How Do I Avoid Improvised Workarounds When the Approved App Can’t Do Something?

You’re trying to finish a clinical task, but the approved app won’t attach a file, share a screen or open a document in the format you need. The tempting fix is to send it through a personal email account, save it to a consumer cloud drive or take a screenshot. It may feel like a one-off shortcut. It can also move patient or organisational information outside the protections your employer has chosen.

The safer response is not simply “don’t do that”. It is to pause, identify what the task requires, check the rules for your device and the information involved, and raise the gap through the right route. This helps you find a policy compliant workflow rather than creating an unsupported one.

This article is general guidance, not a replacement for your employer’s policies or information governance advice. Rules vary between NHS organisations and other employers. If local instructions differ from a general recommendation, follow the local policy and ask your information governance, IT or clinical safety team when the answer is unclear.

Why improvised workarounds create risk

An app limitation can seem like a small technical problem. The workaround can create a larger information-handling problem: where a file is stored, who can access it, whether it is backed up, how long it remains available, and whether the organisation can manage or remove it if your device is lost or your role changes.

Information may also become harder to trace. A document sent through a personal account may not appear in the organisation’s audit trail. A screenshot may persist in a photo library or cloud backup. A message preview may show sensitive content on a locked screen. These risks do not depend on having bad intentions; they can arise from ordinary taps made under pressure.

The Information Commissioner’s Office (ICO) provides guidance on working securely, including when working from home. Its guidance supports practical security measures, but your employer is responsible for setting the systems and rules that apply to your work. Use ICO material to understand the principles, then check how your organisation puts them into practice.

Start with your employer’s BYOD and device policy

Before using a personal phone, tablet or computer for work, check your employer’s bring-your-own-device (BYOD) and acceptable-use policies. Do not assume that a device is approved just because you can install an app, receive a work email or connect to the organisation’s network.

Look for clear answers to these questions:

• Is this type of personal device allowed for work, and for which tasks?
• Must you enrol it in a management service or use a managed work profile?
• Which apps, browsers, storage locations and communication channels are approved?
• What screen-lock, encryption, update and anti-malware requirements apply?
• Can the organisation remove work data remotely, and what does that mean for personal content?
• What should you do if the device is lost, shared, compromised or no longer supported?

If the policy is difficult to find, ask your line manager or the relevant IT or information governance contact where it is held. If it does not cover your situation, ask for a decision before using the device for that task. A verbal “it should be fine” may not resolve questions about what is permitted; request an approved route or written clarification.

BYOD permission is not blanket permission to use every app on a personal device. An employer may allow work email but prohibit downloading attachments, or may allow access only through a managed app. Follow the specific conditions rather than treating access as approval for every possible use.

Use approved systems for patient and organisational data

Patient information and organisational data should stay within systems approved by your employer for that purpose. This may include clinical records, approved messaging, collaboration tools, managed email, secure remote access or an authorised document store. The right system depends on the task and the information involved.

Do not move work information to a personal email account, consumer file-sharing service, personal messaging app or unapproved note-taking tool just because it is quicker. A folder labelled “Work” on a personal device does not make its contents secure or organisation-managed. Likewise, deleting a message from your inbox may not remove copies, backups or recipient downloads.

When an app cannot perform a needed task, use this sequence:

1. Pause before transferring information. Do not test a workaround with real patient details or confidential work content.
2. Describe the task, not just the missing feature. For example: “I need to review an approved document away from the ward” is more useful than “the app is broken”.
3. Check for an existing approved route. Search internal guidance or ask your team’s digital champion, service desk or manager. A supported alternative may already exist.
4. Raise the tooling gap. Tell the appropriate team what you are trying to do, which approved app you are using, what happens, and how the limitation affects the work.
5. Ask what information can be used and where. Make clear whether the task involves patient-identifiable, confidential or otherwise sensitive material.
6. Wait for a supported solution or authorised instruction. If the task is time-critical, use your organisation’s established escalation or contingency process rather than inventing a new channel.

When reporting a problem, include https://obgynkey.com/keeping-work-and-personal-phone-use-separate-practical-habits-for-healthcare-professionals/ enough detail for someone to reproduce it: device type, operating system, app version if available, the steps that fail, and any error message. Do not include patient-identifiable information in an ordinary support ticket unless the ticketing process is specifically approved for it. Ask how to provide examples safely.

