If you run under any regulation (PCI-DSS, HIPAA etc.) your PC will have to be hardened, have anti-virus, full disk encryption, 2 factor auth for remote connection and tick every other possible "security" box to be compliant.
Mobile well it's easy just have an MDM and do what ever the fuck you want, so if you want to use your laptop from the train in a regulated industry you'll have to stand on one foot, hold the laptop over your head while giving a blood sample to authenticate you and on the other hand you can just hope on your tablet/mobile phone connect to your office using VPN on-demand or even a regular web app (as long as it's SSL because dur-dur security!) and you're golden.
HIPAA endpoints that are used to access, view or input patient data are in scope.
I am a QSA.
A better alternative in a laptop form factor would be a zero client laptop, but they are very niche devices.
I didn't really go into detail about the full use case, they get other benefits from the overall snappy iPad experience in terms of switching apps, etc.
- Pre-boot authentication. - Windows sign-in - VPN two-factor sign-in - Web Portal access - Find your thing.
Best case, that process took 7-9 minutes, at a customer site using guest wifi or air-card in an office building, with a potentially angry customer. Not fun. The typical user does that 5-10 times a day, and in many cases the workers were actually preparing paper reports on their own time to function.
Enter iPad. Access was a snap, and it performed better with marginal cellular connections. Accessing the web portal did still require a two-factor challenge, but that two factor was effective for ALL of their internal access. We used a web browser that gave them a native iPad browsing experience (vs. an SSL-VPN'd IE) and access to several different systems via app.