HIPAA compliance for independent medical practices in North Carolina

North Carolina keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, North Carolina has 9 recorded rules that apply to independent medical practices differently from other businesses in the state — set out below with their conditions and sources.

North Carolina jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether North Carolina's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Medical practices that electronically submit claims, check eligibility, request authorization, or conduct another adopted transaction are HIPAA covered entities. That describes the overwhelming majority of modern medical practices. The duties below are required; an EHR does not perform them for the practice.

State — how North Carolina law interacts with HIPAA

North Carolina's breach-notification statute contains no HIPAA-specific provision. Independent medical practices must satisfy the state regime on its own terms, independently of anything HIPAA requires.

N.C.G.S. § 75-65 does not itself contain HIPAA-substitution language on the face of the operative notification section. HIPAA-regulated practices operating in North Carolina must independently satisfy § 75-65's individual-notice and AG Consumer Protection Division notice obligations — the HIPAA-related language that appears elsewhere in Chapter 75 (for example § 75-66 or related provisions) governs different subject matter and should not be imported into § 75-65 to imply an exemption that the operative section does not provide.

What North Carolina adds for independent medical practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not North Carolina's general breach law, which applies the same way to every business in the state.

Minor consent to treatment

Minor may consent

A minor may give effective consent to a physician licensed to practice medicine in North Carolina for medical health services for the prevention, diagnosis and treatment of venereal disease and other diseases reportable under G.S. 130A-135, pregnancy, abuse of controlled substances or alcohol, and emotional disturbance.

Provider class: a physician licensed to practice medicine in North Carolina
Service: prevention, diagnosis and treatment of venereal and other reportable disease, pregnancy, abuse of controlled substances or alcohol, and emotional disturbance

What this means operationally

Two independent limits. The consent runs to a licensed physician, so a practice without one cannot rely on it; and it runs to four named subject matters, so it does not become a general consent once a minor is in the building for one of them. Emotional disturbance is the limb that reaches behavioral health, and it sits alongside three that do not.

Applies when

The service is given by a physician licensed to practice medicine in North Carolina
The service concerns one of the four enumerated subject matters

Exceptions

Does not authorize inducing an abortion, performing a sterilization operation, or admission to a 24-hour facility licensed under Article 2 of Chapter 122C except as provided in G.S. 122C-223
Does not prohibit admission of a minor to a treatment facility on the minor's own written application in an emergency as authorized by G.S. 122C-223
Subject to subsection (a1), which requires written parental consent for a vaccine under emergency use authorization

State statuteN.C. Gen. Stat. § 90-21.5(a)All minors under 18Verified 2026-08-29

Left to professional judgment

A physician licensed to practice medicine in North Carolina may treat a minor without first obtaining the consent of a parent, guardian or person in loco parentis where: the parent, guardian or person in loco parentis cannot be located or contacted with reasonable diligence within the time the minor needs treatment; the identity of the child is unknown, or the necessity for immediate treatment is so apparent that any effort to secure approval would delay treatment so long as to endanger the minor's life; an effort to make contact would result in a delay that would seriously worsen the minor's physical condition; or the parents refuse to consent and the necessity for immediate treatment is so apparent that the delay required to obtain a court order would endanger the life or seriously worsen the physical condition of the child. Treatment for this purpose means any medical procedure or treatment, including X-rays, administration of drugs, blood transfusions, anaesthetics and laboratory or other diagnostic procedures, employed commensurate with reasonable care and the standards of medical practice in the community.

Provider class: a physician licensed to practice medicine in North Carolina
Service: treatment as defined in G.S. 90-21.2, including surgery under G.S. 90-21.3

What this means operationally

The fourth branch is what distinguishes North Carolina: a physician may treat OVER a parent's refusal without going to court, where the delay a court order would take is itself the danger. That is materially different from the Florida and Virginia emergency provisions, which are built around the parent being unreachable rather than unwilling. It also carries its own safeguard, recorded separately — a second physician's opinion.

Applies when

One of the four enumerated circumstances applies

Exceptions

Treatment over a parent's objection requires a second physician's opinion under the proviso to G.S. 90-21.1(4)
Surgery under this authority requires a second physician's opinion under G.S. 90-21.3
A physician's refusal to treat without parental consent is not grounds for civil or criminal action

State statuteN.C. Gen. Stat. §§ 90-21.1, 90-21.2Minors needing treatment where parental consent is unavailable or refusedVerified 2026-08-29

Prerequisite before the authority may be used

No surgery may be conducted on a minor under G.S. 90-21.1 unless the surgeon first obtains the opinion of another physician licensed to practice medicine in North Carolina that the surgery is necessary under the conditions set out in that section. That requirement does not apply in an emergency arising in a rural community, or in a community where it is impossible for the surgeon to contact any other physician for the purpose of obtaining the opinion.

