Kandji vs Rippling IT for a Remote Behavioral Health Group

Most device management platforms, Kandji and Rippling IT included, are built around enrolling and configuring hardware the organization owns. A behavioral health group with a mostly 1099 or remote W-2 clinician base often owns almost none of the laptops its clinicians use, which means the platform's core strength, zero-touch provisioning of new company hardware, doesn't apply to most of the fleet.

That doesn't make either platform useless here, but it does mean the sales pitch built around new-hire hardware showing up pre-configured largely doesn't apply to your situation. Evaluate them instead on how well their lighter-weight compliance enrollment works, since that's the feature you'll actually be using most.

Rather than managing a personal laptop outright, most groups set minimum requirements: current operating system, disk encryption turned on, a passcode, and antivirus software, verified through a lightweight enrollment that checks compliance without taking full control of the machine. Both Kandji and Rippling IT support this kind of limited, compliance-only enrollment, which is a very different posture from managing an office fleet.

The clinician's experience matters here too. A compliance check that runs quietly in the background and only flags a problem when something's actually wrong is far more likely to stay installed than one that feels intrusive, since a remote clinician who never sees an in-person IT presence has an easy path to simply uninstalling anything that annoys them.

Put the requirement in writing as part of the contractor or offer agreement, not just as a verbal expectation during onboarding. A clinician who agreed in writing to maintain a specific security baseline is a very different conversation than one who's being told about it for the first time after an incident.

A minimum bar for a clinician's personal laptop can include the following:

• A current operating system, kept up to date, so known vulnerabilities are not left open on a machine that touches client information.
• Disk encryption turned on, so client information stays protected if the laptop is lost or stolen.
• A passcode or password required to open the machine before anything stored on it can be viewed.
• Antivirus software installed and running on the personal machine.
• A lightweight enrollment that verifies these checks without taking full control of the clinician's personal laptop.

Full-time clinical staff and administrative roles, the practice's intake coordinator or billing lead, are different from a roster of independent contractors. For those roles, issuing a company laptop and managing it fully removes the ambiguity entirely, and it's worth doing for anyone who handles client records as a core, ongoing part of the job rather than a contractor logging into a portal a few hours a week.

Draw the line by role, not by seniority. A senior clinician who sees a handful of clients as an independent contractor is still a BYOD case, while a newer full-time intake coordinator handling records all day is a company-hardware case, and mixing those up in either direction creates gaps or unnecessary friction.

It matters more for full-time staff than for contractors, since contractors typically aren't run through the same payroll system. For the administrative and clinical-staff side of the practice, Rippling IT tying a new hire's laptop setup to the same record used for payroll removes a manual step that's easy to forget when nobody's ever in the same building to hand over a device.

A practice growing its clinician roster without a compliance check in place is relying on trust alone, and that gets harder to justify as headcount grows. Filling a dedicated compliance or office manager role to own this takes real time: SHRM's 2025 benchmarking puts the median time-to-fill for a nonexecutive position at 44 days from the requisition opening to an offer accepted¹. A lightweight compliance-check platform is usually running well before that hire would even start.

That's not an argument against ever hiring for this role, since a growing group eventually needs someone who owns compliance policy, not just the technical enrollment. It's an argument for sequencing: put the automated check in place first, then hire the person to manage exceptions and policy once the group is large enough to need one.