Reconciling Retention Obligations for a Patient Portal Vendor
Medway Health's patient check-in portal, built and hosted by a third-party SaaS vendor, handles 45,000 appointments a month. A privacy impact assessment found the vendor stores application logs containing patient identifiers in a US region, while Medway's policy requires Canadian residency for personal health information. The vendor offers three log tiers: 7-day hot retention, 30-day warm retention, and a "compliance archive" at extra cost with 400-day retention but no documented integrity controls. The regulator requires 10-year retention of access records for certain record classes but only 6 months for diagnostic logs, and Medway's legal team has issued a litigation hold covering 18 months of data for one clinic. The vendor's API returns only 30 days of logs, while the SIEM team wants real-time streaming to detect unauthorised record access. The contract renews in 60 days.
1. How do you turn four overlapping retention and residency obligations into a defensible requirement set?
Read the worked answer
The mistake would be to pick the longest period and apply it to everything - that inflates the residency exposure and the archive cost, and it still fails the litigation hold, which is scoped to one clinic.
Method:
- Classify by record type and purpose, not by system. Three classes fall out: access records for the regulated record classes (10 years), diagnostic/operational logs (6 months), and the litigation-hold subset (one clinic, 18 months, preserved separately and immune from routine deletion).
- Write separate requirements per class, each with the residency obligation attached: where the class contains patient identifiers, it must be stored and processed in Canada, which converts the vendor's US-hosted archive into a non-compliant option for classes 1 and 3.
- Handle the legal hold as an exception mechanism, not as a retention period: the system shall support per-custodian preservation that suspends routine deletion and is released only on written instruction from legal. A retention rule that simply deletes at 400 days will destroy held evidence.
- Resolve the API gap explicitly. Real-time streaming is a requirement in its own right (detection latency), independent of retention; the fact that the vendor returns 30 days today is a current-state finding, not the requirement.
- Log the conflicts in a decision table with the legal, privacy and security positions and the sign-off, so the eventual compromise is auditable.
2. What must the renewal requirements say about the vendor's claims for residency and archive integrity, and how are those verified?
Read the worked answer
Vendor assurance claims are not controls. Each one needs a verification method written into the requirement.
- Residency: all log data containing patient identifiers shall be stored and processed exclusively within Canada, including backups, replicas and support-access paths. Verification: a written data-flow description naming regions and sub-processors, plus a contractual commitment with notification of change. Support access from outside Canada is the usual gap - ask about it specifically, because a Canadian bucket with US-based engineers still fails the policy.
- Archive integrity: "no documented integrity controls" is the finding. Requirement: archived records shall be tamper-evident and retrievable within a stated time, with integrity verification recorded. Verification: evidence of write-once storage or cryptographic chaining, plus a tested retrieval of a sample record with its integrity proof - a live test, not a description.
- Right to audit / attestation: the requirement names the accepted evidence (an independent report covering the log service, or a right-to-audit clause), because otherwise the answer arrives as a sales email.
- Deletion and release: the vendor shall certify deletion at end of term and support legal-hold suspension, verified by a documented process and an exit test.
Each of these becomes a mandatory, not desirable, clause, and each appears in the evaluation matrix with pass/fail rather than a score - a score lets a weak residency answer be offset by a good price.
3. The vendor says Canadian residency and integrity controls cannot be delivered by the renewal date. What do you recommend, and how do you document it?
Read the worked answer
First, establish whether the gap is real or a negotiating position: ask for the specific constraint (region availability, archive product, roadmap date) in writing. That answer determines which option is honest.
Options, with the trade-off stated:
- Interim: move the residency-critical logging in-house. Stream events to a Medway-controlled Canadian collector and restrict the vendor to the 7-day hot tier for operational purposes. This meets residency and detection latency; it costs engineering effort and leaves the 10-year archive as Medway's obligation - arguably where it belongs, since the regulator's obligation is Medway's, not the vendor's.
- Contractual: accept a dated remediation plan with service credits and a termination trigger, plus compensating controls. Defensible only if the privacy office formally accepts the interim residency breach, which is a decision they must make, not the project.
- Exit: invoke the renewal as a lever and evaluate alternatives. Slower, but the 60-day date is a commercial fact, not a regulatory one; the regulator will not extend a deadline because a contract term was inconvenient.
Documentation: a decision record states the chosen option, the obligations it does and does not meet, the compensating controls, the risk owner and the review date. The unmet obligations become explicit, accepted risks with a named owner - the outcome to avoid is an assumption buried in a requirements document that nobody signed.