HIPAA does not set a retention period for chat messages. It requires covered entities to keep their HIPAA documentation (policies, risk analyses, training records and similar) for six years, and your state sets how long medical records must be kept. Staff chat is neither, unless something in it belongs in the chart. A sane default: keep staff chat for one year, copy anything clinical into the record, and keep a legal hold switch for complaints or lawsuits.
Three rules people mix up
Retention questions get tangled because three different rules sit next to each other. Only one of them is HIPAA, and it is not about messages.
The terms matter here. A covered entity is a practice or other provider that must follow HIPAA. Protected health information (PHI) is any information that identifies a patient and relates to their health or care. A Business Associate Agreement (BAA) is the contract in which a vendor, such as your chat provider, promises to protect PHI the way HIPAA requires.
| Rule | What it covers | How long |
|---|---|---|
| HIPAA documentation retention (45 CFR 164.316 and 164.530) | Your policies, procedures, risk analyses, training records, BAAs, breach assessments | Six years from creation, or from when the document was last in effect |
| State medical record retention | The patient's chart | Set by your state and licensing board; varies, often longer for minors |
| Chat retention | Staff messages in your team chat | Not set by HIPAA. You decide, in writing |
Your BAA and your retention policy are documents; your chat messages are data. HIPAA tells you to keep the documents.
Is a chat message part of the medical record?
Usually not, and your policy should say so clearly. A message that says chart 4471 needs a callback is coordination, not clinical documentation. The callback itself gets documented in the chart. The problem starts when staff treat chat as the record: a dosing decision discussed only in a thread, a photo of a wound that never reaches the EHR. Then the chat becomes the only copy of something your state says you must keep for years.
The fix is a one-line rule: anything clinical goes in the chart first, and the chat only points to it. With that rule in place, deleting chat on a schedule does not delete medical records, because there were never any in it.
A default retention policy for staff chat
There is no legally required number, so pick one you can defend and apply it consistently. A sensible default for a small practice:
- Messages and files in staff chat are kept for 12 months, then deleted automatically.
- Anything clinical is entered in the medical record at the time it happens; chat is not a medical record.
- The audit log is kept for six years with the other HIPAA documentation, so you can show who had access even after messages are gone.
- If a complaint, lawsuit, investigation or breach is suspected, a legal hold pauses deletion immediately.
- Departing staff do not take exports; their access ends on the last day and the messages stay under the practice's control.
Why 12 months: it is long enough to settle a scheduling dispute or reconstruct what happened before an incident, and short enough that you are not storing years of PHI you no longer need. Minimum necessary applies to what you keep, not only to what you send.
Legal hold: the pause button
A legal hold is a setting that stops automatic deletion for a workspace, a channel or a person, so that evidence is preserved. You turn it on the day you learn of a complaint, a records request or a possible breach, and you leave it on until your attorney says the matter is closed. Deleting messages on schedule after you knew about a dispute looks like hiding something, even when it was only the retention policy doing its job.
Look for retention controls and legal hold on whatever plan you buy, not only the enterprise tier. Yodl includes both on every plan, with an audit viewer that exports to CSV; Enterprise adds custom retention terms.
What to do with messages when staff leave or a location closes
Messages belong to the practice, not the person who typed them. When someone leaves, remove their account and keep the messages in place under the normal retention schedule. Do not export a copy to the departing person. When a location closes, archive its channels, keep them for the rest of the retention period, and let the schedule delete them. Note the dates.
The policy paragraph, ready to paste
Paste it into your internal communication policy, fill in the brackets, and set the tool to match the number you chose. The policy and the setting must agree; an auditor will check both.
How to check that it is actually working
- Once a quarter, confirm in the admin panel that the retention setting still equals the policy number.
- Open the audit viewer and export the last quarter to your HIPAA folder.
- Pick one old message and confirm it is gone on schedule.
- Review the legal hold list: anything still on hold should have an open matter attached.
Four checks, ten minutes, four times a year. If you need a chat tool that lets you do all of them, Yodl is $10 a month for 5 people with a signed BAA, on the pricing page.
HIPAA keeps your documents for six years and your state keeps the chart; chat is yours to decide. Keep staff chat about a year, keep clinical facts in the record, keep the audit log, and pause everything with a legal hold the day a dispute appears.
Frequently asked questions
Does HIPAA require us to keep chat messages for six years?
No. The six-year rule covers HIPAA documentation such as policies and risk analyses. Chat messages are not on that list unless you have made them part of your records.
Can we delete chat messages after 30 days?
You can, as long as nothing clinical lives only in chat and the policy says 30 days. Many practices find a year more useful for resolving disputes.
What if a patient requests their records and some discussion is in chat?
The medical record is what you produce. If clinical information exists only in chat, that is a documentation gap to fix. Talk to your attorney about what to include in the response.
Does deleting messages delete the audit log?
It should not. Ask your vendor to confirm that the audit log is kept separately, so you can show who had access after the content is gone.
Who should be able to change the retention setting?
Owners or a single named admin. Record who changed it and when, and never change it while a legal hold is active.