HIPAA compliance for dental practices in North Carolina

North Carolina keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, North Carolina has 3 recorded rules that apply to dental practices differently from other businesses in the state — set out below with their conditions and sources.

North Carolina jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether North Carolina's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Dental practices that electronically submit claims, check eligibility, request authorization, or have a billing service conduct those standard transactions on their behalf are HIPAA covered entities. Most modern dental practices meet that definition. Once covered, the duties below are required.

State — how North Carolina law interacts with HIPAA

North Carolina's breach-notification statute contains no HIPAA-specific provision. Dental practices must satisfy the state regime on its own terms, independently of anything HIPAA requires.

N.C.G.S. § 75-65 does not itself contain HIPAA-substitution language on the face of the operative notification section. HIPAA-regulated practices operating in North Carolina must independently satisfy § 75-65's individual-notice and AG Consumer Protection Division notice obligations — the HIPAA-related language that appears elsewhere in Chapter 75 (for example § 75-66 or related provisions) governs different subject matter and should not be imported into § 75-65 to imply an exemption that the operative section does not provide.

What North Carolina adds for dental practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not North Carolina's general breach law, which applies the same way to every business in the state.

How long records must be kept

How long the record must be kept

A dentist SHALL MAINTAIN TREATMENT RECORDS ON ALL PATIENTS FOR A PERIOD OF 10 YEARS FROM THE LAST TREATMENT DATE, EXCEPT THAT WORK ORDERS MUST ONLY BE MAINTAINED FOR A PERIOD OF TWO YEARS.

Provider class: North Carolina dentists

What this means operationally

Ten years is the longest practice-level retention period in this corpus, and it sits in a state that imposes no general retention duty at all — North Carolina dentistry is the outlier rather than the pattern. The work-order carve-out is the trap: a two-year class living inside a ten-year record, so a practice destroying on a single schedule either over-retains lab orders or under-retains everything else. Note the clock is the LAST TREATMENT DATE, not last contact or last entry, so a recall visit with no treatment does not restart it.

Applies when

A North Carolina dentist holds treatment records

Exceptions

Work orders need only be maintained for two years

State regulation21 N.C. Admin. Code 16T .0101Dental patientsVerified 2026-08-30

Duty to keep an accurate record

Treatment records may include such information as the dentist deems appropriate BUT SHALL INCLUDE: the patient's full name, address and treatment dates; the patient's EMERGENCY CONTACT OR RESPONSIBLE PARTY; a CURRENT HEALTH HISTORY; the diagnosis of condition; the treatment rendered AND BY WHOM; the name and strength of any medications prescribed, dispensed or administered ALONG WITH THE QUANTITY AND DATE; the WORK ORDERS ISSUED; the TREATMENT PLANS for patients of record, except that treatment plans are not required for patients seen ONLY ON AN EMERGENCY BASIS; the DIAGNOSTIC RADIOGRAPHS, ORTHODONTIC STUDY MODELS AND OTHER DIAGNOSTIC AIDS, if taken; the patient's FINANCIAL RECORDS AND COPIES OF ALL INSURANCE CLAIM FORMS; THE RATIONALE FOR PRESCRIBING EACH NARCOTIC; and a WRITTEN RECORD THAT THE PATIENT GAVE INFORMED CONSENT.

Provider class: North Carolina dentists

What this means operationally

Two elements make this list wider than a clinical chart. FINANCIAL RECORDS AND INSURANCE CLAIM FORMS are part of the treatment record, so billing data inherits the ten-year period and must travel with the record on transfer. And the RATIONALE FOR PRESCRIBING EACH NARCOTIC must be documented individually — not a general pain-management note but a per-prescription justification. The emergency-basis carve-out is narrow: it excuses only the treatment plan, and only for patients seen exclusively on that basis.

