WhatsApp in Clinical Practice-The Challenges of Record Keeping and Storage. A Scoping Review.

The use of WhatsApp in health care has increased, especially since the COVID-19 pandemic, but there is a need to safeguard electronic patient information when incorporating it into a medical record, be it electronic or paper based. The aim of this study was to review the literature on how clinicians who use WhatsApp in clinical practice keep medical records of the content of WhatsApp messages and how they store WhatsApp messages and/or attachments. A scoping review of nine databases sought evidence of record keeping or data storage related to use of WhatsApp in clinical practice up to 31 December 2020. Sixteen of 346 papers met study criteria. Most clinicians were aware that they must comply with statutory reporting requirements in keeping medical records of all electronic communications. However, this study showed a general lack of awareness or concern about flaunting existing privacy and security legislation. No clear mechanisms for record keeping or data storage of WhatsApp content were provided. In the absence of clear guidelines, problematic practices and workarounds have been created, increasing legal, regulatory and ethical concerns. There is a need to raise awareness of the problems clinicians face in meeting these obligations and to urgently provide viable guidance.

1. Introduction

The use of instant messaging applications, and in particular WhatsApp, to share patient information between clinicians is becoming increasingly common [1,2,3]. An earlier review noted that most WhatsApp use in clinical services was in the developing world [4]. For example, studies from Malaysia, South Africa, and Brazil show that WhatsApp use is common (with 74%, 87%, and 97% of clinicians, respectively, using WhatsApp [5,6,7]), including for second opinions or sharing of patient information. Its use in the developed world is now also common [1,2,8], and has grown further during the COVID-19 pandemic, with searches of PubMed on WhatsApp showing a marked increase in papers: 2018—94; 2019—126; 2020—312; 2021 (to 30 August 2021)—323.

Record keeping and storage of medical records are a legal requirement in many countries [9], and as early as 1999, the World Medical Association (WMA) had made clinicians aware of the need to maintain clinical records of telemedicine consultations [10], reiterated in 2018 together with legal and ethical obligations to protect sensitive patient data [11]. The absence of clear guidelines when using social media apps such as WhatsApp [9] has created problematic practices and workarounds particularly for issues of record keeping and data storage, and only serves to increase legal, regulatory and ethical concerns for patient privacy and the safeguarding of protected health information.

In the absence of formal and broadly accepted definitions of record keeping and storage, functional definitions were developed and adopted, as follows. Record keeping is defined as: maintaining, for each patient, a contemporaneous, chronological, secure, attributable, legible, traceable, permanent, original, accurate and date and time-noted health care record, whether paper or electronic, that documents in sufficient detail all health care interactions. Storage is defined as: the safe retention of health care records, with enduring access for a defined retention period, filed in a suitable systematic and permanent form, such as (for paper records) books, binders, files, cards or folders, or (for electronic records) in digital form in accordance with pertinent local or national policies and guidelines with respect to the creation, maintenance, security, disposition and recovery of electronic records.

The growing use of WhatsApp is despite its use not being fully General Data Protection Regulation (GDPR) [12] or Health Insurance Portability and Accountability Act (HIPAA) [13] compliant. Patient information sent as text messages, photographs, or video may contain sensitive, private, health-related information, in the form of electronic data. Over 125 countries now have strict data protection laws or regulations [14], many of which impact health and health care. Examples include the GDPR in the European Union [15], Lei Geral de Proteção de Dados in Brazil [16], HIPAA in the United States [17], and the Protection of Personal Information Act (POPI) in South Africa [18]. HIPAA introduced the term electronic protected health information (ePHI) as any information in an electronic format that can be used to identify a patient, defined as “personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.”

Beyond data protection legislation, clinicians must also comply with jurisdictionally specific legal and ethical responsibilities to keep patient records and store patient information. Traditionally, clinicians have kept paper-based files and notes in the patient’s medical record stored in a filing cabinet and, more recently, in electronic records of one form or another (e.g., electronic health record (EHR), electronic medical record (EMR), and electronic patient record (EPR)).

With the growing use of smartphones and instant messaging apps such as WhatsApp, neither designed for medical use, patient information often resides on both the senders’ and recipients’ mobile phones. Proactive steps have to be taken to transfer the data to a medical record and to then store the electronic data. However, some consider the information to be “stored” on mobile phones and that this constitutes a “record” of the communication/s, thereby addressing both record keeping and storage [4]. The legal, regulatory and ethical risks of this approach and a framework for their mitigation has been proposed in the Cellphone Stewardship Framework for Health Care Providers (CSF-HCP) [19].

