Every home health clinician who plans their own visits carries patient information: a list of names, addresses, door codes, the days a patient has dialysis. The question is where. In the agency's EMR, it sits behind the agency's safeguards and contracts. In your phone's calendar, a notes app or a text thread, it usually sits behind neither.
This guide is for field clinicians, employed or PRN, who keep their own schedule. It covers what counts as protected health information in a schedule, what HIPAA asks of you and your agency, what a Business Associate Agreement is, and what to look for in a scheduling app.
A note on who is writing. I'm an occupational therapist and the founder of Logicly, a home health scheduling app for clinicians. This is not legal advice; your agency's privacy officer has the final word on what it allows.
The Short Answer
- A schedule is protected health information when it ties a person to their care: a name with an address and a visit time is enough.
- HIPAA doesn't ban phones. It requires safeguards, and it requires a Business Associate Agreement with an outside company that stores the information.
- A personal calendar or notes app usually has no agreement. Ask your agency before you use one for patients.
- Look for four things in any scheduling tool: a signed BAA, encryption, a lock when you put the phone down, and an audit trail.
- Lost phone? Tell the agency right away. Encryption is what keeps a lost phone from being a reportable breach.
What Counts as Protected Health Information in a Schedule
Protected health information is health information that identifies a person and is held by a covered entity, such as a home health agency, or its business associate. A visit schedule qualifies easily: a name, an address and "Tuesday 10 am, PT" says who is getting home health, where, and when. Add a diagnosis, a door code or "oxygen in use" and there is more of it.
You hold that information for the agency. If you are an employee, a volunteer or a trainee, or anyone whose work for the agency is under its direct control, you are part of its workforce under HIPAA (45 CFR 160.103), and its privacy rules are yours. If you are a contractor, you may be the agency's business associate and sign its terms. Either way, the information is the agency's patients', and so are the duties.
What HIPAA Asks For
Three rules matter for a clinician's phone:
- The Privacy Rule limits use and disclosure to what the job needs, the minimum necessary standard (45 CFR 164.502(b)). Your schedule needs names and addresses; it does not need the full chart.
- The Security Rule requires administrative, physical and technical safeguards for electronic protected health information, including access controls and encryption where reasonable (45 CFR Part 164, Subpart C). On a phone that means a screen lock, encryption, and apps that sign you out.
- The Breach Notification Rule requires notice when unsecured protected health information is lost or disclosed (45 CFR 164.400 to 414). Information encrypted to HHS's standard is not "unsecured," which is why encryption matters so much on a phone that can be left on a car seat.
What a Business Associate Agreement Is
When an outside company creates, receives, keeps or sends protected health information on behalf of a covered entity, it is a business associate, and HIPAA requires a written agreement with it: a Business Associate Agreement, or BAA. The company promises to safeguard the information, report breaches and use it only for the job.
This is the line that rules out most consumer tools. A free calendar, a notes app or a texting app on a personal account comes with terms of service, not a BAA. Google's own help page for Google Workspace, read on November 7, 2026, says its BAA covers certain Workspace services on its included list, and that customers who have not signed a BAA must not use PHI in those services. A personal Gmail account is not that.
Warning
Texts are the leak most clinicians don't think of. A coordinator texts a new patient's name, address and diagnosis. That message now sits on your phone, in your backups, and on any tablet or computer that syncs your messages. Move what you need into a protected tool and delete the text.
Where Patient Information Should Live
| Where | Fine for patient information? | Why |
|---|---|---|
| The agency's EMR | Yes | The agency's safeguards and contracts cover it |
| A scheduling app whose company signs a BAA with you, with encryption and a lock | Yes | It has the agreement and the safeguards HIPAA expects |
| The agency's own approved calendar or messaging tool | Yes, as the agency allows | The agency chose it and holds the agreement |
| Your phone's calendar on a personal account | Usually no | No BAA; syncs to other devices |
| A notes app or a photo of a referral | No | No BAA, no audit trail, often no lock |
| Texts | Only as the agency allows | Copies spread across devices and backups |
| A paper list in the car | Only as the agency allows | Easy to lose, impossible to lock |
What to Look For in a Home Health Scheduling App
Before you put a single patient in a home health scheduling app, check:
- A signed BAA. It should be offered to you, not only to agencies, and it should be in place before you add a patient.
