A healthcare organization processes patient records with varying retention requirements. Clinical records must be kept for 7 years, billing records for 10 years, and research datasets must be anonymized and retained indefinitely. The data team is planning the data lifecycle management strategy. What are the key considerations that should guide the retention and disposition policies?
Correct Answer:
A
Effective data lifecycle management requires balancing multiple factors: regulatory and legal requirements (which differ by data type and jurisdiction), legitimate business needs (how long the organization needs data to operate), storage costs (economic optimization), and contractual obligations (agreements with patients, partners, or regulators). When data is no longer needed, it must be securely disposed of and the action logged for audit trails. The healthcare scenario illustrates this clearly: clinical, billing, and research data have different lifespans based on law and use case. Keeping all data indefinitely wastes resources and increases privacy risk; one-size-fits-all schedules ignore legal differences; premature deletion violates regulations and creates legal liability; and ignoring business or contractual needs can harm operations or breach agreements.
