Notifications
Clear all
Topic starter
20/08/2026 5:46 pm
TL;DR: Slack retains PHI unless users or admins manually remove it, and Strac says its real-time deletion engine is meant to close that gap for messages, threads, files, images, and PDFs in HIPAA-sensitive environments. The governance issue is not just redaction speed but whether data handling in collaboration tools can be made compatible with lifecycle control and auditability.
NHIMG editorial — based on content published by Strac: How to Delete PHI in Slack Automatically
Questions worth separating out
Q: What breaks when PHI is shared in Slack without automatic deletion?
A: PHI can persist in messages, files, screenshots, and direct messages long after the original user intended it to disappear.
Q: Why do collaboration tools create HIPAA risk even when access is restricted?
A: Because access control only governs who can open a record, not where that record travels next.
Q: How do security teams know whether PHI deletion controls are working?
A: They should test whether the control catches text, files, and image-based content, then verify that deletions generate auditable events and consistent notifications.
Practitioner guidance
- Define PHI deletion policy for collaboration tools Document which message types, file formats, and content classes must be removed automatically, including screenshots, PDFs, and bot-generated posts.
- Test OCR coverage against image-based PHI Validate that detection works on medical images, scanned forms, and embedded text inside attachments, not just plain chat messages.
- Require auditable deletion workflows Ensure each deletion event records what was removed, which policy triggered it, and whether admins or users were notified.
What's in the full article
Strac's full product article covers the operational detail this post intentionally leaves for the source:
- Exact examples of Slack surfaces that the deletion engine monitors, including public channels, private channels, DMs, and group DMs
- Workflow detail for message deletion, file removal, user notifications, admin alerts, and HIPAA logging
- OCR handling for images and PDFs containing PHI, including how the detection and deletion sequence works
- Historical cleanup behaviour for previously stored PHI and how bulk removal is triggered
👉 Read Strac's article on automatic PHI deletion in Slack →
Slack PHI auto-deletion: what compliance teams need to know?
Explore further
20/08/2026 6:28 pm
Manual deletion is not a viable control for regulated collaboration data. Slack-style workflows assume that users or administrators can remove sensitive information after the fact, but that assumption breaks once PHI is shared across chat, files, images, and bot messages. The governance failure is persistence without deterministic removal. Practitioners should treat human cleanup as evidence of process intent, not proof of control.
A question worth separating out:
Q: Who is accountable when regulated data persists in a collaboration platform?
A: Accountability usually spans workspace administrators, compliance owners, and the teams that approved the retention model. If bots or automated workflows can introduce PHI, their permissions and outputs must also be governed. Under HIPAA-style controls, the organisation remains accountable even when a third-party platform stores the data.
👉 Read our full editorial: Slack PHI deletion exposes the limits of manual HIPAA cleanup