Privacy, data security, IT governance, and mobile phone stewardship issues, and the legal obligation to keep medical records, require that patient information be added to, or incorporated into, a medical record, be it electronic or paper based. At issue is, can the information be transferred to a medical record, how can this be done, and if having done so, is there a need to retain the original text message/s and attachments?

Aligning the use of WhatsApp with record keeping and storage of medical records is complex (complying with individual country/region legislation), and fluid (changing with adjustments to both legislation, and WhatsApp versions and privacy policy). The aim of this study was to review the literature on how clinicians who use WhatsApp in clinical practice keep medical records of the content of WhatsApp messages and how they store WhatsApp messages and/or attachments. The goal of this study is to inform and raise awareness of these and related issues and to encourage debate and resolution.

2. Methods

A scoping review was undertaken in accordance with published guidance [20]. Nine databases were searched, up to 31 December 2020, for articles on WhatsApp use in clinical practice: PubMed, Scopus, Science Direct and six databases within EbscoHost—CINAHL with full text, Health Source Nursing/academic edition, Index to legal periodicals, PsycARTICLES, PsycINFO and MEDLINE.

The search terms used varied according to database (Table 1). After duplicates were removed, titles and abstracts of the remaining resources were reviewed by all authors against inclusion and exclusion criteria, with resolution of any disagreements by consensus. Inclusion criteria were that the paper was in English, reported on WhatsApp in clinical use, and addressed record keeping or storage of WhatsApp messages and attachments. Book chapters, conference proceedings that were not full-length papers, and papers on the use of WhatsApp for behaviour change, education, appointment reminders or medication adherence were excluded. Full-text papers of the resources meeting the criteria were obtained and reviewed by all authors against the inclusion and exclusion criteria until final selection, with consensus. The information was charted in an Excel spreadsheet, and included record keeping and storage steps, country in which the study took place, and the medical discipline involved, and were then categorised by all authors.

Table 1

Database, Search Strings and Resources Used for the Searches.

Database	Search Strings	Resources
PubMed	“WhatsApp” [All fields] a	601
Scopus	(ALL (“WhatsApp”) AND ALL (“telemedicine” OR“telehealth” OR “ehealth” OR “e-health” OR “mhealth” OR “m-health”))	741
Science Direct	((“WhatsApp”) AND (“telemedicine” OR “telehealth” OR “ehealth” OR “e-health” OR “mhealth” OR “m-health”)) All fields	282
Ebsco Host	((“WhatsApp”) AND (“telemedicine” OR “telehealth” OR “ehealth” OR “e-health” OR “mhealth” OR “m-health”)) All text	503

a No search modifiers used; PubMed is a biomedical and life sciences specific database.

3. Results

The searches yielded 2079 initial resources (Figure 1). After full-text review, 16 papers met the study criteria [5,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35]. Of these, 11 reported on both record keeping and storage [5,21,22,23,24,25,26,27,28,29,30], four papers reported only on record keeping [31,32,33,34], and one paper reported only on storage [35]. Papers originated from Africa (4) [21,23,30,35], India (3) [22,24,25], EU (3) [28,33,34], UK (3) [26,27,32], Middle East (2) [29,31], and Asia (1) [5].

Figure 1

PRISMA Flow Diagram of the Search Process.

Ten papers reported the use of WhatsApp in surgical disciplines; general surgery [27,28,33,34], maxillofacial surgery [25,26], neurosurgery [22], otolaryngology surgery [29], plastic surgery [31], and orthopaedic surgery [32]. The remaining six papers were from a range of disciplines: dermatology [23,30], burns [21,35], paediatric patient transfer [24], and general medical and emergency services [5]. A summary and characteristics of included studies are contained in Appendix A.

The methods of record keeping and/or storage were grouped into five categories.

3.1. Group A. Prescribed Action—Electronic

Two papers reported transfer of data from mobile phones to electronic versions of patient notes or departmental records. Transfer was performed manually to a password protected database [21], or to a departmental secure computer [22], also presumably manually. One paper formally reported deleting messages off mobile phones after transfer [21], but this was only inferred from the descriptions in the other paper [22].

3.2. Group B. Prescribed Action—Paper Based

Three papers reported ‘downloading’ of a hard copy/script for record keeping before deleting data from ‘participant devices’ after a defined period of time [27,28,29], but the method was not described.

