How long does HIPAA require communications to be retained?

HIPAA requires covered entities to retain records for six years from creation or last effective date, whichever is later. State laws may require longer periods, and when they do, the longer period governs.

What does FINRA require for voice and text retention?

FINRA Rule 4511 requires broker-dealers to retain business communications including voice calls and SMS for 3 to 6 years depending on record type. FINRA Rule 3110 additionally requires firms to actively supervise all business communications regardless of the channel used.

Does SOX apply to voice calls?

Yes. Sarbanes-Oxley requires firms to retain material financial communications, including voice calls tied to audits and financial reporting, for 7 years.

Does Microsoft Teams natively archive voice calls and business SMS?

No. Native Microsoft Teams with Purview captures chat and channel messages but does not capture PSTN voice calls or business SMS by default. Running unified eDiscovery across voice, SMS, and chat requires stitching together separate systems.

How do GDPR and CCPA interact with communications retention mandates?

GDPR right-to-erasure provisions conflict directly with FINRA, HIPAA, and SOX retention requirements. The resolution is purpose-based retention policies: records are held for their required compliance period under a documented legal basis, then deleted on a scheduled basis once that obligation expires.

Unified Communications Archiving: Best Practices Overview

Q: What is unified communications archiving?

Unified communications archiving is the practice of capturing, retaining, and making retrievable every business communication channel: voice calls, SMS, Teams chat, and meeting transcripts, all in a single immutable, searchable archive under one retention policy. All channels are governed together, so a regulator auditing by person and time window finds a complete record across every medium.

Regulators have spent the last four years making clear that voice and text are not compliance footnotes. Understanding what that means for your Teams environment is worth doing before a records request forces the question.

Key Takeaways

A unified approach captures voice, SMS, and Teams data in one platform, retained 30 days to 10 years, running natively inside Microsoft Teams with no third-party bolt-ons and no extra licensing.
Off-channel communications enforcement has produced more than $2 billion in fines since 2021. Voice and text are no longer regulatory exceptions for financial services, healthcare, or legal.
Most "Teams archiving" only captures chat. Voice calls, business SMS, and unified eDiscovery across all three remain the structural gap in 2026, and the one most compliance officers discover only after an audit request.

$0B+SEC/FINRA fines since 2021 for off-channel failures

$0MFines to six credit rating agencies in 2025 alone

0 yrsSOX retention for material financial communications

What is unified communications archiving?

Unified communications archiving means actively capturing, retaining, and retrieving every business communication channel in one immutable, searchable archive: voice calls, SMS, Teams chat, and meeting transcripts, all under one retention policy.

The word "unified" matters more than it might seem. Regulators audit by person and time window, not by channel. An archive that captures Teams chat but misses the phone call that preceded it fails the eDiscovery request just as completely as no archive at all.

Many organizations start by searching for a HIPAA-compliant phone system or call recording software. That is a reasonable starting point. The real requirement runs broader than either term implies. Regulated firms need an architecture that treats every communication channel as one continuous compliance obligation, not five separate ones.

Why it matters more in 2026

Since 2021, the SEC and FINRA have levied more than $2 billion in fines against financial services firms for off-channel communications failures. JP Morgan, Morgan Stanley, Bank of America, Goldman Sachs, Citigroup. In 2025, regulators fined six credit rating agencies a combined $49 million for the same category of violation.

The exposure is concrete: a firm routing business SMS through Teams today, without archiving that channel, fails a FINRA Rule 4511 examination. Not eventually. Now.

Industry retention requirements

Regulation	What it covers	Retention	Who it affects	Risk
FINRA Rule 4511	All business comms including voice and SMS	3–6 years	Broker-dealers	High
FINRA Rule 3110	Active supervision of all business comms	Ongoing	Broker-dealers	High
SEC Rule 17a-4	Electronic communications and records	3–6 years	Investment firms	High
HIPAA / HITECH	PHI-related communications	6 years	Covered entities	Medium
Sarbanes-Oxley	Material financial communications	7 years	Public companies	Medium
GDPR / CCPA	Interacts with above; deletion rights apply	Per mandate	All organizations	Medium

What Teams captures and what it misses

Most mid-market Teams deployments have done something about archiving. Someone configured Purview, set a retention policy, and checked the box. The problem is what the box actually covers.

The voice and SMS blind spot

Native Teams with Purview captures chat and channel messages well. PSTN voice calls and business SMS go unarchived by default across the majority of mid-market deployments. Most vendors selling "Teams archiving" capture chat and nothing else.

Multi-vendor sprawl

Firms running separate tools for call recording, SMS capture, and Teams chat export cannot run unified eDiscovery across them. Legal requests follow people and time windows, not application boundaries.