Provider class: the operating surgeon, plus a second physician licensed in North Carolina
Service: surgery on a minor without parental consent

What this means operationally

A prerequisite rather than a judgment call: until the second opinion exists, the surgery may not proceed on this authority at all. Its trigger is that the procedure is SURGICAL, so it applies across all four G.S. 90-21.1 circumstances. The escape is geographic and practical rather than clinical — a rural emergency, or any community where no other physician can be contacted — which means an urban practice that simply could not reach a colleague quickly is on weaker ground than the wording first suggests.

Applies when

Surgery is to be performed on a minor under the G.S. 90-21.1 authority

Exceptions

Does not apply in an emergency arising in a rural community, or where it is impossible for the surgeon to contact any other physician

State statuteN.C. Gen. Stat. § 90-21.3Minors treated without or against parental consentVerified 2026-08-29

Limit on liability

A physician licensed to practice medicine in North Carolina who provides health services to a minor under the terms, conditions and circumstances of Article 1A shall not be held liable in any civil or criminal action for providing those services without having obtained permission from the minor's parent, legal guardian, person standing in loco parentis, or a legal custodian other than a parent granted specific authority in a custody order to consent to medical or psychiatric treatment. The physician is not relieved by the Article from liability for negligence in the diagnosis and treatment of a minor.

Provider class: a physician licensed to practice medicine in North Carolina
Service: health services provided to a minor under Article 1A

What this means operationally

The protection is against the CONSENT question only and the section says so expressly, which is worth noting because it is the same structure Florida uses and the opposite of what practices often assume. It also introduces a fourth category of adult the rest of the corpus rarely names — a legal custodian other than a parent who holds specific authority under a custody order, which is a document a practice would have to see to know about.

Applies when

Health services were provided to a minor under Article 1A

Exceptions

No relief from liability for negligence in diagnosis and treatment

State statuteN.C. Gen. Stat. § 90-21.4(a)Minors treated under Article 1AVerified 2026-08-29

Provider must disclose

Notwithstanding any other provision of law to the contrary, a health care provider shall obtain WRITTEN consent from a parent or legal guardian prior to administering any vaccine that has been granted emergency use authorization and is not yet fully approved by the United States Food and Drug Administration to an individual under 18 years of age.

Service: administration of a vaccine granted emergency use authorization and not yet fully FDA-approved
Patient population: individuals under 18

What this means operationally

A narrow rule with a wide override — it opens 'notwithstanding any other provision of law', so it displaces the minor-consent routes in § 90-21.5(a) for the vaccines it covers. What makes it operationally awkward is that its trigger is a REGULATORY STATUS that changes over time: a product moves from emergency use authorization to full approval, and the consent requirement lapses when it does. A practice cannot encode this once; it has to track approval status per product.

Applies when

The patient is under 18
The vaccine holds emergency use authorization and is not yet fully FDA-approved

State statuteN.C. Gen. Stat. § 90-21.5(a1)Individuals under 18Verified 2026-08-29

Prerequisite before the authority may be used

No treatment shall be administered to a child over the parent's objection as authorized by G.S. 90-21.1 unless the physician first obtains the opinion of another physician licensed to practice medicine in North Carolina that the procedure is necessary to prevent immediate harm to the child.

Provider class: the treating physician, plus a second physician licensed in North Carolina
Service: treatment administered over a parent's objection

What this means operationally

The condition attached to the most exposed branch of the North Carolina emergency authority — treating where the parent has refused and a court order would take too long. It is a prerequisite, not a judgment: without the second physician's opinion the treatment is not authorized on this section, however urgent. Note the standard the opinion must address is narrower than the surgical rule's — whether the procedure is necessary to prevent IMMEDIATE HARM. The section itself carries no rural or cannot-contact exception, but that does not leave a practice without a route: where a second physician genuinely cannot be reached in time, G.S. 7B-3600 supplies a judicial authorization pathway built for exactly that case, and it is recorded separately.

Applies when

The parents refuse to consent
The necessity for immediate treatment is so apparent that the delay required to obtain a court order would endanger the life or seriously worsen the physical condition of the child

State statuteN.C. Gen. Stat. § 90-21.1(4), second-opinion provisoMinors treated over a parent's objectionVerified 2026-08-29

Provider disclosure to a parent

Release prohibited

A physician shall not notify a parent or legal guardian of services rendered under G.S. 90-21.5(a) without the permission of the minor, unless the situation in the opinion of the attending physician indicates that notification is essential to the life or health of the minor.

Provider class: the physician treating the minor under § 90-21.5(a)
Service: the four subject matters listed in § 90-21.5(a)
Patient population: minors treated on their own consent

What this means operationally

North Carolina's default is silence, which is the opposite of Texas and looser only than an absolute bar. Because the exception is framed as essential to life or health rather than as clinical discretion generally, a practice cannot notify simply because it judges involvement helpful — the threshold is high and the record should show it was met.