3.3. Group C. Prescribed Action—Uncertain Electronic or Paper Based

Four papers reported keeping records, but it was not clear from descriptions if this was done electronically or was paper based [24,31,32,35]. Three of these papers formally reported deleting messages off mobile phones [24,32,35]. In a burn service, all communications were removed once the clinical scenario had been addressed, and the importance of record keeping and storage was noted, but no details were provided on how this was done [35]. Ellanti et al. reported that data were deleted from each participant’s mobile phone after a 6 month period and although no mention was made of formal storage or record keeping, this was inferred from the descriptions in the paper [32].

Neogi and Panda reported keeping records of all patients physically (either analogue or digital) at the ‘referred hospital’ and periodically deleting all ‘archived data’ [24]. Another paper reported photographing a screenshot for saving in the medical record, but it was not clear if and how the screenshots were stored, but it seems unlikely they were printed as it was reported that WhatsApp conversations could not be printed [31].

3.4. Group D. Inaction—ePHI Remains on Mobile Phones

Some felt that information stored on the users’ mobile phone constituted a medical record [5,25,33,34]. Benefits of this were: a record of communication for audit and training purposes [5,27] and a digital record for future reference such that “lost X-rays are a thing of the past” [25]. In a dermatology service, some messages were stored on the specialists’ mobile phones [23].

3.5. Group E. Uncertain

Two papers mentioned but did not report evidence of record keeping or storage of WhatsApp message content [26,30]. Dungarwalla et al. acknowledged that records constituted a pillar of good clinical practice and governance but reported difficulties with transferring consults to patient records when using the departmental mobile phone [26]. Williams and Kovarik reported the inability to save data centrally or integrate WhatsApp consultations into a patient’s medical record [30]. Of note was that in four retrospective studies, information was accessed from WhatsApp messages stored on the users’ mobile phones [22,26,33,34] with no mention of subsequent deletion of messages.

4. Discussion

While the use of WhatsApp is becoming increasingly common [6,7], there are few papers reporting record keeping and storage of sensitive patient health information contained in WhatsApp messages and attachments. Only 16 papers mentioned keeping records and/or storing of data transmitted using WhatsApp. Further, there is no clear evidence from the reviewed literature as to how, when using WhatsApp, patient information can routinely be transferred to, or incorporated into, a print or electronic medical record to permit record keeping and storage. Surprisingly, there were no reports of copies of WhatsApp messages being sent by email for record keeping or subsequent entry into an electronic medical record, a feature available within WhatsApp.

The absence of clear guidelines on record keeping and data storage has, as previously noted [9], created problematic practices and workarounds that only serve to increase legal, regulatory and ethical concern for patient privacy and the safeguarding of protected health information. For example, there was a general sense of concern about sensitive patient data being shared and stored on mobile phones, but those papers reporting deletion of messages on users’ phones did not report the message being deleted from the sender’s phone after completion of the case or other specified time period. Patient privacy is at risk when sensitive data are stored on mobile phones, and such practice is common. The problem is not confined to the use of instant messaging but also pertains to clinical photographs. Of 300 French plastic surgeons, 50% stored clinical photographs on their smartphones, whilst in Australia, 46% of dermatologists surveyed stored images on smartphones with limited security measures [36]. In a Canadian survey of plastic surgery residents and physicians, 57% stored such images on their mobile phones, with 73% of these storing clinical images among their personal photos [36].

Furthermore, a mobile phone may be lost or stolen, or content may be inadvertently shared. A survey of plastic surgeons reported 26% of respondents had accidentally revealed a clinical image to family or friends [37]. A safeguard to minimise this type of risk such as password protection was reported in one paper [22]. The term mobile phone “stewardship” has been defined and is applied to the appropriate care and use of mobile phones by health care workers. Good mobile phone stewardship practice recommends that messages are deleted off both the sender’s and receiver’s mobile phones [19].

Some authors were more mindful of concerns of breaching patient confidentiality but were less forthcoming in declaring their storage practices and even used the data stored on mobile phones for retrospective studies of WhatsApp use [22,26,33,34]. In addition, clinicians used WhatsApp despite recognising non-compliance with privacy laws [1] and/or contravention of organisational policies [38]. The reasons proposed were a lack of training in compliance with regulations [2] and the need for guidelines [39]. There is a general lack of awareness or concern about flaunting existing privacy and security legislation, regulations or guidelines [1,2,36] because the benefits to the patient and physicians outweigh the difficulty of compliance.

