Admin guide
Nightschool AI: Claude data retention and HIPAA-ready Enterprise, for admins
Retention and HIPAA-ready are Enterprise settings, and each one has a single role that can change it.
Custom data retention in Anthropic's Claude is an Enterprise feature: an Owner or Primary Owner sets it, the minimum is 30 days, and without it data is kept indefinitely. HIPAA-ready is also Enterprise only; only the Primary Owner can accept the BAA. Team plans can't enable HIPAA.
Published
Key Takeaways
- Custom retention: Enterprise only, set by an Owner or Primary Owner, minimum 30 days.
- Shortening retention schedules older data for permanent deletion as soon as you save.
- HIPAA-ready: Enterprise only, and only the Primary Owner can accept the BAA and enable it.
- Org data exports include conversation data and are limited to the Primary Owner.
The full guide
Tap any section to open it.
About this guide
This page is for the admin asked how long Anthropic's Claude keeps company data and whether the workspace can handle health information. It lists what Anthropic says admins can set, who can set it, and what a Team plan cannot do. It is not legal advice, and turning a setting on does not make your use compliant.
RetentionWhat you can set for data retention
Anthropic says custom data retention is available to Enterprise plan customers, and that you need the Primary Owner or Owner role to set it. The pricing page lists custom data retention controls for Enterprise and not for Team.
The setting is in Organization settings, Data and Privacy. The minimum retention period is 30 days, and each month is counted as 30 days, so three months means 90 days. By default, data is retained indefinitely unless a custom period is set.
Custom periods apply to content in chats, projects and artifacts. Anthropic lists exceptions, including features that run Claude Code in the cloud, and notes that content flagged by trust and safety systems or required by law may be kept.
Before you saveShortening retention deletes data, and you cannot undo it
When you shorten a retention period, Anthropic says any data outside the new period is scheduled for permanent deletion as soon as you save. A daily background process removes it, which can take several days for large amounts of data.
Anthropic tells admins not to rely on that delay to reverse the change, and says data past its retention period cannot be recovered. Get written sign-off from legal or records management before you shorten the period.
Chats inside a project follow the project's retention, and projects are kept indefinitely by default. Set the project period as well if you want project chats to age out.
HIPAA-readyWho can enable the HIPAA-ready Enterprise plan
Anthropic says the HIPAA-ready feature is available for Enterprise plans only, both self-serve and sales-assisted. Team plans and individual plans (Free, Pro, Max, and Ultra) can't enable HIPAA.
Only the Primary Owner of the organization can accept the BAA and enable HIPAA; other Owners or Admins cannot complete the flow. The Primary Owner goes to Organization settings, Data and privacy, opens HIPAA Compliance, reviews the BAA and Implementation Guide, and accepts.
If your organization signed a BAA for Claude API usage before December 2, 2025, Anthropic says it covers API usage only and does not extend to the Enterprise plan. You would need a new BAA with your account team.
Enabling HIPAA is a one-way decision. Anthropic says that once HIPAA is enabled and the BAA is accepted, the change can't be reversed from organization settings, and it calls this an irreversible organization transition. Enabling it also resets certain settings across your organization back to defaults, so read the onboarding modal and the Implementation Guide for exactly which ones before the Primary Owner accepts.
CoverageEnabling HIPAA does not cover every feature
Anthropic sorts features into three groups: covered by your BAA, available but not covered, and disabled. The Implementation Guide on the Anthropic Trust Center is the list it calls authoritative, so read it before anyone handles protected health information.
Enabling HIPAA alone does not bring Claude Code or Cowork under the BAA. The Primary Owner must also apply a HIPAA configuration for their local modes. After that, cloud features such as Claude Code cloud sessions and Cowork in the cloud are not available, and the Primary Owner cannot remove the configuration.
ExportsWho can export what
Anthropic says organization data exports are only available to Team and Enterprise plan Primary Owners, and that they include conversation data and the user data for your organization. The download link expires 24 hours after delivery.