Applies when

A North Carolina dentist creates a treatment record

Exceptions

Treatment plans are not required for patients seen only on an emergency basis
Diagnostic radiographs, study models and other diagnostic aids are required only if taken

State regulation21 N.C. Admin. Code 16T .0101Dental patientsVerified 2026-08-30

Patient access to records

Deadline to respond to an access request

A dentist SHALL, UPON REQUEST BY THE PATIENT OF RECORD, provide all information required by HIPAA and this Rule, INCLUDING ORIGINAL OR DIAGNOSTIC COPIES OF RADIOGRAPHS and a LEGIBLE COPY OF ALL TREATMENT RECORDS, to the patient OR TO A LICENSED DENTIST IDENTIFIED BY THE PATIENT. The dentist MAY CHARGE A FEE NOT EXCEEDING THE ACTUAL COST OF DUPLICATING the records. The records SHALL BE PROVIDED WITHIN 30 DAYS of the request and PRODUCTION SHALL NOT BE CONTINGENT UPON CURRENT, PAST OR FUTURE DENTAL TREATMENT OR PAYMENT OF SERVICES.

Provider class: North Carolina dentists

What this means operationally

Radiographs are the point of difference. The state fee statute expressly excludes X rays from MEDICAL RECORDS, but this rule requires ORIGINAL OR DIAGNOSTIC COPIES of radiographs to be produced — so a dentist cannot rely on the statutory exclusion to withhold imaging or to supply a degraded copy. The fee is also tighter than the statutory schedule: ACTUAL COST OF DUPLICATING, not the seventy-five-cent page rate with a ten-dollar minimum. And production may not be conditioned on payment for SERVICES, which is broader than the usual past-due-account bar because it reaches future treatment too.

Applies when

A patient of record requests their dental records, or asks that they go to a licensed dentist they identify

State regulation21 N.C. Admin. Code 16T .0102Patients of record, and licensed dentists they identifyVerified 2026-08-30

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

North Carolina breach obligations

These apply to businesses generally rather than to dental practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

North Carolinabreach data →

Individual notice deadline

Following discovery or notification of the breach, without unreasonable delay, subject to statutory qualifications including law-enforcement delay and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

The statute does not fix a numeric outer bound. Unreasonable delay is itself a violation and may result in state enforcement action, so treat the operative timeframe as the shortest window your incident circumstances reasonably support.

State regulator notice

Required

Whenever a business provides individual notice, it must also provide notice to the Consumer Protection Division of the North Carolina Attorney General's Office. This is required for any breach that triggers individual notice — there is no numeric threshold for the AG notice itself.

Source: N.C.G.S. § 75-65

Statewide rules that also reach dental practices

Minor may consent

Any minor who is emancipated may consent to any medical treatment, dental and health services for themselves or for their child.

What this means operationally

Emancipation removes the subject-matter and provider limits that constrain § 90-21.5(a), so it is the provision that turns a narrow consent into a general one. Intake needs to be able to record emancipation as a status, because it changes which rule applies rather than merely satisfying the one already in play.

Applies when

The minor is emancipated

StatewideN.C. Gen. Stat. § 90-21.5(b)Emancipated minorsVerified 2026-08-29

Duty to keep an accurate record

Any health care provider or facility licensed, certified or registered under the laws of this State MAY CREATE AND MAINTAIN MEDICAL RECORDS IN AN ELECTRONIC FORMAT and SHALL NOT BE REQUIRED TO MAINTAIN A SEPARATE PAPER COPY. A provider SHALL MAINTAIN ELECTRONIC MEDICAL RECORDS IN A LEGIBLE AND RETRIEVABLE FORM, INCLUDING ADEQUATE DATA BACKUP. Authorized individuals may AUTHENTICATE orders and other medical record entries by written signature, or by ELECTRONIC OR DIGITAL SIGNATURE in lieu of ink. MEDICAL RECORD ENTRIES SHALL BE AUTHENTICATED BY THE INDIVIDUAL WHO MADE OR AUTHORIZED THE ENTRY. AUTHENTICATION means identification of the author of an entry BY THAT AUTHOR and CONFIRMATION THAT THE CONTENTS OF THE ENTRY ARE WHAT THE AUTHOR INTENDED. The legal rights and responsibilities of patients, providers and facilities APPLY TO ELECTRONIC RECORDS TO THE SAME EXTENT as to paper, with respect to the SECURITY, CONFIDENTIALITY, ACCURACY, INTEGRITY, ACCESS TO AND DISCLOSURE of medical records.