Ideally, every institution and medical practice should have an IT Governance Policy or Rules and standard operating procedures for the use of instant messaging, which would include record keeping and data storage. The reality is that in the developed world, the literature indicates that they are being ignored; and in the developing world, few medical practices and institutions have IT Governance Policies. No paper reported WhatsApp use in compliance with an IT Governance Policy. Johnston et al. reported special dispensation was given by the hospital’s information compliance department for the use of WhatsApp, provided that patient identifiable data were not shared, hardcopy records of the messages were kept, and WhatsApp messages were deleted from the phones at the end of each week [27].

Different approaches to record keeping and storage are possible (Figure 2). The figure shows the basic options for transferring WhatsApp chats (and/or attachments) to print or electronic formats capable of long-term storage, each of which was reported in the identified literature. These options provide potential solutions.

Figure 2

Options for Record Keeping and Storage of WhatsApp Messages.

The problematic practices and workarounds noted earlier relate to safeguarding of protected health information, in particular retention of original messaging, long-term storage, encryption, extra-jurisdictional record keeping and storage, consent for subsequent use, and anonymisation.

4.1. Retention of Original Messaging

Few reports noted any concern or need for retention of original text messages or attachments, e.g., for audit purposes, although some did consider retention on their mobile devices as long-term ‘storage’ for clinical purposes [5,25,33,34]. Certainly, the literature implies, and a scan of the web shows, storage options exist through ‘back-up’ and cloud storage for WhatsApp chats and attachments. However, these will be fraught with their own security and confidentiality issues, and their longevity is uncertain. Many countries require electronic medical records be kept for several years after the death of a patient, but just how long would a commercial entity such as WhatsApp be able, or willing, to guarantee retention?

4.2. Long-Term Storage

As workarounds, there are a number of options to print out WhatsApp chats or convert them to pdf documents, which would allow both ‘print’ and ‘electronic’ (email; upload) transfer to medical records, offering storage options. However, any transmission of a pdf file (e.g., via email or over a network) would also require compliance with security and confidentiality requirements.

4.3. Encryption

Since 31 March 2016, messages between WhatsApp users have been protected with an end-to-end encryption protocol so that third parties, including WhatsApp and Facebook, cannot read them; the messages can only be decrypted by the recipient’s mobile phone [40]. All types of WhatsApp messages (chats, group chats, images, videos, voice messages, files) and WhatsApp calls, and any associated sensitive patient information, are protected by this end-to-end encryption, yet use of WhatsApp remains non-compliant with GDPR and HIPAA [12,13]. Furthermore, content may still be vulnerable if used for other purposes before being encrypted or after being decrypted using WhatsApp.

Due to the constant upgrading of security measures by WhatsApp, a number of concerns reported in earlier papers regarding storage of WhatsApp messages (containing sensitive patient information) may be misleading [26,41,42,43,44,45,46].

4.4. Extra-Jurisdictional Record Keeping and Storage

Increasingly, countries are introducing laws about extra-jurisdictional storage of health data. For example, the GDPR does not allow the storage of sensitive data of EU citizens on servers located outside the geographic area of the European Community [46]. Thus, WhatsApp messages are transmitted (and potentially stored for up to 30 days awaiting delivery) via servers located in the US, which may not comply with a particular country’s data protection regulations [26,45]. There has been concern about WhatsApp accessing and sharing information on users’ phones, however, this concern may be moot. The information gathered by WhatsApp and stored in the US on their servers is not ePHI, but contact information and possibly images if backed up to the cloud by the user. By downloading and using WhatsApp all users have knowingly or unwittingly consented to allow Facebook to access and download the telephonic contact details stored on their mobile phone. WhatsApp does share contact details with their parent company, Facebook, but it is important to emphasise that WhatsApp only stores users’ contact details, for which consent has been given when first downloading the app. When clinicians are sending messages to each other, WhatsApp is not able to access the patient’s contact details. Should a patient and clinician communicate directly with one another the patient’s contact details will already have been accessed by WhatsApp.

WhatsApp’s current and updated privacy policy allows Facebook to process additional user data that it collects from WhatsApp and importantly does not permit users, except within the EU, to opt out of accepting this policy. This “take it or leave it” privacy policy has caused concern in a number of countries, who are trying to negotiate an exemption from the policy [47].

4.5. Consent

Legislation in many countries require patient information be used only for the purposes for which consent was originally given, a common ethical principle. Thus, it may be a legal or ethical requirement that a patient give specific written informed consent before sensitive patient information is shared with another health professional or chat group of health professionals. Only one of the reviewed papers mentioned the need for keeping a record of informed consent (for example submitting a photograph of the signed consent) [21], although other sources acknowledged the need for consent [24,31] even if only verbal [22,35].