Primary Owners and Owners can also let users export their own data. The switch is Allow members to export their own data, in Organization settings, Data and privacy. Our page on whether an employer can see Claude chats covers this from the staff side.
ChecklistData settings checklist you can copy
Fill this in before anyone changes retention or enables HIPAA.
1. Confirm the plan
Retention controls and HIPAA-ready both need Enterprise. A Team plan has neither.
2. Name the roles
Owners or the Primary Owner set retention. Only the Primary Owner can accept the BAA.
3. Pick a period
At least 30 days, counted in 30-day months. Set chat and project periods separately.
4. Get sign-off
Shortening deletes data as soon as you save. Record who approved it and when.
5. Read the guide first
Enabling HIPAA can't be reversed from organization settings and resets some org settings. Before the Primary Owner accepts, read the Implementation Guide and note which features are covered, not covered or disabled.
6. Export rules
Record who the Primary Owner is and whether members may export their own data.
SourcesWhere each fact comes from
Anthropic, "Configure custom data retention controls for Enterprise plans": support.claude.com/en/articles/10440198. Anthropic, "HIPAA-ready Enterprise plans": support.claude.com/en/articles/13296973.
Anthropic, "Export your organization's data": support.claude.com/en/articles/13346720. Anthropic, "Plans and pricing": claude.com/pricing.
Each fact on this page was read on that vendor page on 2026-11-08. Settings pages move and plans change, so open the source and your own admin console before you rely on a detail here.
Train the admins, then the people they support
This page covers one admin task. The Nightschool AI admin and governance course walks the whole Team and Enterprise setup in order: sign-in, provisioning, connectors, data, and Claude Code, with every step checked against Anthropic's own documentation.
Frequently Asked Questions
What is the minimum custom retention period in Claude?
30 days. Anthropic says each month is counted as 30 days, so a three-month period equals 90 days. The setting is in Organization settings, Data and Privacy, on Enterprise plans.
How long does Claude keep data by default?
Anthropic says that by default data is retained indefinitely unless a custom retention period is set. Custom periods are an Enterprise feature.
Can a Claude Team plan set custom retention?
No. Anthropic's retention article says the feature is available to Enterprise plan customers, and the pricing page lists custom data retention controls for Enterprise and not for Team.
Can a Claude Team plan be HIPAA-ready?
No. Anthropic says Team plans and individual plans (Free, Pro, Max, and Ultra) can't enable HIPAA. The HIPAA-ready offering is for Enterprise plans only.
Who can accept the BAA for Claude Enterprise?
Only the Primary Owner of the organization. Anthropic says other Owners or Admins cannot complete the flow on the organization's behalf.
Does HIPAA-ready make our use of Claude compliant?
No setting does that on its own. Anthropic says enabling HIPAA does not bring every feature under the BAA, and points admins to its Implementation Guide. Whether your use meets your obligations is a decision for your own compliance and legal teams.
Can admins export employees' conversations?
The Primary Owner can. Anthropic says organization data exports are only available to Team and Enterprise plan Primary Owners and include conversation data. Primary Owners and Owners can also let users export their own data.
Can I undo a shorter retention period?
Do not count on it. Data outside the new period is scheduled for permanent deletion as soon as you save, and Anthropic says not to rely on the processing delay to reverse the change.
Can we turn HIPAA off later?
No, not from organization settings. Anthropic says enabling HIPAA is a one-way decision: once it is enabled and the BAA is accepted, the change can't be reversed from organization settings, and it also resets certain settings across your organization back to defaults. Review the Implementation Guide before the Primary Owner accepts.
Keep going
Related Guides and Courses
Set it up once, write it down, then teach it
Write down who can change each data setting before the day someone asks you to change it.
Nightschool AI is independent and not affiliated with, sponsored by or endorsed by Anthropic. Claude is Anthropic's product, named here only to describe it. Facts checked against Anthropic's public pages on 2026-11-08; confirm in your own admin console before you change a setting.