I think you hit it right on the head, Liz. She could opt to only use the Company provided device, when she was working for the Company. Leave it at her desk, or at home during off hours, and use her personal devices for personal communications.
As for employment, she works at the pleasure of her Employer, and if she tampers with Company property (the provided I Phone), and does not follow other procedures without some complaints, she is not doing her job, from the Employers viewpoint, and the employer can legally let her go, following that Companies usual procedures for such personnel action.
Company provided vehicles are often monitored 24/7 by GPS that reports the history, including time of day, exact location, and other information. If personal use of the vehicle is allowed, the GPS continues to track the date, and such date is stored, available for recall for a Authorized person. I would think the same would apply for a provided device, be it a phone, computer, or vehicle.
Like any personnel action, one would expect some confidential steps be taken for access to off duty hours of operation, and that that info would not be publicly available for any but specifically Authorized use.