A recent review of consent practices when using WhatsApp found only 18 papers that reported obtaining either written or verbal consent for sharing information and/or images [48]. At one academic hospital, 97% of doctors surveyed did not obtain consent for sharing patient information by instant messaging [49]. Medico-legal providers recommend documenting consent in the patient’s notes when sharing images on mobile phones [1].

4.6. Anonymisation

Some have considered the use of WhatsApp to be permissible if sensitive patient details were not disclosed [26], and possible workarounds to comply with privacy and data security requirements were also suggested, primarily de-identification of patient information [50] and anonymisation [32]. However, this leads to an untenable conflict between ‘de-identification’ of messages and transfer to some form of ‘record’ and highlights the futility of such attempts. There is a spectrum of how anonymised personal health data may be, for example, use of medical record numbers or bed numbers [32], but truly anonymous (or anonymised) data are unacceptable in a clinical setting, where repeated confirmation of identity is the norm. Consider a clinician receiving anonymised data; how could any identifiable record be created from such anonymised data? Retaining the integrity of patient identity is crucial to safe health care delivery, and anonymisation is the antithesis. Merging of electronic (and paper) health records can and does occur but only under strict guidelines that require commonality of key identifiers. Once de-identified, merging is forever precluded.

The need for a WhatsApp-like instant messaging app for the health care sector has been identified [45]. Other instant messaging applications that meet HIPAA and/or GDPR requirements are available: Siilo, Hospify, Simple Practice, Oncall Health, Tiger connect, Trillian and MedX (for Australian registered doctors) [1,46]. In the UK, although Hospify is approved by the NHS, the use of WhatsApp and Telegram has recently been sanctioned “where there is no practical alternative and the benefits outweigh the risks” [51]. Each has strengths and weaknesses.

Study limitations are that while nine databases were searched, the grey literature was not searched (e.g., Google Scholar). Additionally, searches were restricted to the English language.

5. Summary

Only 16 of 346 papers reporting the use of WhatsApp in clinical practice addressed either record keeping or data storage. Most clinicians were aware that they must comply with statutory reporting requirements in keeping medical records of all electronic communications. For example, it was reported that records “constitute a pillar of good clinical practice and governance” [26] and that there was a need “for proper documentation in the medical record of valuable data and the content of consultations and treatment plans” [29]. Yet, it is clear that clinicians are failing to meet many legal, ethical, and good practice requirements. The reasons seem clear: on the one hand, WhatsApp is ubiquitous, freely available, easy to use, convenient, and meets clinicians’ needs. On the other hand, there is no comprehensive, consistent, and comprehensible guidance found in the literature [9] on the acceptable use of WhatsApp, nor how to transfer WhatsApp communications to a print or electronic patient record to allow satisfactory record keeping and storage [9].

There also remain untested limits to existing legislation. For example, the GDPR contains sections limiting the application of other restrictive sections when communications are for “preventive or occupational medicine, … medical diagnosis, the provision of health or social care or treatment, …”, and when the data “are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies …” [52]. Could current concern be greater than required?

WhatsApp is also regularly upgraded and a number of concerns about data security related to message encryption, data transmission and data storage on external servers reported in earlier papers have been resolved. Of current concern is information contained in users’ contact lists, names, addresses and phone numbers being collected and used by Facebook. By downloading and using WhatsApp all users have knowingly or unwittingly consented to this, but the people whose information is being shared do not know with whom their information will be shared and how it will be used. This contravenes most existing data protection laws and regulations. The situation remains fluid and in the EU users can opt out of data sharing. A shortcoming of reported literature is the lack of clear statement about which WhatsApp application is being used. For example, WhatsApp for Business should not be used for health care as decrypted messages can be stored on external servers [12]. WhatsApp meets HIPAA requirements for data security during transmission; however, if information is stored on the phone, it becomes non-compliant as the app is not password protected, and the audit trail cannot be ensured as the user can delete the message [13].

Overall, the literature is confusing due to misinterpretation, misinformation, and constant updates to software versions and security protocols, and the introduction of new legislation. Users need to be made aware of the potential implications of the options they choose for record keeping and data and image storage, which may not be appropriate from a legal, regulatory, or ethical standpoint. Combinations and permutations of transmission for record keeping and storage are many. In general, unless specific choices have been made within WhatsApp or a user’s mobile phone to upload or back-up text messages, use of WhatsApp for general communication is secure. However, currently, there are no simple ‘GDPR/HIPAA proof’ solutions to record keeping or storage of WhatsApp content.

