Having a policy and what happens in the real world are most of the time very different things (Understandably, as the line between work and personal time is often blurry).

True but one would hope though that people dealing with national security would follow more than your average employee.

> True but one would hope though that people dealing with national security would follow more than your average employee.

The more important you are the more you may think that exceptions can be made for you.

Then it seems the person is not suitable if they don't understand the gravity and their exposure

> Then it seems the person is not suitable if they don't understand the gravity and their exposure

So you're telling me / implying that sometimes people are sometimes promoted [1] or hired into positions that they are unsuited for?

[1] https://en.wikipedia.org/wiki/Peter_principle

From what I understood, he took his compromised work phone to the hospital, and the concern is that it may have recorded conversations that contained personal medical information.

He didn’t have medical information on the phone.

If you're off sick and need to provide a doctor's letter, at some point it will need to touch your employer servers. Just one example.