Configuring Data Retention for Deleted Records

Changes Apply to Future Deletions Only

The retention period setting applies only to records deleted after the setting is saved. Previously deleted records retain the retention period that was in effect at the time of their deletion.

Example: If the retention period was 120 months when a patient was deleted, that patient record will be retained for 120 months regardless of subsequent changes to the setting.

Earlier Removal Requires Database Access

To remove previously deleted records before their scheduled expiration, manual intervention via the database is required. This is described in the Manual Database Cleanup section below.

How Deleted Records Are Stored

When a patient or user is deleted, the system creates a record in a dedicated collection:

• Deleted patients are stored in the deletedPatients collection
• Deleted users are stored in the deletedUsers collection
• Associated logs are marked with an expiration date in the logging collection

Each record includes an expiresAt field that indicates when the record becomes eligible for permanent removal.

Manual Database Cleanup

In some cases, you may need to remove deleted records before their scheduled expiration date. This can be accomplished by directly accessing the MongoDB database.

Prerequisites

• Access to the MongoDB database (typically via MongoDB Shell or a database management tool)
• Administrative privileges on the database
• Understanding of the implications of permanent data removal

Connecting to the Database

The MongoDB database runs inside Docker containers as a replica set. To access it:

1. Ensure Dermi Atlas Professional is running.
2. Open a terminal on the host computer.
3. Connect to the MongoDB container:

1. Authenticate and select the Atlas database:

Removing Expired Records

To remove all records that have passed their expiration date, run the following commands:

Remove expired deleted patient records:

Remove expired deleted user records:

Remove expired log entries:

Removing Specific Records Before Expiration

To remove specific records before their scheduled expiration, you can filter by additional criteria.

Remove a specific deleted patient by patient ID:

Remove all deleted records for a specific user (physician):

Viewing Pending Deleted Records

To view deleted records and their scheduled expiration dates:

List all deleted patients with expiration dates:

Count records expiring within the next 30 days:

Data Retention and Compliance

The retention period feature supports compliance with data protection regulations such as HIPAA and PIPEDA. Consider the following when setting your retention period:

• Regulatory requirements may mandate minimum retention periods for medical records
• Practice policies may require specific retention durations
• Storage capacity should be considered for long retention periods

Consult with your compliance officer or legal counsel to determine the appropriate retention period for your practice.