6. Conclusions

The findings of this study are telling. Despite the widespread use of WhatsApp, clinicians are either failing in their legal, regulatory, ethical, and clinical responsibility to keep records of WhatsApp consults, or are not reporting that they do so, nor how they do so. The literature does not report any clear “best practices” for record keeping or the secure storage of patient information obtained using WhatsApp. There is a need to raise awareness of the problems clinicians face in meeting these obligations and to urgently provide viable guidance.

Table A1

Summary and characteristics of included studies.

Paper	Country	Specialty	Overview of Included Studies	Evidence of Records/Storage
Group A. Prescribed Action—Electronic
den Hollander and Mars.[21]2017	South Africa	Burn care.	Referring doctors were required to telephone the burns specialist, answer a referral questionnaire about the case and send photographs of the burn wounds before a decision was made on acceptance of the referral or providing ongoing management advice. The photographs were taken and sent by smartphone using MMS or WhatsApp. The completed questionnaire, with photographs, were entered into a database which was reviewed for the study.	Evidence of record keeping and storage.Reported transfer of data from mobile phones to electronic versions of patient notes or departmental records. Transfer was done manually to a password protected database. Retrospective study from a database where messages and photos were deleted from the consultant’s phone.
Joshi et al.[22]2018	India	Neurosurgical referral service.	Examined the use of WhatsApp for a neurosurgical referral service. Use of WhatsApp was extended from a purely intra-departmental informal communication to a formal tertiary referral service for Neurosurgical referrals. The pros and cons of deploying such a system were discussed and important concerns highlighted.	Evidence of both record keeping and storage. Reported the transfer of data from mobile phones to electronic versions of patient notes or departmental records. Transfer was done manually to a departmental secure computer. Messages remained on the phone and apparently ‘backed up’, with no explanation of how and no mention of subsequent deletion of messages. A retrospective study where information was accessed from WhatsApp messages stored on the users’ mobile phones.
Group B. Prescribed Action—Paper Based
Johnston et al.[27]2015	UK	Communication in emergency surgical teams.	Evaluated implementation of a WhatsApp messaging service within emergency surgical teams. A prospective mixed-methods study. All emergency surgery team members used WhatsApp for communication for 19 weeks. Examined response times, communication types, and safety events.	Reported on both record keeping and storage. Temporarily stored messages on the phone for 1 week. Downloaded and kept a hard copy record but did not explain how? Benefits were a record of communication for training purposes.
Nardo et al.[28]2016	Italy	Patient surgical management.	Examined use of WhatsApp between two distant elective surgery teams to verify if WhatsApp improved patient care, while preserving their privacy and enhanced learning.	Reported on both record keeping and storage. Temporarily stored messages on the phone for 1 week before deleting messages off mobile phones. Downloaded and kept a hard copy record, but did not describe how? Applied the same protocol as Johnston et al.
Siegal et al.[29]2016	Israel	Otolaryngology.	Experience and practices governing the usage of WhatsApp for mobile health purposes in a national cohort of practicing otolaryngologists.	Reported on both record keeping and storage by ‘downloading’ of a hard copy/script for record keeping before deleting data from ‘participant devices’ after a defined period but the method was not described.
Group C. Prescribed Action—Uncertain electronic or paper based
Wani et al.[31]2013	Saudi Arabia	Plastic and reconstructive surgery.	An assessment of the efficacy of smartphone and its WhatsApp application as a communication method amongst the staff of plastic and reconstructive surgery section at tertiary care health facility. WhatsApp was used for various aspects of patient management.	Reported keeping records, but it was not clear from descriptions if this was done electronically or was paper based. The chat conversations were photographed as screenshots for saving in the medical record, but it was not clear if and how the screenshots were stored, but it seems unlikely they were printed as it was reported that WhatsApp conversations could not be printed.
Ellanti et al.[32]2017	UK	Orthopaedic Surgery.	Analysis of WhatsApp communication between non-consultant members of an orthopaedic team over a six-month period. A specific “orthopaedic group” was created on WhatsApp, which included all the non-consultant orthopaedic team.	Reported only on record keeping. Reported deleting messages off mobile phones after a 6 month period and although no mention was made of formal storage or record keeping this was inferred from the descriptions in the paper.
