Our company recently announced a new IT policy that requires encryption of any personal smartphone used to connect to the corporate Exchange server. As far as I can tell, they're using Exchange ActiveSync encryption.
Part of this new policy is that in the event you lose your phone, you must immediately report it to IT so that they can wipe all data, including personal data.
It is worth noting that our company does work with PHI data covered under HIPAA.
Are there any effective alternate strategies that would allow for employees to access email and calendars from personal smart phones, but which wouldn't expose employees to the risk of having their personal data wiped? Or is the ability to remote wipe all data on a potentially compromised phone an absolute requirement for security?