What this means operationally

Three obligations here read as system requirements rather than policy. LEGIBLE AND RETRIEVABLE FORM INCLUDING ADEQUATE DATA BACKUP is a state-law backup mandate with no size threshold. The authentication definition is stricter than a signature field: it requires identification of the author BY THAT AUTHOR and confirmation the contents are what the author INTENDED, which is an attestation step, not a login. And subsection (c) forecloses the argument that electronic records attract lighter duties — security, confidentiality, accuracy, integrity, access and disclosure obligations transfer wholesale from paper.

Applies when

A provider creates or maintains medical records in electronic format

StatewideN.C. Gen. Stat. § 90-412Patients and designated representativesVerified 2026-08-30

Limit on copy fees, format or delivery

A health care provider MAY CHARGE A REASONABLE FEE to cover the costs incurred in SEARCHING, HANDLING, COPYING AND MAILING medical records to the patient or the patient's designated representative. The MAXIMUM FEE FOR EACH REQUEST shall be SEVENTY-FIVE CENTS PER PAGE FOR THE FIRST 25 PAGES, FIFTY CENTS PER PAGE FOR PAGES 26 THROUGH 100, and TWENTY-FIVE CENTS FOR EACH PAGE IN EXCESS OF 100 PAGES, provided that the provider MAY IMPOSE A MINIMUM FEE OF UP TO TEN DOLLARS, INCLUSIVE OF COPYING COSTS. Nothing limits a REASONABLE PROFESSIONAL FEE charged by a physician for the REVIEW AND PREPARATION OF A NARRATIVE SUMMARY if requested. Charges for records related to workers' compensation claims are governed by the fees the North Carolina Industrial Commission establishes under § 97-26.1. This section DOES NOT APPLY to Department of Health and Human Services Disability Determination Services requests made on behalf of an applicant for Social Security or Supplemental Security Income disability.

What this means operationally

North Carolina lets the provider recover SEARCHING and HANDLING, which most cost-based regimes exclude, and the ten-dollar minimum makes a short request disproportionately expensive — a two-page chart costs ten dollars rather than a dollar fifty. Two carve-outs decide who pays nothing: a workers' compensation request is priced by the Industrial Commission instead, and a DHHS Disability Determination Services request on behalf of a Social Security or SSI applicant falls outside the section entirely. The narrative-summary clause is a separate professional fee and is not capped by the page schedule, so a physician summary can lawfully cost more than the records themselves.

Applies when

A health care provider supplies medical records to a patient or designated representative

Exceptions

Does not reach X rays or fetal monitor records, which § 90-410(2) excludes from MEDICAL RECORDS
Workers’ compensation records are priced under N.C. Gen. Stat. § 97-26.1
Does not apply to DHHS Disability Determination Services requests for Social Security or SSI disability applicants

StatewideN.C. Gen. Stat. §§ 90-410, 90-411Patients and designated representativesVerified 2026-08-30

What applies to dental practices everywhere

Dental ePHI does not live in one system. It moves through the practice management system, digital imaging equipment, operatories, front-desk workstations, insurance transactions, laboratories, referral workflows, mobile devices, cloud backups, patient communication, and third-party support systems.

The practice management system and every user with administrative, clinical, scheduling, or billing access

Panoramic, CBCT, intraoral, and other imaging systems — including how images move between devices, workstations, laboratories, specialists, and storage

Electronic claims, eligibility verification, payment, and clearinghouse workflows

Patient portals, digital forms, e-fax, email, text messaging, appointment reminders, and referral tools

Office servers, workstations, laptops, tablets, phones, removable media, network equipment, and cloud backups

Every vendor that stores, maintains, transmits, or can remotely access the practice's ePHI

Full dentistscompliance guide →

Knowing the North Carolina rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the North Carolina rules on this page.

Start the risk assessment