Martinez et al.[35]2018	South Africa	Paediatric burn care.	Reviewed use of WhatsApp to facilitate paediatric burn injury consultations to a regional burn centre. A retrospective review of all WhatsApp consultations over an 18 month period. Assessed the impact in terms of reductions in admissions and clinic visits, a cost analysis plus analysis of feedback from those health practitioners regularly using the service.	Evidence of storage only.Reported keeping records, but it was not clear if it was done electronically or was paper based. Reported deleting messages off mobile phones. The importance of record keeping, and storage was noted, but no details were provided on how this was done.
Neogi et al.[24]2020	India	Interinstitutional patient transfer.	Use of WhatsApp to facilitate transfer of paediatric patients, including neonates, from paediatric department of one hospital (which does not have paediatric surgical support) to a tertiary care hospital. The WhatsApp group included the consultants and residents of the concerned department from both the hospitals. Patient details, investigations were initially uploaded on the group. The case was assessed on the messenger and the transfer coordinated.	Reported on both record keeping and storage but it was not clear if this was done electronically or was paper based. Kept an analogue or digital record, and then periodically deleted messages off mobile phones or gained consent and archived.
Group D. Inaction—ePHI remains on mobile phones
Gulacti et al.[33]2016	Turkey	Communication between consulting and emergency physicians.	Evaluated WhatsApp messenger usage for communication between consulting and emergency physicians. A retrospective, observational study conducted in the emergency department of a tertiary care university hospital.	Reported only on record keeping and that information stored on the users’ mobile phone constituted a medical record. Retrospective study of WhatsApp messages stored on the phone with no mention of subsequent deletion of messages.
Sidhoum et al.[34]2016	France	Surgical team communication.	Experiences and results over nearly three years of the use of WhatsApp in the plastic surgery team in CHU Amiens. Transmitted patient information included text, photos, and video, with the patient’s agreement to share with other team members.	Reported only on record keeping where information stored on the users’ mobile phone constituted a medical record.Retrospective study of messages stored on the phone with no mention of subsequent deletion of messages.
Ganasegeran et al.[5]2017	Malaysia	Use in clinical practice.	A preliminary study. Aim was to investigate perceived benefits, if any, of WhatsApp use across general medical and emergency teams during clinical practice.	Reported on both record keeping and storage and that information stored on the users’ mobile phone constituted a medical record. Benefits of this were a record of communication for audit purposes. Mentioned concerns of messages stored on users’ phones.
Mars and Scott.[23]2017	South Africa	Dermatology and burn management.	Describes two ‘‘spontaneous’’ WhatsApp-based telemedicine services in dermatology and burn management. For dermatology, doctors at rural referring hospitals take photographs of skin lesions and send them to dermatologists together with a brief text message history. For the burns service, admissions now require completion of a preadmission questionnaire and submission of photographs of the burn sent by WhatsApp, with the decision transmitted by text message.	Reported on both record keeping and storage. In the dermatology service, some messages were stored on the consultant’s phone, no central depository.In the burns service: some messages deleted from the phones.
Pandian et al.[25]2014	India	Maxillofacial surgery.	Description of a protocol using WhatsApp for communication between postgraduate trainees and senior maxillofacial surgeons. Electronic transmission of clinical images for remote consultation was done using WhatsApp in the maxillofacial unit.	Reported on both record keeping and storage. Messages stored on the phone as a digital record for future reference such that “lost X-rays are a thing of the past”.
Group E. Uncertain
Williams and Kovarik.[30]2018	Botswana	Dermatology care.	The use of WhatsApp for dermatology care and a description as to how this application can be easily adapted and integrated into clinical practice in resource-limited settings to improve patient outcomes.	Mentioned but did not report evidence of record keeping or storage of WhatsApp message content. A reported drawback was the inability to save data centrally or integrate WhatsApp consultations into a patient’s medical record.
Dungarwalla et al.[26]2019	UK	Oral and maxillofacial surgery.	Investigation of the use of WhatsApp among oral and maxillofacial surgery junior trainees at a level one trauma centre in London. Additionally included a review of existing studies.	Mentioned but did not report evidence of record keeping or storage.A retrospective study where information was accessed from WhatsApp messages stored on the users’ mobile phones with no mention of subsequent deletion of messages. Stated that “records constitute a pillar of good clinical practice and governance”, but reported difficulties with transferring consults to patient records when using the departmental mobile phone.

Table A2

Preferred Reporting Items for Systematic reviews and Meta-Analyses extension for Scoping Reviews (PRISMA-ScR) Checklist.

