Kandji vs Rippling IT for an Outpatient PT Clinic Network
A physical therapy clinic's tablets don't belong to any one therapist. They sit in a charging dock between treatment rooms, get picked up by whoever's seeing the next patient, and stay logged into the charting software all day because nobody wants to re-authenticate between every fifteen-minute session. That shared, always-on pattern breaks a lot of device policy that assumes one person per device.
Before deciding between Kandji and Rippling IT, it's worth being honest about which security defaults you're actually willing to keep on a device that a busy clinic day will fight you over. A setting that looks reasonable on a security checklist and gets disabled by frustrated staff within a week isn't actually protecting anything.
Vendors Covered in this Article
Disclosure: We may earn a commission if you buy through some links on this page. It doesn't change what we recommend.
Shared devices need settings that survive a full clinic day, not just a security audit
A tablet that locks after two minutes of inactivity sounds reasonable until a therapist is mid-treatment and has to log back in three times in one session. Clinics that enable aggressive auto-lock on shared charting tablets usually disable it within a week because the friction is worse than the risk it prevents.
The realistic middle ground is a longer timeout paired with app-level restrictions, so the tablet stays usable between patients but can't be walked out of the building and used for anything else. Both Kandji and Rippling IT can configure that combination on managed iPads.
Test whatever timeout you land on during an actual busy Monday, not a quiet Friday afternoon. A setting that seems fine during a slow shift can turn out to be exactly the friction point that gets disabled once the clinic is back-to-back with patients.
Where Kandji fits a clinic network running iPads and Mac front-desk machines
If your clinics standardized on iPad for charting and Mac for the front office, Kandji's zero-touch enrollment means a new clinic's tablets arrive pre-configured with the right app locked in and the right restrictions applied, no unboxing checklist required. That's a real advantage when you're opening a new clinic location and want it charting on day one.
The fit weakens quickly if any clinic's billing software or referral portal turns out to be Windows-only, which is worth confirming across every clinic in the network before standardizing on an Apple-only platform, not just the flagship location.
Where Rippling IT fits once Windows enters the front office
Plenty of PT networks run practice management or billing software that's Windows-only, which puts a Windows machine at the front desk even in an otherwise Apple clinic. Rippling IT manages both from one console, and its HR link means a new front-desk hire's laptop is configured from the same record used to set up their payroll, which matters at a network that opens clinics and hires staff on a regular cadence.
A network hiring a front-desk coordinator at a new clinic every few months benefits the most from this link, since it removes a manual setup step from every single opening instead of just the first one.
What actually goes wrong when clinics roll this out themselves
The most common mistake is treating every clinic's rollout as a one-off instead of a repeatable process, so clinic five ends up with different restrictions than clinic one for no real reason. A close second is exempting the clinic director's personal laptop from the policy because they're senior, which means the one person with the broadest access to client data across locations is the least protected.
A third, quieter mistake is buying a platform and never actually locking the shared tablets into kiosk mode, leaving them as fully open iPads that happen to have an EMR app installed. The value of a platform like this comes from the restrictions it enforces, not just the fact that it's installed, so confirm the kiosk configuration is actually active at each clinic rather than assuming the default setup covers it.
Watch for these mistakes when a clinic network rolls this out itself:
- Treating each clinic's rollout as a one-off, so a later clinic ends up with different restrictions than the first for no real reason.
- Exempting the clinic director's personal laptop from the policy because they are senior, which leaves an exception at the top of the organization.
- Enabling aggressive auto-lock on shared charting tablets, which staff usually disable within a week because the friction outweighs the risk.
- Managing devices by hand past a third or fourth clinic, when the person doing it is also running daily operations.
When does a manual approach still make sense?
A single clinic with two or three shared tablets and one front-desk machine can genuinely be managed by hand, checking updates monthly and keeping a spreadsheet of what's installed where. That stops scaling around a third or fourth clinic, when the person doing it by hand is also trying to run daily operations. Price a dedicated hire against a platform honestly first: national wage data puts the median salary for a general operations manager, a role often asked to absorb this kind of cross-clinic duty, at $105,770 a year1.
Say your network is opening its fourth clinic and the clinic director who's been keeping the spreadsheet is also trying to hire and train new therapists for it. That's usually the point where the manual process quietly stops happening at all, not because anyone decided to abandon it, but because there's no time left in the week for it.
What Good Looks Like
A well-run PT network can show that every shared clinic device runs the same locked-down configuration regardless of which clinic it's in, and can remotely wipe any device the same day it's reported lost.
Building The Capability (5-Stage Skill Ladder)
How to Get Started
Disclosure: We may earn a commission if you buy through some links on this page. It doesn't change what we recommend.
If a clinic's front desk runs Windows alongside iPad charting tablets, Rippling IT covers both from one console and ties a new hire's laptop setup to the same record it uses for payroll.
If clinic staff payroll runs through Gusto, use its hire and termination events as the trigger for provisioning or wiping that clinic's front-desk device rather than tracking it by hand.
Frequently Asked Questions
Should charting tablets stay logged into the EMR all day, or log out between patients?
Most PT networks keep them logged in during clinic hours and rely on app-level session timeouts plus a locked kiosk mode instead of full device logout, since logging out between every fifteen-minute session is unworkable in practice. Confirm your EMR vendor's own session security recommendation, since some have specific guidance here.
How do we handle a tablet a therapist takes home to finish notes?
Treat it like any managed device leaving the building, with encryption and a passcode already enforced. Both Kandji and Rippling IT can also flag or restrict a device that stays outside expected network ranges for an extended period. Confirm both settings are in place before a therapist takes any tablet home.
Do we need different device policies for a home health or mobile PT division?
Usually yes. A mobile therapist's laptop or tablet travels to patient homes and can't rely on the clinic's Wi-Fi network for any part of its security, so it needs full-disk encryption and a stricter remote-wipe posture than a device that never leaves a building.
Sources
Where we quote a benchmark, we show its source. Other figures in this guide are estimates or general guidance, so check them against your own numbers.
- Annual wage, General and Operations Managers (SOC 11-1021), US all industries. BLS OEWS May 2025, 2025.
Related Guides
Justworks vs Rippling for a Multi-Clinic PT Network
A step-by-step guide for outpatient physical therapy networks weighing Justworks against Rippling for multi-state clinical staff payroll.
Rippling vs Firstbase for Outpatient PT Networks with Float Staff
Clinic-based therapists barely touch this problem, but float pool and home health staff do. Here's how an outpatient PT network should think about device tools.
Rippling vs Gusto for Outpatient PT Networks
A checklist for setting up productivity bonuses, PT Compact multi-state licensure, and PRN staff pay in Rippling or Gusto across a therapy network.
Make vs Zapier for Outpatient Physical Therapy Networks
Build a prior-authorization tracking worksheet for an outpatient physical therapy network to see exactly where Zapier, Make or Workato actually fits.
SOP Software Questions for Outpatient Physical Therapy Networks
Answers to what an outpatient physical therapy network asks when comparing Process Street and SweetProcess for documentation and authorization work.
Metabase vs Tableau for Outpatient Physical Therapy Groups
A decision guide for outpatient physical therapy networks weighing Metabase against Tableau to track visits per authorization and clinic comparisons.