- Encryption where the information is stored and while it travels.
- A lock. The app should sign you out or lock after a short time without use, and let you unlock with Face ID or a fingerprint so you are not tempted to turn the lock off.
- An audit trail of changes to patients and visits.
- What happens offline. If the app keeps a copy on the phone for dead zones, it should be locked and should not stay forever.
- Minimum necessary. A scheduling app needs names, addresses, dates and precautions. It does not need your visit notes.
How Logicly Handles It
Logicly is a home health scheduling app for clinicians who plan their own visits. You sign a Business Associate Agreement in the app before you add a patient, at no extra cost. Everything is encrypted where it is stored and while it travels, and every change to a patient or a visit is kept in an audit trail. Logicly signs you out after 15 minutes without activity, or locks if you use Face ID or a fingerprint, which never leave your phone. With Face ID on, it can keep a locked copy of your schedule and patients for use with no signal; the copy goes after 7 days without signal, and signing out removes it. Logicly is not an EMR: you chart in your agency's system, and each patient shows which agency that is.
A schedule with a BAA behind it
Sign the Business Associate Agreement in the app, then add your caseload. Encrypted, locked with Face ID, with an audit trail of every change.
Key Takeaways
- A name, an address and a visit time is protected health information when you hold it for an agency.
- HIPAA requires safeguards and a BAA with any outside company that stores it; it does not ban phones.
- Personal calendars, notes apps and texts usually have no BAA. Ask your agency what it allows.
- In a scheduling app, look for a BAA offered to you, encryption, a lock, an audit trail and a time limit on any offline copy.
- Report a lost phone to your agency right away. Encryption is what makes the difference.
Frequently asked questions
Is it a HIPAA violation to keep patient names in my phone's calendar?
It can be. A patient's name with an address and a visit time is protected health information when you hold it for a home health agency. HIPAA does not ban phones; it requires safeguards and, for an outside company that stores the information, a Business Associate Agreement. A personal calendar or notes app usually has neither an agreement nor the agency's approval, so ask your agency what it allows before you use one.
Is Google Calendar HIPAA compliant?
Not on its own. Google's help page for Google Workspace says its Business Associate Agreement covers certain Workspace services on its included list, and that customers who have not signed a BAA must not use PHI in those services. A personal Gmail account is not a Workspace account with a signed BAA.
What is a Business Associate Agreement?
A contract between a covered entity, such as a home health agency, or a business associate, and a company that creates, receives, keeps or sends protected health information for it. The company promises to protect the information as HIPAA requires, to report breaches, and to use the information only for the job. A software company that stores your patients' names and addresses should sign one.
What happens if I lose my phone with patient information on it?
Tell your agency right away; it decides whether a breach has to be reported. Under the HIPAA Breach Notification Rule, information that was encrypted to HHS's standard is not unsecured protected health information, which is why encryption and a screen lock matter. Information in an unlocked notes app is the case the rule is written for.
Sources
- 45 CFR 160.103 (opens in a new tab): definitions of business associate, protected health information and workforce.
- 45 CFR 164.502(b) (opens in a new tab): the minimum necessary standard; 164.504(e) (opens in a new tab): business associate contracts.
- 45 CFR Part 164, Subpart C (opens in a new tab): the Security Rule.
- 45 CFR 164.402 (opens in a new tab): breach and unsecured protected health information.
- Google Workspace Admin Help, "HIPAA Compliance with Google Workspace and Cloud Identity," read November 7, 2026.
- Related on this site: HIPAA compliance for home health agencies, the HIPAA checklist tool, route planning for home health visits.