Message retention policy

A message retention policy sets how long an organization keeps staff chat messages, files and voice notes, and when they are automatically deleted. The practice usually writes the policy down as part of its broader records policy, then enforces it through retention settings in the messaging tool its staff use.

In practice at a clinic or small practice

Front desk staff usually notice the policy when an old thread about a schedule change or a supply order is no longer there. The office manager or IT contact chooses the period based on the practice's own records policy. For example, they might set 90 days for routine coordination channels. That figure is an illustration, not a recommendation. Over time, staff learn that chat is not the place to keep anything that belongs in the record.

The length of the period is a tradeoff. Shorter retention reduces how much protected health information (PHI) sits in chat if someone mentions a patient detail in passing. Longer retention makes it easier to look up who agreed to cover a Saturday shift, or to reconstruct events during an internal investigation. Many tools combine a workspace-wide default with shorter limits for specific conversations, such as a channel used only for same-day front desk coordination.

Here is one example of how a tool handles this. On Chanty Business and Enterprise plans, admins can set workspace-wide retention, for example 30, 90 or 365 days, or unlimited. Users and admins can set conversation-level retention from 1 minute up to 90 days, or unlimited. Retention applies to messages, files, voice notes, tasks and Teambook.

Whatever period a practice picks, clinical information belongs in the EHR. Staff chat is for operational coordination.

Not to be confused with

• Medical record retention. This is how long a patient's record must be kept. State law and payer rules generally set it, and the record lives in the EHR. A chat retention setting does not satisfy or replace it.
• Legal hold. This is a temporary instruction to preserve specific data because of litigation or an investigation. A legal hold overrides normal deletion for the data it covers. A retention policy is the everyday default.
• Backups and archives. These are copies kept for recovery and follow their own schedules. The retention period users see in chat does not by itself tell you when every copy is gone. Ask the vendor how deletion applies to backups.

What the rules say

"Message retention policy" has no legal definition in HIPAA. The term is industry usage. The rules that do apply:

• HIPAA documentation. Covered entities and business associates must keep required policies, procedures and other required documentation for a stated period. This requirement applies to HIPAA documentation, not to every chat message staff send.
• Medical records. HIPAA does not set a retention period for medical records. State law does.
• Safeguards for stored messages. The HIPAA Security Rule includes audit controls that record and examine activity in systems containing ePHI. It also includes integrity protections that guard ePHI from improper alteration or destruction.
• Disposal. Organizations need policies for the final disposal of ePHI and of the hardware or electronic media it is stored on.

Before choosing retention periods, check your state's law, any payer or contract terms, and your existing records policy, and talk to counsel. A retention setting is one safeguard among many. It does not make a practice HIPAA compliant by itself.

Related reading

• HIPAA-compliant messaging explains what a staff messaging tool needs before it handles PHI.
• The security, HIPAA and BAA details page shows how retention fits alongside a vendor's other safeguards.
• Browse more terms in the Healthcare operations glossary.