Workplace messaging platforms such as Microsoft Teams have become a regular part of clinical work. Health care organizations rely on them to coordinate schedules, manage logistics, and keep teams connected across different locations and telehealth settings. Because these channels are closed to outsiders and separate from the electronic health record, clinicians may view them as informal, friendly, and private. However, it’s worth reconsidering that belief, as it is far from the truth.
Consider this example: In a private internal group, therapists and prescribers make jokes about alcohol use. One clinician shares openly about his own heavy drinking, and others join in with similar comments and encouragement. No patients are mentioned, and nothing is recorded in the medical record. Still, everyone in the chat works for the same organization and cares for the same patients, some of whom may have substance use disorders.
This article looks at three questions that come up in this situation:
- Are these chats private?
- What legal and regulatory risks do they pose?
- What ethical responsibilities come up?
A closed channel on a company platform is not legally private in any real sense. For example, messages sent through an organization’s Microsoft 365 system are usually treated as business records. The employer manages these messages, can store and search them, and may need to share them if required.
Real physician voices, twice a week
Free, and one click to unsubscribe.
Technical factors increase this risk. Forensic research shows that the Teams desktop app saves message content on the computer, and investigators can recover it. Deleting a message in the app does not erase it from the organization’s systems.
Many clinicians believe the Health Insurance Portability and Accountability Act (HIPAA) protects everything said inside a health care organization, but that’s not the case. The HIPAA Privacy Rule only covers patient health information that can identify someone. It does not protect what employees say about themselves or their opinions. Even for protected health information, HIPAA allows sharing if there is a court order, subpoena, or certain official requests. So, a chat about a clinician’s drinking is not specially protected by federal privacy law.
Several pathways could bring these messages into a legal dispute. Civil lawsuits are the most common way these messages might be used. For example, if a patient has a bad outcome and claims the clinician was impaired, the patient’s lawyer can ask for electronic messages about that clinician’s alcohol use. If a clinician talks about heavy drinking and others encourage it, this could support claims that the organization knew or should have known about a risk. This can lead to claims of negligent supervision or credentialing. Even if patient care was not affected, these messages can still damage the organization by shaping how a jury sees its culture.
Licensing and employment actions are another way these messages might be used. Licensing boards, HR investigations, and claims of wrongful termination or a hostile work environment can all use workplace chats as evidence.
Federal program oversight is a third, though less common, way these chats might be reviewed. Regular Medicare and Medicaid audits usually focus on billing, coding, and documentation, so they rarely include employee chats. However, fraud and abuse investigations under the False Claims Act and the Anti-Kickback Statute are broader, and investigators can ask for many types of organizational records. If messages show that an impaired clinician provided services and billed for them, those chats could become important.
Ethical issues often matter more than legal ones. Professional codes make it clear that clinicians should not ignore warning signs. The American College of Obstetricians and Gynecologists, following the American Medical Association Code of Medical Ethics, says doctors must act when they notice signs of impairment in colleagues. This includes helping with interventions, cooperating with investigations, and reporting to licensing boards if reasonable help does not work.
Current guidelines distinguish between illness and impairment. Impairment means someone cannot practice safely and skillfully. Joking about drinking does not automatically mean someone is impaired. However, if someone reports heavy use, is intoxicated near work hours, or shows changes in performance, a more serious response is needed. Behavioral health organizations face a unique challenge because their clinicians advise patients about alcohol risks, screen for unhealthy use, and treat substance use disorders. If the same team jokes about heavy drinking in a workplace chat, it can weaken professional standards and damage public trust if those messages become public. It could also discourage a struggling colleague from seeking help, since the group treats the behavior as a joke instead of a concern.
Closed workplace chats might feel private, but they are not. They are organizational records that can be found and are not protected by HIPAA. These chats can reveal information that creates professional duties to colleagues and patients. Research on messaging platforms as a source of health care liability is still limited, and most advice comes from legal and risk-management experts. Still, the main points are clear: Write as if your message could be read in a deposition, know the difference between a joke and a warning sign, and when you see warning signs, use confidential and supportive channels to protect both clinicians and patients.
This article is for general information and is not legal advice.
Timothy Lesaca is a psychiatrist in private practice at New Directions Mental Health in Pittsburgh, Pennsylvania, with more than forty years of experience treating children, adolescents, and adults across outpatient, inpatient, and community mental health settings. He has published in peer-reviewed and professional venues including the Patient Experience Journal, Psychiatric Times, the Allegheny County Medical Society Bulletin, and other clinical journals, with work addressing topics such as open-access scheduling, Landau-Kleffner syndrome, physician suicide, and the dynamics of contemporary medical practice. His recent writing examines issues of identity, ethical complexity, and patient-clinician relationships in modern health care. Additional information about his clinical practice and professional work is available on his website, timothylesacamd.com. His professional profile also appears on his ResearchGate profile, where further publications and details may be found.