Separate entertainment from clinical work on the device

Keeping clinical work separate from entertainment is a practical way to reduce accidental sharing and confusion. On a personal device, that may mean using an employer-managed work profile or approved container, if your organisation supports one. On an organisation-owned device, it may mean keeping personal accounts and entertainment apps off the device, in line with local policy.

Separation is useful, but it is not a substitute for approval. A second user profile, a folder, or a different home screen does not automatically prevent data from being copied, backed up or exposed to another app. Use only the separation method your employer has approved and understands how to support.

For example, before opening a work attachment, check whether it is being opened in the approved managed app rather than a personal document viewer. Before sharing a file, check the destination shown in the share menu. It is easy to tap a familiar personal app by mistake, especially when the phone places it near the approved option. If there is any doubt, cancel the share and verify the destination before trying again.

Also consider shared household access. Do not leave a work device unlocked where another person could see information, and do not let family members use a device that is signed in to work systems. Follow your employer’s rules for using work equipment at home and for keeping work conversations private.

Check lock-screen previews and notification privacy

Notifications can reveal more than people expect. A message preview may show a patient’s name, appointment details or a colleague’s comment while the device is locked. Notifications can also appear on a paired watch, car display or other connected device.

Check both the device settings and any work-app settings. Depending on the device and employer policy, you may be able to hide preview text, show notifications only after unlocking, or turn off lock-screen notifications for particular apps. Do not assume that changing one setting covers every app or connected device.

Test the result on an actual locked screen, as you would in a corridor or shared room. Send a test notification using non-sensitive content, lock the device, and check what appears. If you use a paired watch or another display, check that too. If the employer manages the device, some settings may be controlled centrally; ask IT rather than trying to bypass management.

Notification privacy is one layer of protection, not permission to put work data in an unapproved app. Hiding previews reduces what is visible at a glance, but it does not make an unapproved storage or messaging route suitable for confidential information.

What to do when the task cannot wait

Urgency does not turn an unsupported app or personal account into an approved system. If a task cannot wait, use the organisation’s established route for urgent work: for example, the relevant clinical escalation process, an approved on-call contact method, or a designated downtime procedure. Which route applies depends on your service and local policy.

If you cannot find the procedure, contact your manager, service lead or on-call support using a known, approved contact method. Explain the time pressure and the technical barrier. Ask for a specific decision: which system should be used, who can authorise it, and how the information should be recorded afterwards.

Do not send patient details to a personal account while waiting for a reply. If information has already gone to the wrong place, act promptly: stop further sharing, follow your organisation’s incident-reporting process, and contact the appropriate information governance or security team. Do not try to conceal the mistake or assume that deleting one copy has resolved it.

Make it easier to find a supported solution

When you raise tooling gaps with clear examples, the organisation can distinguish a one-off misunderstanding from a recurring problem affecting a team. You can make the report more useful by setting out the impact without including unnecessary sensitive data.

Include Example The work task “I need to review a rota document during an approved remote shift.” The approved tool and device “I used the organisation’s managed document app on an enrolled phone.” The limitation “The file opens, but the app does not support the required accessibility feature.” The operational impact “I cannot complete the review using the current supported workflow.” The decision needed “Please advise on an approved alternative or whether the app needs a change.”

Ask for the answer to be recorded in a place your team can find, such as a service notice, guidance page or agreed procedure. If a temporary workaround is authorised, clarify its limits: what information it covers, who may use it, how long it is allowed, where data must be stored, and how it should be removed or recorded. A temporary exception should have an owner and an end point.

A quick decision check

Before using any alternative route, ask yourself:

• Does my employer’s BYOD or device policy allow this device and task?
• Is the app or destination approved for this type of patient or organisational data?
• Will information remain in a managed location with appropriate access and retention controls?
• Could a notification, shared screen, paired device or personal app expose the content?
• Has the alternative been confirmed by an appropriate person or documented procedure?

If you cannot answer these questions, pause and ask. That is not a failure to be resourceful. It is a practical way to protect people’s information and keep work traceable.

Use ICO guidance alongside local rules

The ICO’s guidance on working securely and working from home securely is a useful reference for security habits and protecting information outside the usual workplace. It does not approve a particular app for your organisation, replace your employer’s BYOD policy, or tell you which local clinical system to use. Check the ICO’s current guidance and your employer’s information governance and IT instructions together.

The core approach is straightforward: stay within approved systems, keep work and personal use appropriately separated, check what the locked screen reveals, and report the feature that is missing. When the approved app cannot do what the job requires, ask for a supported solution rather than building a workaround that the organisation cannot safely manage.