North Dakota Dialysis Clinics: Medical Records Privacy Laws and Patient Rights

Knowing how your health information is protected—and what you can do with it—helps you take control of your care. This guide explains how federal rules and North Dakota laws work together to safeguard patient confidentiality, set medical record retention timelines, and define your rights at dialysis facilities. It also clarifies NDHIN participation rules and how secure health information exchange affects you.

Federal Medical Records Privacy Regulations

HIPAA privacy, security, and breach notification

At the federal level, the HIPAA Privacy Rule protects health information privacy, allowing dialysis facilities to use or disclose your protected health information (PHI) for treatment, payment, and health care operations without your written authorization. HIPAA also guarantees your right to access your medical records, request amendments, and receive a Notice of Privacy Practices. The Security Rule requires administrative, physical, and technical safeguards for electronic PHI, and the Breach Notification Rule compels facilities to notify you if unsecured PHI is compromised.

ESRD Conditions for Coverage: confidentiality and record handling

• Dialysis facilities must maintain complete, accurate, and confidential medical records, ensuring appropriate access by the care team only.
• When a patient transfers, the releasing facility must send all requested medical record information to the receiving facility within one working day to support uninterrupted care.
• Facilities must retain dialysis patient records for at least six years from the date of discharge, transfer, or death. State laws or other professional rules that require longer retention still apply and should be followed.

Federal Patient Rights Regulations

Your federal rights at dialysis facilities

• Be informed of your patient rights and the facility’s policies, including discharge and transfer rules.
• Expect privacy and health information privacy protections, including confidential handling of your records.
• Access your medical records and be informed of your medical status and treatment options in clear language.
• Participate in your plan of care, receive necessary services, and be treated with dignity and respect.
• Use a grievance process without retaliation and contact external entities (the ESRD Network or state survey agency) if concerns are not resolved internally.
• Receive patient rights notification, including how to file grievances and who to contact outside the facility.

North Dakota Patient Rights Regulations

Confidentiality and disclosures under state law

North Dakota’s Health Information Protection laws reinforce patient confidentiality and limit disclosures to specific circumstances, such as public health needs, emergencies, or law enforcement requests that meet statutory criteria. Unlawful disclosures can carry penalties, underscoring the state’s commitment to health information privacy.

Decision-making and directives

North Dakota allows you to designate a health care agent and set treatment preferences through a health care directive. This supports informed decision-making for dialysis care, particularly around hospitalization, end-of-life choices, and emergency planning.

North Dakota Patient Records Regulations

Access, copies, and fees

• You may request copies of your medical records. If records are requested for transfer of care to another provider, one copy must be provided without charge.
• Otherwise, providers may charge capped fees for copies (different caps for paper versus electronic formats). These fees include any administrative, retrieval, and postage costs.
• HIPAA’s 30-day response timeline applies unless a shorter timeframe is required by applicable law or policy.

Patient confidentiality in practice

Dialysis facilities must limit access to those who need information for your care, apply minimum-necessary standards outside of treatment, and document disclosures as required. Staff training, role-based access, and audit trails help ensure dialysis facility compliance with both HIPAA and state law.

North Dakota Record Retention Regulations

How long records are kept in practice

• Dialysis facility (federal): At least six years from discharge, transfer, or death.
• Physicians and other licensees in North Dakota: At least seven years from the last date of service (longer if another law applies).
• Hospital-based units: Hospitals must preserve patient records for at least ten years after last treatment; for minors, until at least age twenty-one or ten years after last treatment, whichever is later.

Clinics should adopt the longest applicable retention period. In any pending or reasonably anticipated litigation, records must not be destroyed, even if a scheduled retention period has passed.

North Dakota Health Information Network Privacy Practices

NDHIN participation rules and secure health information exchange

• By default, your PHI can be queried in the NDHIN to support safe, coordinated care; access is limited to authorized users and is logged.
• Permitted uses through NDHIN are limited (for example, treatment, payment, health care operations, required public health reporting, or as required by law). Marketing uses are prohibited without your authorization.
• Minimum necessary policies apply to NDHIN use (except for treatment). A provider or health insurer cannot deny treatment or coverage solely because you choose not to participate.

Opt-out choices and what they mean

• Full Opt-Out: Your data cannot be searched via NDHIN.
• Opt Out Except for Emergencies: Your data is accessible through NDHIN only during a qualifying medical emergency.
• Processing: An Opt Out/Revoke Opt Out form is required; requests are typically processed within five business days. Your choice is flagged so providers can see it.
• Direct results: Even if you opt out, providers may still receive your lab and radiology results directly (e.g., secure interfaces or fax) outside the NDHIN query function.

Conclusion

For North Dakota dialysis clinics, federal HIPAA standards and ESRD Conditions for Coverage set the baseline for patient confidentiality and patient rights, while state law adds practical rules for record access, copy fees, and longer retention in certain settings. NDHIN offers secure health information exchange with clear participation choices. When in doubt, ask your clinic’s privacy officer which policies apply to your situation and how to exercise your rights.

FAQs.

What are the patient's rights regarding medical records at North Dakota dialysis clinics?

You have the right to privacy and confidentiality, to receive a Notice of Privacy Practices, and to access your records—usually within 30 days. You can request corrections, receive records in paper or electronic format, and direct your records to another provider (a transfer-of-care copy must be provided at no charge). You may also file grievances without retaliation and escalate unresolved concerns to the ESRD Network or the state survey agency.

How long must dialysis clinics retain patient medical records in North Dakota?

Federal rules for dialysis facilities require at least six years from discharge, transfer, or death. North Dakota adds longer requirements in some contexts: physicians must keep records at least seven years from the last service date, and hospital-based units follow hospital rules of at least ten years (longer for minors). Facilities typically follow the longest applicable period.

Can patients opt out of the North Dakota Health Information Network?

Yes. You may opt out entirely or choose “Opt Out Except for Emergencies,” which limits NDHIN access to emergency situations. Your request uses an Opt Out/Revoke Opt Out form and is usually processed within five business days. Even if you opt out, providers can still receive your results directly by non-NDHIN methods, and required-by-law reporting continues.

What are the conditions for releasing dialysis patient information under federal law?

Without your written authorization, disclosures are limited to treatment, payment, and health care operations, plus specific situations required or permitted by law (such as public health reporting or certain law enforcement requests). Disclosures must follow minimum-necessary standards (except for treatment). For transfers, the releasing dialysis facility must send all requested medical record information to the receiving facility within one working day to support continuity of care.