Half Of Care Providers Use Staff’s Own Phones — But Most Staff Unaware Of Any Bring Your Own Device Policy, New Research Finds

New research commissioned by Digital Care Hub has revealed that “Bring Your Own Device” (BYOD) — where care staff use their own phones or tablets for work — is now widespread across adult social care, yet many staff are unaware of any policy or guidance on how to use their devices safely.

The largest-ever survey on BYOD in adult social care, with 775 respondents (606 managers and 169 staff), found that:

• Half (50%) of care providers surveyed use BYOD approaches, but only half of those have a BYOD policy in place

• Home care has the highest uptake, with 53% of respondents using personal devices

• Smaller organisations are significantly more likely to adopt BYOD

• Cost is the main driver (58% of managers cited this reason)

• 97% of those using BYOD do so through personal mobile phones

• Just 40% of staff using their own devices remember signing any policy or guidance — meaning most are operating without clear rules

• 70% of staff say they would prefer an organisation-provided device.
• Staff delivering face-to-face care most likely to use their own device (70%). They also have high levels of access to the data of the people they support.

Despite these gaps, 70% of managers said they believed BYOD poses a “low risk” to their organisation. Interviews found that many data breaches go unrecognised, suggesting the true scale of incidents may be higher than reported.

The research, launched for the Care Show during Cyber Security Awareness Month, uncovered widespread insecure practices, including staff using WhatsApp to share sensitive information, connecting to public Wi-Fi to access care systems, and taking photos on personal devices — all of which could put people’s private data at risk.

Between 2019 and 2024, 211 digital data breaches were reported to the ICO in the social care sector, with 63% caused by human error. While not all relate directly to BYOD, the findings highlight the sector’s vulnerability and the need for clearer policies and controls.

“Bring Your Own Device can seem like a win-win — it saves money and staff get to use the phones they already have,” said Daniel O’Shaughnessy, Head of Programme Delivery, Digital Care Hub.

“But the reality is it’s risky if you don’t manage it properly. Many small providers simply can’t afford to give everyone a phone, so we need to help them do BYOD safely, with the right policies, training, and controls in place.”

New support: Data Policy Builder to launch with BYOD policy tool

To help providers tackle these risks, Digital Care Hub is launching a new Data Policy Builder — a free online tool that helps care organisations create tailored data protection policies.

The first policy available will be “Bring Your Own Device (BYOD)”, providing a step-by-step framework to help managers:

• Understand and identify risks linked to BYOD;

• Create a custom policy for their organisation;

• Learn about technical solutions like Mobile Device Management (MDM) and secure apps;
• Support staff awareness and training on safe device use.

“Simply banning BYOD isn’t realistic for many care providers,” added Daniel O’Shaughnessy. “Our goal is to help them manage it safely — protecting people’s data, satisfying regulators, and reducing the risk of costly breaches.”

The research has been welcomed by sector leaders, including Dr Jane Townson OBE, Chief Executive Officer of the Homecare Association:  “This research highlights a significant challenge for homecare providers. Whilst BYOD has become widespread, often driven by financial necessity, the gap between adoption and proper governance is concerning. When most staff cannot recall signing a policy and seven in ten would prefer an organisation-provided device, we clearly need better support. The research and plans for the new Data Policy Builder are very welcome. We must also address the underlying issue of tight financial margins that prevent providers from investing in secure devices and robust technical controls in the first place.”

The report is available on the Digital Care Hub website.