A health service provider is considering the impact of allowing doctors and nurses access to the internal email system from their personal smartphones. The Information Security Officer (ISO) has…

Email system overload is an operational availability concern, not an information security issue, and is lower priority than data confidentiality risks in a healthcare context.

Personal smartphones vary widely in OS and hardware capabilities, meaning some devices will not support the MDM security policies (PIN enforcement, screen lock, remote wipe) described, creating uncontrollable compliance gaps.

Health data on personal devices significantly increases the risk of data leakage and makes sensitive information harder to control if a device is lost or stolen, even with remote wipe capabilities.

Radio frequency interference is a physical patient safety concern regulated separately from information security and is not within the ISO's information security purview.

Increased data usage costs are a financial and operational concern, not an information security risk.

Not all smartphone platforms and older devices natively support data-at-rest encryption, leaving health data potentially unprotected even when the email system enforces other policies.

While rogue access points are a valid security concern, they are not directly tied to the email access scenario described and are less probable than the selected concerns.