Applies when

The services were rendered under § 90-21.5(a)

Exceptions

Notification is permitted where the attending physician's opinion indicates it is essential to the life or health of the minor

State statuteN.C. Gen. Stat. § 90-21.4(b)Minors treated on their own consent under § 90-21.5(a)Verified 2026-08-29

Provider may disclose

If a parent, legal guardian or person standing in loco parentis contacts the physician concerning the treatment, the physician may give information.

Provider class: the physician treating the minor under § 90-21.5(a)
Patient population: minors whose parent has contacted the physician

What this means operationally

The default flips on who initiates. Silence is required until a parent makes contact, at which point disclosure becomes discretionary — so the same file is governed by a prohibition or a permission depending on an event outside the practice's control. Front-desk staff need to recognize that a parental enquiry changes the rule rather than merely triggering the existing one.

Applies when

A parent, legal guardian or person in loco parentis contacts the physician about the treatment

State statuteN.C. Gen. Stat. § 90-21.4(b)Minors whose parent has contacted the treating physicianVerified 2026-08-29

Who may act for the patient

Minor may consent

A juvenile in need of emergency treatment under Article 1A of Chapter 90, whose physician is barred from rendering necessary treatment by reason of parental refusal to consent, may receive treatment with court authorization. The physician signs a written statement setting out the treatment and the emergency need for it, the refusal to consent, and THE IMPOSSIBILITY OF CONTACTING A SECOND PHYSICIAN for a concurring opinion in time to prevent immediate harm. On finding the statement in accordance with the Article and the treatment necessary to prevent immediate harm, the court may issue written authorization. In acute emergencies where time does not permit the written procedure, the court may authorize treatment IN PERSON OR BY TELEPHONE on the physician's oral statement. The court should attempt to offer the parent an opportunity to state their reasons for refusal, but failure to hear the parent does not invalidate the authorization. The court's authorization has the same effect as parental consent.

Provider class: the treating physician, with authorization from the court
Service: emergency treatment under Article 1A of Chapter 90 blocked by parental refusal

What this means operationally

The route that exists precisely where the § 90-21.1(4) prerequisite cannot be met — its own required statement asks the physician to certify that a second physician could not be reached in time. So the two provisions interlock rather than competing: second opinion where one is obtainable, court authorization where one is not. Two features make it usable in a real emergency: authorization can be given by telephone on an oral statement, and the parent's objection does not have to be heard first for the authorization to stand. The paperwork follows rather than precedes — the oral authorization is reduced to writing as soon as possible and filed with the physician's statement. A separate hearing afterwards allocates the cost of the treatment.

Applies when

The juvenile needs emergency treatment under Article 1A of Chapter 90
The physician is barred from treating by parental refusal
A second physician cannot be contacted for a concurring opinion in time to prevent immediate harm

Exceptions

The court should attempt to offer the parent an opportunity to state reasons for refusal, but failure to do so does not invalidate the authorization

State statuteN.C. Gen. Stat. § 7B-3600Juveniles needing emergency treatment where a parent has refusedVerified 2026-08-29

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

North Carolina breach obligations

These apply to businesses generally rather than to independent medical practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

North Carolinabreach data →

Individual notice deadline

Following discovery or notification of the breach, without unreasonable delay, subject to statutory qualifications including law-enforcement delay and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

The statute does not fix a numeric outer bound. Unreasonable delay is itself a violation and may result in state enforcement action, so treat the operative timeframe as the shortest window your incident circumstances reasonably support.

State regulator notice

Required

Whenever a business provides individual notice, it must also provide notice to the Consumer Protection Division of the North Carolina Attorney General's Office. This is required for any breach that triggers individual notice — there is no numeric threshold for the AG notice itself.

Source: N.C.G.S. § 75-65

Statewide rules that also reach independent medical practices

Minor may consent

Any minor who is emancipated may consent to any medical treatment, dental and health services for themselves or for their child.

What this means operationally

Emancipation removes the subject-matter and provider limits that constrain § 90-21.5(a), so it is the provision that turns a narrow consent into a general one. Intake needs to be able to record emancipation as a status, because it changes which rule applies rather than merely satisfying the one already in play.

