When a regional hospital network moved clinicians to remote work, the identity side was done in a week. The device side took a year, mostly because every check was a surprise to the people it blocked. We learned how to do it in the right order.
Four checks cover most of the risk: disk encryption enabled, screen lock with a short timeout, operating system within the patch window, and a managed browser or agent that can attest to the first three. Everything beyond that (specific antivirus products, certificate pinning, hardware tokens) is worth doing later and is not where the incidents come from.
The rollout order matters more than the checks. Start in observe mode: the Device Gateway records the posture of every device that connects and the Posture Engine reports what would have been blocked. Share the report with the people affected before enforcing anything. At a regional hospital network the first report showed 30 percent of devices out of the patch window; two weeks and one reminder later it was 4 percent, with no enforcement yet.
Enforce gradually and by consequence, not by cliff. A device that drifts out of policy first loses access to patient records and keeps everything else; a message explains which check failed and what to do. Most fixes are a restart. The help desk sees the hard cases only, which is what the help desk is for.
Personal devices need a decision rather than a loophole. If clinicians may use their own laptops, the same four checks apply through the managed browser, and that browser is the only way to reach patient records. If they may not, the Device Gateway says so plainly instead of failing in silence. Either policy works; silence does not.
Record posture with every access decision. When the HIPAA auditor asks whether the device that exported a record in March was encrypted, the answer is in the Device Registry, next to the identity and the approval, and nobody has to find the laptop.
If your last posture rollout ended in a help-desk flood, we would like to hear what broke. Get in touch; the comparison is useful to both of us.