproved notes app because it feels quicker during an on-call shift. Do not take a screenshot or copy a clinical message into another app to make it easier to find. These workarounds can create extra copies, weaken access controls, and make information harder for the organisation to manage appropriately.

If an approved system is unavailable, use the downtime or escalation process your employer provides. If you do not know what that is, ask before your first shift. A rushed workaround may create a bigger problem than a delayed response routed through the proper process.

Check what the app actually retains

It is worth reviewing whether an approved app stores information locally, allows downloads, or includes a “remember hide notification content android me” option. Do not assume that an app is secure just because it has a work logo. Follow your organisation’s setup instructions, keep the app and operating system updated as required, and avoid changing managed settings without approval.

Also check whether work content is included in automatic device backups. Your employer may have specific requirements about backups or may use management controls to keep work data separate. If the answer is unclear, ask IT rather than switching backup settings at random.

Separate clinical work from entertainment

One phone may serve several parts of your life, but the work boundary needs to be deliberate. Keep clinical activity inside approved work apps and accounts. Use separate work and personal profiles or containers if your employer provides them. Do not assume that making a folder called “Work” creates a security boundary: folders organise icons; they do not control access to data.

Check whether personal apps can display over work screens, read notifications, access contacts, or sync files. Pay attention to apps that request broad permissions, especially those that record the screen, manage notifications, share files, or connect to cloud services. Do not grant a permission simply because an app asks for it. If an approved work app needs a permission and you are uncertain why, confirm it with IT.

Keep entertainment use from interfering with on-call duties. A focus mode, do-not-disturb schedule, or quiet-hours setting may silence the very alert you need. Set exceptions only as your employer’s instructions allow, and test the result. If your device supports separate work and personal notification schedules, verify that work alerts remain enabled during your on-call period and that personal alerts do not drown them out.

Set notification rules for privacy and response

Notifications are often the most visible route by which work information leaves the app. A phone can be locked and still show a sender, a message preview, an appointment detail, or a patient-related subject line. The lock screen is not a private space just because only you can unlock the device.

Review notification rules for each approved work app and for the phone as a whole. Depending on your device and employer’s policy, you may be able to show that a notification exists without showing its contents. Prefer the least revealing option that still lets you meet your on-call responsibilities. For example, you may need an alert that a secure app has a new message, while opening the app itself requires authentication.

• Hide sensitive content from lock-screen previews, or disable previews when locked.
• Check whether sender names, message subjects, calendar details, or message text appear on a locked screen.
• Review notification settings for each approved work app, not just the phone’s general setting.
• Check vibration, sound, banners, and wearable-device alerts if a watch or other paired device receives notifications.
• Confirm that on-call alerts are not silenced by sleep, focus, or do-not-disturb schedules.
• Do not use a more revealing preview setting simply to identify a message faster; open the approved app instead.

Test on the actual lock screen

Always test the settings on the phone itself. Menu labels can be misleading, and one setting may override another. Lock the device, then trigger a harmless test notification from an approved app or ask your IT team how to test safely. Check what appears while the phone is locked, including on a paired watch or car display if those devices receive alerts.

Repeat the test after an operating-system update, a work-app update, a change to notification settings, or a new device setup. Do not use real patient information as a test message. If the preview exposes content you did not expect, adjust the setting and test again before relying on it during a shift.

A practical role change review

Use this short review before your first on-call shift, and revisit it after material changes. Keep the review proportionate: the aim is to confirm the phone is suitable for the approved work, not to turn your personal device into an unofficial clinical system.

1. Confirm the rules. Find the current BYOD, remote-working, and on-call instructions. Ask who owns the decision if they conflict or leave a gap.
2. Confirm the approved route. Check which apps and accounts you may use for patient and organisational data, including how to handle downtime.
3. Check access. Remove work access you no longer need, and confirm your current access is authorised for the new role.
4. Check device configuration. Confirm the required passcode, updates, encryption, management controls, and backup settings under local policy.
5. Separate work and personal use. Check profiles, app permissions, file sharing, and any personal apps that could interact with work content.
6. Set notification rules. Keep necessary on-call alerts working while hiding sensitive previews from the lock screen.
7. Test the real outcome. Lock the phone and verify what is visible and what still alerts. Test paired devices too.
8. Know the reporting route. Save or know how to find the service desk and incident-reporting instructions without storing sensitive details in an unapproved place.

How often is often enough?

There is no single ICO timetable that says every share menu wrong account clinician must review a phone every set number of weeks. The ICO guidance is about protecting information and managing security appropriately; your organisation sets the operational rules for its devices and systems.

Use three triggers: review when your role changes, review when the device or its software changes in a way that could affect security, and review at the interval your employer specifies. If no interval is stated, a quarterly check is a practical backstop for someone regularly on call—not a legal requirement or a substitute for local policy. A quick pre-shift check is sensible when you have not used the setup recently or know that an update has changed how alerts behave.

Finally, write down any unresolved question and take it to the right team. For example: “Does this app show message previews on the lock screen under our policy?” is more useful than “Is my phone secure?” Specific questions help IT, information governance, and your manager give advice that matches your device and role.

The takeaway

When your role changes to on call, review your phone setup before you rely on it. Start with the employer’s BYOD policy, keep patient and organisational information in approved systems, maintain a clear boundary between work and entertainment, and set notification rules that protect privacy without silencing essential alerts. Then test the configuration on the actual lock screen.

Repeat the review when access, duties, devices, or software change, and follow your employer’s scheduled checks. That approach is more useful than treating one setup as permanent—and safer than discovering during a night shift that a preview is visible to everyone in the room.