Retention drift

Each platform sets its own default retention period. Without a single policy governing all channels, any one of them can drift out of compliance without anyone noticing until it is too late.

eDiscovery latency

When legal asks for everything from a specific person across a six-month window, days is defensible. Months is not. Fragmented systems make the latter far more likely.

Is your Teams environment actually covered?

Compliance Gap Checker

Answer three questions to see where exposure is most likely.

1. Does your current archiving solution capture voice calls, not just Teams chat?

Yes, voice is archived

No / not sure

2. Are business SMS messages sent from company phones or Teams archived?

Yes, SMS is captured

No / not sure

3. Can legal run a single eDiscovery search across voice, SMS, and chat for one person?

Yes, unified search

Partial coverage

No / separate tools

Significant compliance exposure

You have one or more structural gaps that would surface during a regulatory examination or legal hold. Voice calls, business SMS, or eDiscovery completeness are not covered. These are the exact channels regulators have fined firms over $2 billion for failing to retain since 2021.

Partial coverage — worth reviewing

Your setup covers some channels but not all under a unified eDiscovery interface. Financial services and healthcare firms face the highest examination risk from fragmented archives. An architecture review before the next audit cycle is advisable.

Coverage looks solid

Voice, SMS, and unified eDiscovery are all in place. Next step: verify retention periods align with your industry's longest applicable rule rather than platform defaults, and confirm that GDPR/CCPA deletion schedules do not conflict with mandatory retention periods.

Common questions

What is the difference between call recording and unified communications archiving?+

Call recording captures audio. Unified communications archiving captures audio, makes it searchable, indexes it with metadata (caller, time, duration, linked contact), ties it to the same person's SMS thread and Teams chat history, retains everything under a single policy, and makes all of it retrievable through one eDiscovery interface. Call recording satisfies the first layer of a FINRA Rule 3110 requirement. Unified archiving satisfies the full stack of what an examiner actually requests.

Does HIPAA require call recording for healthcare organizations?+

HIPAA does not mandate call recording explicitly, but it does require covered entities to retain records related to protected health information for six years and to implement reasonable safeguards for PHI transmitted through electronic communications. If a voice call involves PHI, failing to archive it creates both a records gap and a potential breach notification exposure. Healthcare organizations using Teams Phone as their primary business line should treat call archiving as a HIPAA compliance requirement in practice.

How do GDPR right-to-erasure requests interact with FINRA retention mandates?+

They conflict directly. GDPR Article 17 grants data subjects the right to request deletion. FINRA Rule 4511 prohibits destruction of required records before the end of the retention period. The resolution is a purpose-based retention policy: while a record is subject to a regulatory retention obligation, it falls under a legal exception to GDPR erasure rights (Article 17(3)(b)). Once the retention period expires, deletion is scheduled automatically. Firms must document this exception explicitly to produce it during a GDPR audit.

What is a WORM archive and why do regulators require it?+

WORM stands for Write Once, Read Many. It is a storage format in which records cannot be altered or deleted after writing; they can only be read. SEC Rule 17a-4 requires electronic records to be stored in a non-rewriteable, non-erasable format. An archive that allows administrators to delete or edit messages is not compliant with these requirements regardless of how long it retains them.

Does Microsoft Purview satisfy FINRA archiving requirements for voice and SMS?+

Purview satisfies FINRA requirements for Teams chat and channel messages when configured correctly with immutable storage. It does not natively capture PSTN voice calls or business SMS in most mid-market configurations. Meeting transcripts are partially captured and gated behind higher license tiers. Firms relying on Purview alone should verify precisely which channels are in scope before the next examination cycle.

Five questions to ask any archiving vendor

1Does it capture voice and SMS, not just chat?
Ask for a specific technical answer about PSTN call capture and business SMS, not marketing language about "unified communications."

2Will it retain records to your industry's longest applicable rule, not the platform default?
Default retention periods are far shorter than FINRA, HIPAA, or SOX require.

3Can it run unified eDiscovery across all channels in one interface?
A legal hold requiring three separate tool exports is not unified eDiscovery in any meaningful sense.

4Does it operate natively inside Teams, or does it push users into a second application?
Adoption and completeness both depend on whether the archive lives where employees already work.

5Who answers the phone when something breaks at midnight, and are they in your time zone?
Compliance infrastructure is only as reliable as the support behind it.

If a vendor cannot answer all five clearly, their gaps will eventually become yours.

Next Steps

Ready to close the gap in your Teams environment?

Explore how Aureon's unified communications platform combines voice, SMS, Teams archiving, and eDiscovery in one native environment — or talk through your current setup with a specialist who can map your channels against your industry's retention requirements.

Explore the UC Solution Book a Compliance Review

Why Unified Communications Archiving Will Define Compliance in 2026