Maya Patel from SecureHorizon Consulting is investigating a breach at Dallas General Hospital in Texas...

The most direct guideline is D. Register devices with a remote locate and wipe facility because the incident’s core impact came from two factors: loss of physical control of the device and continued exposure of sensitive records while the device remained active. A remote locate-and-wipe capability (commonly delivered through Mobile Device Management (MDM) / Enterprise Mobility Management (EMM) platforms) addresses both problems immediately: it enables administrators to identify the device’s last known location (or trigger location reporting) and, critically, to remotely lock or wipe the device to prevent ongoing unauthorized access to patient data.

In healthcare environments handling regulated data, the priority during a lost-device event is rapid containment. Even if device tracking alone can help find the phone, it does not guarantee that sensitive information stops being accessed during the search. Remote wipe (often paired with remote lock, enforced encryption, and policy-based access control) reduces exposure time by allowing responders to remove protected data and invalidate application access. This is particularly important when the device is still connected to the network, because an attacker (or unauthorized holder) could continue using cached sessions, stored tokens, or locally available records until access is cut off.

Why the other options are less direct: A (anti-virus/DLP) may help detect malware or control data movement, but it does not solve the immediate lost-device containment requirement. B (VPN on public Wi-Fi) is unrelated because the problem is physical loss and inability to control the endpoint. C (install tracking software) helps locate the device, but the scenario highlights that sensitive records were exposed for hours; the most direct impact reduction is achieved when the organization can both locate and wipe/lock the device through an enrolled, centrally managed capability.

Therefore, enrolling devices in a remote locate and wipe facility would have most directly reduced the breach impact.