Deleted Texts, Slack Messages, and WhatsApp Chats: Why “Cleaning Up” Can Make a Healthcare Fraud Case Worse

By Barry Wax

  |  

News

  |  

Jul 17, 2026

Executive Summary: Deleting texts, emails, Slack messages, or WhatsApp chats after learning about a healthcare fraud investigation can lead to obstruction or evidence tampering charges. Modern forensic tools can often recover deleted material from phones and computers. Investigators can also subpoena cloud providers, email companies, and telecom carriers directly. Healthcare providers and businesses should preserve all records immediately once they become aware of an investigation.

A lot of healthcare fraud investigations start quietly. A subpoena arrives. A billing audit expands. An employee gets interviewed. Then panic sets in. Someone starts deleting texts. Slack threads disappear. WhatsApp messages get wiped. Social media posts vanish overnight. The thinking is usually the same: “If it’s gone, they can’t use it.” That’s not how it works. In many healthcare fraud investigations, deleting digital communications after learning about an investigation creates a second problem that can be worse than the first: obstruction of justice.

1. Your Phone Is Still a Computer

People treat text messages differently than emails or files stored on a laptop. But your phone is just another computer with a hard drive. When you delete a text, photo, or message, it usually is not immediately erased. Instead, it moves into what’s called the “unallocated” portion of the device’s storage. The data often remains recoverable until it is eventually overwritten. That’s important because law enforcement uses forensic extraction tools designed to recover deleted material. One of the most commonly known forensic programs is Cellebrite, which is used by law enforcement agencies across the country to extract data from phones and digital devices. These tools can recover:

• Deleted text messages
• Photos and videos
• App communications
• Call logs
• Location data
• Metadata showing when messages were deleted

In many cases, investigators recover far more than people think still exists.

2. Deleting Messages Before an Investigation Is Different Than Deleting Them After

If someone routinely deletes old texts before any investigation exists, that usually is not criminal conduct. But once you receive:

• A grand jury subpoena
• A civil investigative demand
• A search warrant
• Notice of an investigation
• A preservation request

the situation changes immediately. At that point, deleting records can expose someone to:

• Federal obstruction of justice charges
• Evidence tampering charges
• Additional sentencing enhancements

Under federal law, obstruction can be charged as a felony. In Florida, deleting evidence during an active investigation may lead to tampering charges under Fla. Stat. § 918.13.

3. Healthcare Fraud Cases Depend Heavily on Digital Communication

Healthcare fraud investigations today are built around digital records. Prosecutors look closely at:

• Internal billing discussions
• Referral arrangements
• Kickback conversations
• Slack channels
• WhatsApp groups
• Text exchanges between providers and staff
• Email communications with marketers or labs

In False Claims Act and healthcare fraud investigations, prosecutors often try to prove intent through communication patterns. A single message taken out of context can become a centerpiece of the case. That’s why deleting communications after learning of an investigation is so dangerous. It may allow prosecutors to argue:

1. You believed the messages were damaging
2. You intentionally destroyed evidence
3. You were attempting to conceal wrongdoing

4. Companies Do Not Have Fifth Amendment Rights

Individuals have certain constitutional protections. Companies do not. A corporation generally cannot refuse to produce business records based on the Fifth Amendment. That means investigators can subpoena:

• Corporate emails
• Internal communications
• Billing records
• Cloud storage
• Slack archives
• Microsoft Teams data
• Google Workspace records

The government can also subpoena third parties directly. That includes:

• Internet service providers
• Google
• Microsoft
• Cloud storage providers
• Cellular carriers

In many situations, investigators may already have the records before anyone inside the company starts deleting them.

5. WhatsApp and “Encrypted” Apps Are Not Invisible

A common misconception is that encrypted messaging apps make communications untouchable. Encryption protects messages during transmission. It does not necessarily prevent recovery from:

• Device backups
• Cloud syncing
• Screenshots
• Recipient devices
• Forensic extractions

Even disappearing-message settings can become evidence if investigators show they were activated after an investigation began.

6. What Should Healthcare Providers Do Instead?

If your practice, company, or organization receives a subpoena or learns of an investigation:

• Stop deleting anything immediately
• Preserve all devices and records
• Suspend automatic deletion policies
• Avoid discussing the investigation internally through informal messaging apps
• Contact legal counsel before responding to investigators

The worst decisions in these cases are usually made in the first 48 hours after panic sets in. Barry Wax gives people in trouble the ability to make the right choices and regain control of their lives. If you or your healthcare business is under investigation, Barry can help you respond strategically, protect your rights, and avoid mistakes that create even larger problems.

FAQs