What should I do before I share a photo or document from my phone at work?

A photo of a wound, a screenshot of a rota, or a document sent for a quick review can contain more information than you intend to share. The risk is not only choosing the wrong recipient. It can also be choosing the wrong app, sharing an unedited image, or sending from the wrong account.

Before sharing anything connected with patient care or your organization, pause and check three things: the content, the share destination, and the account you are signed in to. Use only approved tools, and follow your employer’s device and bring-your-own-device (BYOD) policy.

This practical checklist is informed by the Information Commissioner’s Office (ICO) guidance on working securely and working from home securely, as well as UK GDPR principles. Your organization’s policies and clinical procedures take priority. If you are unsure whether a particular phone, app, or transfer method is allowed, ask your manager, information governance team, or IT service desk before sending the material.

1. Start with your employer’s BYOD and device policy

Do not assume that a phone is suitable for work simply because it has a passcode or because a colleague uses theirs. Your employer may allow personal devices for some tasks but prohibit them for patient information, photography, or document storage. It may also require mobile device management (MDM), encryption, a screen lock, or the ability to remove work data remotely.

Check the current policy, not a remembered version. Find out:

• Whether your personal phone may be used for work at all.
• Which types of information you may access, photograph, store, or send from it.
• Which approved apps, accounts, and systems you must use.
• Whether work data is kept in a managed area separate from personal data.
• What to do if the phone is lost, damaged, shared with someone else, or suspected of being compromised.

If your organization issues a device, use it as directed. If personal devices are not approved for the task, do not create a workaround by sending the file to personal email, a consumer messaging app, or a private cloud account. A convenient folder does not make information secure or an app approved.

2. Use approved tools for patient and organizational data

Use only the tools your employer has approved for the information and purpose involved. That might mean a clinical record system, a secure file-sharing service, or an organization-managed messaging platform. Approval matters because the organization can set access controls, manage accounts, retain records appropriately, and respond if something goes wrong.

Before you tap Share, confirm the share destination. The first option shown may be a recent contact, a personal app, or a service you used for something unrelated. The share sheet is a menu, not a safety check.

1. Open the approved app or service you intend to use.
2. Select the intended recipient or destination from within that service, where possible.
3. Check the recipient’s name, address, team, or record carefully, especially where names are similar.
4. Check that the recipient is authorized to receive the information and needs it for their role.
5. Review the attachment and message before sending. Confirm the correct file is attached and that the message does not include unnecessary details.

Do not rely on autocomplete, a familiar profile picture, or a recent-recipient list. I've seen this play out countless times: made a mistake that cost them thousands.. If the destination looks unfamiliar, stop and verify it using your organization’s approved contact directory or another established channel.

3. Check the account you are signed in to

A phone can have several accounts active at once: work and personal email, more than one cloud-storage account, or multiple profiles in the same app. The app name alone does not tell you which account will send or store the file.

Before sharing, check the signed-in account in the app you are using. Look for the account name or address in the profile or settings area. Confirm that it is your organization-managed account, if that is what the approved process requires. If you cannot tell which account is active, do not send the file until you have checked.

Also check what happens after sharing. Some phones or apps may offer to save a copy to a personal photo library, downloads folder, or cloud backup. Follow your organization’s instructions for storage and deletion. Do not assume that deleting a message removes every copy, backup, or recipient download.

4. Separate entertainment from clinical work

Many people use one phone for both personal and work activity. That makes clear boundaries important. Keep clinical or organizational work inside the approved work app, profile, or managed space where your employer provides one. Do not move work files into personal photo albums, consumer messaging apps, personal cloud storage, or social media just because they are easier to open.

Keep personal and work accounts distinct. Sign out of personal services before a work task if that helps avoid selecting the wrong account, but do not change device settings in a way that breaks required security controls. If you are not sure how your managed work area behaves, ask IT or information governance to explain it.

Be particularly cautious with screenshots. A screenshot can capture more than the item you meant to share: names in the background, a patient list, a notification banner, browser tabs, or part of another record. Crop or redact only if your organization’s approved tools and process allow it. Do not rely on a black mark, blur, or crop that can be reversed or removed from the original file. When possible, create a clean copy with only the necessary information, using an approved method.

5. Review the photo or document itself

Check that the the file is appropriate to share and contains only what the recipient needs. A useful test is: “If this reached the wrong person, what would it reveal?” Look for identifiers and details outside the main subject, including labels, screens, paperwork, reflections, whiteboards, and background audio or conversation in video.

For a photo, check the full image rather than only the preview. Confirm that the correct person or item is shown and that no other patient or staff information is visible. A photo may also include location or other file details. Follow your employer’s rules on whether such images may be captured or sent from a phone.

For a document, check the file name, pages, and content. Look for hidden comments, tracked changes, extra tabs, or information in document properties if relevant. Verify that the recipient has permission to view the file. Share the minimum necessary information for the task, using the organization’s approved process.

6. Protect lock-screen previews and notifications

Lock-screen notifications can reveal message text, names, appointment details, or document previews to anyone who can see the phone. This can happen in a staff room, at a reception desk, on public transport, or at home when another person picks up the device.

Review notification privacy in your phone’s settings and in work apps. Options vary by device, but you may be able to hide sensitive content while the phone is locked, show only that a notification arrived, or turn off previews for particular apps. Follow your employer’s requirements, especially if it manages the device.

Test the setting on an actual locked screen. Send a test notification from an approved source or ask a colleague to help, then lock the phone and check what is visible without unlocking it. Do not assume a setting has worked because its label sounds right. Repeat the check after a software update or a change to notification settings.

Use a strong screen lock and set the phone to lock automatically after a short period, in line with your organization’s policy. Keep the device physically secure. A hidden preview does not protect a phone that is left unlocked on a desk.

7. Quick checks before you send

Use this short pre-send check when time is tight. It is not a substitute for your organization’s policy, but it helps catch common errors.

Check Question to ask If the answer is unclear Policy Is this phone and activity allowed under the BYOD or device policy? Stop and check with your manager, IT, or information governance. Tool Am I using an approved tool for this kind of information? Do not switch to personal email or an unapproved app. Account Am I signed in to the correct work account? Check the account in the app before selecting a file or recipient. Destination Is this the correct, authorized recipient or location? Verify it through an approved directory or process. Content Does the file show only what the recipient needs? Review the full file and remove unnecessary information using an approved method. Notifications Could sensitive content appear on the lock screen? Adjust the settings and test them on the locked phone.

8. If you send it to the wrong place

Act promptly. Follow your organization’s incident-reporting process and contact your manager, information governance team, or IT service desk. Provide the facts: what was shared, when, through which tool, who received it, and what steps you have already taken. Do not wait to see whether anyone notices.

Do not try to hide the incident by deleting messages or share menu wrong account asking the recipient to keep quiet. If your organization’s procedure allows you to recall a message or restrict access, use that process and report what you did. A recall may not remove downloaded copies, screenshots, or notifications, so it is not a substitute for reporting.

The ICO provides practical guidance on information security, including working securely and working from home securely. Its guidance is useful for understanding safe handling, access, and device practices, but your employer is responsible for setting the approved local process. If a task cannot be completed using an approved tool, ask for a safe route rather than improvising.

Make the pause part of the routine

Before sharing a work photo or document from your phone, check the policy, use approved tools, keep work separate from personal activity, and verify both the account and the share destination. Then review the file and consider what appears on the locked screen. A short pause can prevent a misdirected message, an avoidable disclosure, and a difficult clean-up later.