SECTION	ITEM	PRISMA-ScR CHECKLIST ITEM	REPORTED ON PAGE
TITLE
Title	1	Identify the report as a scoping review.	WhatsApp in Clinical Practice—The Challenges of Record Keeping and Storage. A Scoping Review
ABSTRACT
Structured summary	2	Provide a structured summary that includes (as applicable): background, objectives, eligibility criteria, sources of evidence, charting methods, results, and conclusions that relate to the review questions and objectives.	P2.
INTRODUCTION
Rationale	3	Describe the rationale for the review in the context of what is already known. Explain why the review questions/objectives lend themselves to a scoping review approach.	P3-5
Objectives	4	Provide an explicit statement of the questions and objectives being addressed with reference to their key elements (e.g., population or participants, concepts, and context) or other relevant key elements used to conceptualize the review questions and/or objectives.	P5
METHODS
Protocol and registration	5	Indicate whether a review protocol exists; state if and where it can be accessed (e.g., a Web address); and if available, provide registration information, including the registration number.	No review protocol
Eligibility criteria	6	Specify characteristics of the sources of evidence used as eligibility criteria (e.g., years considered, language, and publication status), and provide a rationale.	P5–6
Information sources *	7	Describe all information sources in the search (e.g., databases with dates of coverage and contact with authors to identify additional sources), as well as the date the most recent search was executed.	P5
Search	8	Present the full electronic search strategy for at least 1 database, including any limits used, such that it could be repeated.	P6
Selection of sources of evidence †	9	State the process for selecting sources of evidence (i.e., screening and eligibility) included in the scoping review.	P6
Data charting process ‡	10	Describe the methods of charting data from the included sources of evidence (e.g., calibrated forms or forms that have been tested by the team before their use, and whether data charting was done independently or in duplicate) and any processes for obtaining and confirming data from investigators.	P6
Data items	11	List and define all variables for which data were sought and any assumptions and simplifications made.	P6
Critical appraisal of individual sources of evidence §	12	If done, provide a rationale for conducting a critical appraisal of included sources of evidence; describe the methods used and how this information was used in any data synthesis (if appropriate).	Not done
Synthesis of results	13	Describe the methods of handling and summarizing the data that were charted.	P6
RESULTS
Selection of sources of evidence	14	Give numbers of sources of evidence screened, assessed for eligibility, and included in the review, with reasons for exclusions at each stage, ideally using a flow diagram.	P7
Characteristics of sources of evidence	15	For each source of evidence, present characteristics for which data were charted and provide the citations.	P6
Critical appraisal within sources of evidence	16	If done, present data on critical appraisal of included sources of evidence (see item 12).	Not done
Results of individual sources of evidence	17	For each included source of evidence, present the relevant data that were charted that relate to the review questions and objectives.	P6
Synthesis of results	18	Summarize and/or present the charting results as they relate to the review questions and objectives.	P7–9
DISCUSSION
Summary of evidence	19	Summarize the main results (including an overview of concepts, themes, and types of evidence available), link to the review questions and objectives, and consider the relevance to key groups.	P9–15
Limitations	20	Discuss the limitations of the scoping review process.	P16
Conclusions	21	Provide a general interpretation of the results with respect to the review questions and objectives, as well as potential implications and/or next steps.	P16–18
FUNDING
Funding	22	Describe sources of funding for the included sources of evidence, as well as sources of funding for the scoping review. Describe the role of the funders of the scoping review.	P19

JBI = Joanna Briggs Institute; PRISMA-ScR = Preferred Reporting Items for Systematic reviews and Meta-Analyses extension for Scoping Reviews. * Where sources of evidence (see second footnote) are compiled from, such as bibliographic databases, social media platforms, and Web sites. † A more inclusive/heterogeneous term used to account for the different types of evidence or data sources (e.g., quantitative and/or qualitative research, expert opinion, and policy documents) that may be eligible in a scoping review as opposed to only studies. This is not to be confused with information sources (see first footnote). ‡ The frameworks by Arksey and O’Malley (6) and Levac and colleagues (7) and the JBI guidance (4, 5) refer to the process of data extraction in a scoping review as data charting. § The process of systematically examining research evidence to assess its validity, results, and relevance before using it to inform a decision. This term is used for items 12 and 19 instead of “risk of bias” (which is more applicable to systematic reviews of interventions) to include and acknowledge the various sources of evidence that may be used in a scoping review (e.g., quantitative and/or qualitative research, expert opinion, and policy document). From: Tricco AC, Lillie E, Zarin W, O’Brien KK, Colquhoun H, Levac D et al. PRISMA Extension for Scoping Reviews (PRISMAScR): Checklist and Explanation. Ann Intern Med. 2018;169:467–473. doi: 10.7326/M18-0850.