Start with your employer’s phone policy and use only approved systems for...

https://sierra-wiki.win/index.php/What_Does_the_ICO_Say_About_Using_a_Personal_Device_for_Work_Data%3F

Start with your employer’s phone policy and use only approved systems for patient information. Hide lock-screen previews, set clear on-call notification rules, and check which account you’re using before you send or share anything.