Applies when

The minor is emancipated

StatewideN.C. Gen. Stat. § 90-21.5(b)Emancipated minorsVerified 2026-08-29

Duty to keep an accurate record

Any health care provider or facility licensed, certified or registered under the laws of this State MAY CREATE AND MAINTAIN MEDICAL RECORDS IN AN ELECTRONIC FORMAT and SHALL NOT BE REQUIRED TO MAINTAIN A SEPARATE PAPER COPY. A provider SHALL MAINTAIN ELECTRONIC MEDICAL RECORDS IN A LEGIBLE AND RETRIEVABLE FORM, INCLUDING ADEQUATE DATA BACKUP. Authorized individuals may AUTHENTICATE orders and other medical record entries by written signature, or by ELECTRONIC OR DIGITAL SIGNATURE in lieu of ink. MEDICAL RECORD ENTRIES SHALL BE AUTHENTICATED BY THE INDIVIDUAL WHO MADE OR AUTHORIZED THE ENTRY. AUTHENTICATION means identification of the author of an entry BY THAT AUTHOR and CONFIRMATION THAT THE CONTENTS OF THE ENTRY ARE WHAT THE AUTHOR INTENDED. The legal rights and responsibilities of patients, providers and facilities APPLY TO ELECTRONIC RECORDS TO THE SAME EXTENT as to paper, with respect to the SECURITY, CONFIDENTIALITY, ACCURACY, INTEGRITY, ACCESS TO AND DISCLOSURE of medical records.

What this means operationally

Three obligations here read as system requirements rather than policy. LEGIBLE AND RETRIEVABLE FORM INCLUDING ADEQUATE DATA BACKUP is a state-law backup mandate with no size threshold. The authentication definition is stricter than a signature field: it requires identification of the author BY THAT AUTHOR and confirmation the contents are what the author INTENDED, which is an attestation step, not a login. And subsection (c) forecloses the argument that electronic records attract lighter duties — security, confidentiality, accuracy, integrity, access and disclosure obligations transfer wholesale from paper.

Applies when

A provider creates or maintains medical records in electronic format

StatewideN.C. Gen. Stat. § 90-412Patients and designated representativesVerified 2026-08-30

Limit on copy fees, format or delivery

A health care provider MAY CHARGE A REASONABLE FEE to cover the costs incurred in SEARCHING, HANDLING, COPYING AND MAILING medical records to the patient or the patient's designated representative. The MAXIMUM FEE FOR EACH REQUEST shall be SEVENTY-FIVE CENTS PER PAGE FOR THE FIRST 25 PAGES, FIFTY CENTS PER PAGE FOR PAGES 26 THROUGH 100, and TWENTY-FIVE CENTS FOR EACH PAGE IN EXCESS OF 100 PAGES, provided that the provider MAY IMPOSE A MINIMUM FEE OF UP TO TEN DOLLARS, INCLUSIVE OF COPYING COSTS. Nothing limits a REASONABLE PROFESSIONAL FEE charged by a physician for the REVIEW AND PREPARATION OF A NARRATIVE SUMMARY if requested. Charges for records related to workers' compensation claims are governed by the fees the North Carolina Industrial Commission establishes under § 97-26.1. This section DOES NOT APPLY to Department of Health and Human Services Disability Determination Services requests made on behalf of an applicant for Social Security or Supplemental Security Income disability.

What this means operationally

North Carolina lets the provider recover SEARCHING and HANDLING, which most cost-based regimes exclude, and the ten-dollar minimum makes a short request disproportionately expensive — a two-page chart costs ten dollars rather than a dollar fifty. Two carve-outs decide who pays nothing: a workers' compensation request is priced by the Industrial Commission instead, and a DHHS Disability Determination Services request on behalf of a Social Security or SSI applicant falls outside the section entirely. The narrative-summary clause is a separate professional fee and is not capped by the page schedule, so a physician summary can lawfully cost more than the records themselves.

Applies when

A health care provider supplies medical records to a patient or designated representative

Exceptions

Does not reach X rays or fetal monitor records, which § 90-410(2) excludes from MEDICAL RECORDS
Workers’ compensation records are priced under N.C. Gen. Stat. § 97-26.1
Does not apply to DHHS Disability Determination Services requests for Social Security or SSI disability applicants

StatewideN.C. Gen. Stat. §§ 90-410, 90-411Patients and designated representativesVerified 2026-08-30

What applies to independent medical practices everywhere

Independent medical practices often have the broadest technology and data surface: EHRs, portals, laboratories, e-prescribing, imaging, claims, referrals, fax, remote access, and dozens of vendors. The SRA must cover the whole environment — not merely the primary EHR.

The complete inventory of systems that create, receive, maintain, or transmit ePHI

EHR access, administrative privileges, audit logging, integrations, APIs, and patient-portal connections

Laboratory, imaging, e-prescribing, pharmacy, hospital, specialist, and referral data flows

Claims, eligibility, prior authorization, clearinghouse, billing, and payment workflows

Email, text, e-fax, forms, telehealth, call recording, voicemail, and patient messaging

Workstations, servers, laptops, tablets, phones, network equipment, remote access, cloud storage, and backup

Full medical practicescompliance guide →

Knowing the North Carolina rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the North Carolina rules on this page.

Start the risk assessment