Start with your employer’s phone policy and use only approved systems for...

https://sierra-wiki.win/index.php/What_Does_the_ICO_Say_About_Using_a_Personal_Device_for_Work_Data%3F

Start with your employer’s phone policy and use only approved systems for patient information. Turn off lock-screen previews, set clear on-call notification rules, and check the selected account before sharing so work details stay in the right place.