Protecting Our Organizations & Their People in the Era of Digital Surveillance
About Protecting Our Organizations From Digital Surveilance
Recent headlines have sparked serious concern among advocacy and healthcare organizations. One example: the federal government attempted to subpoena medical records of trans youth receiving gender-affirming care from Boston Children’s Hospital. A judge blocked the request, calling it “motivated only by bad faith.”
That case highlights a broader risk: internal communications, cloud video-calls, document sharing and other digital tools may be subject to legal demands. For organizations working with systemically excluded communities, these risks are especially real.
Here’s what’s happening and how your small business or nonprofit can build systems to protect yourselves and the communities you serve.
What’s Going On?
Cloud platforms like Zoom and others store more than what we see: metadata, recordings, chat logs, white-boards. Legal counsel has pointed out that the government can seek:
Call dates, participants, IP addresses.
Stored recordings or transcripts.
The Boston Children’s Hospital case highlighted a government subpoena asked for patient files, staff records, and identifying details. The court found the scope “astonishingly broad” and targeted the hospital’s trans-care program.
For any organization using digital tools, the takeaway is: what’s stored in the cloud can be accessed by government if appropriately requested.
What It Means For You
If you’re leading a mission-driven organization—especially one serving trans youth, immigrants, or other systemically excluded groups—this is not theoretical.
Were your organization’s meetings recorded? Stored in the cloud?
Do you have chat logs, file shares, or video discussions saved indefinitely?
Could those communications contain sensitive client or staff information?
If yes, your systems unfortunately weren’t built intentionally for safety and clarity in the legal reality of now (which, of course, is super challenging to do in a consistently changing legal and governmental landscape).
What You Can Do Now?
Map your tools and storage:
- List every platform your team uses (video, chat, file storage).
- Identify where recordings, chats or logs are being kept, for how long.
Reduce unnecessary storage:
- Turn off auto-recording unless it’s mission-critical.
- Delete old recordings, chats or files you don’t need.
Set clear policies for use of cloud tools:
- Encourage staff not to store highly sensitive client data in public or shared drives without controls.
- Use access controls: who can download recordings? Who can export transcripts?
Train your team:
- Clarify what is “sensitive data” (client names, identifying details, health info).
- Provide guidance when working remotely: avoid using personal accounts, confirm platform security.
Use encryption & alternative tools:
- For highly sensitive conversations, consider tools such as Signal or ProtonMail.
Consult legal or compliance support:
- Know what your obligations are, especially regarding privacy laws, data protection, and when a subpoena arrives.
Why This Aligns with Our Values
At Triple Creeks, our work is grounded in three core values: adaptability, stewardship, equity. Building systems that protect your communications is part of each.
Adaptability: You adjust your systems proactively before an external threat forces change.
Stewardship: You protect the trust of your community, clients and staff by safeguarding their data.
Equity: When your work supports communities often under-resourced, attention to privacy and transparency is a part of that.
When your organization operates with clear, intentional systems that anticipate risk and protect people, you create space for sustainable impact, not just urgent reaction.
If you’re ready to examine how your digital tools and communications systems serve your organization’s mission (and your communities), we’re here to help. Protecting your operations means protecting your impact. We’d love to hear from you!
