North Dakota Physical Therapy Encounter Records: Privacy Laws & Compliance Guide

Patient Record Management Requirements

What belongs in a physical therapy encounter record

Your encounter record should clearly tell the story of care: referral and diagnosis, evaluation findings, clinical reasoning, goals, plan of care, interventions, patient response, education, and follow‑up. Include dates and times, signatures or authenticated e‑signatures, and any modifications to the plan.

Capture collaboration with other providers, communication with payers, and any equipment issued. When care involves assistants or students, document direction and supervision to align with the North Dakota Administrative Code and your facility policy.

Documentation integrity and corrections

Authenticate each note, avoid late entries when possible, and use addenda—never delete or overwrite original content. Date, time, and explain corrections. Maintain a complete audit trail that shows who created, viewed, or changed each entry.

Workflow tips that scale

• Standardize note templates to reduce omissions and improve quality.
• Embed required fields for consent, outcome measures, and progress toward goals.
• Automate prompts for re‑evaluation timelines and discharge summaries.

Record Retention Policies

Setting your record retention period

Adopt a written retention schedule that specifies the record retention period for adults and minors, aligns with the North Dakota Administrative Code, and meets payer and federal program obligations. Use the most stringent rule that applies to your clinic and keep policy documentation current.

Retain telehealth notes, consents, and any recordings for at least the same period as in‑person records. When research, quality improvement, or grant conditions apply, verify whether longer retention is required.

Special cases that require longer retention

• Minors: retain beyond the age of majority per policy and insurer requirements.
• Medicare, Medicaid, and federal grants: follow program‑specific minimums and audit windows.
• Litigation or audit hold: immediately suspend destruction for all potentially relevant records.

Secure storage and disposal

Store records in locked areas or encrypted systems with backups. When the retention period ends, dispose of paper via cross‑cut shredding and sanitize or destroy media for electronic data. Keep certificates of destruction for accountability.

Confidentiality and Security Standards

Scope of confidential health information

Treat all individually identifiable patient data—written, verbal, and electronic—as confidential health information. Apply the minimum necessary standard to every use and disclosure that is not for direct treatment.

Authorized Access Controls

Implement role‑based access with unique user IDs, strong authentication, and least‑privilege permissions. Log access, regularly review user rights, and promptly remove access when roles change. Train your team to recognize and report privacy incidents.

Technical and physical safeguards

• Encrypt ePHI at rest and in transit; use vetted EHRs and secure messaging.
• Harden endpoints, patch systems, and use mobile device management.
• Control physical access to workstations, file rooms, and servers.
• Execute business associate agreements with cloud, billing, and telehealth vendors.

Breach response and Data Breach Notification Requirements

Maintain an incident response plan that defines how to identify, contain, investigate, and document suspected breaches. If a breach occurs, follow applicable data breach notification requirements, notifying affected individuals—and regulators when thresholds apply—without undue delay and within any mandated timelines.

Authorized Use of Health Information

Permitted uses without additional authorization

You may use and disclose information for treatment, payment, and health care operations. Share only what is necessary, verify recipient identity, and document disclosures when required by policy.

Disclosures requiring written permission

Obtain patient authorization for marketing, disclosures to employers or schools, and most non‑treatment sharing. Use clear forms that specify what will be released, to whom, for what purpose, and for how long the authorization remains valid.

Requests from third parties

Validate subpoenas, court orders, and law‑enforcement requests before releasing records. When in doubt, consult counsel and follow your release‑of‑information workflow to protect patient rights and comply with state and federal rules.

Patient rights

Patients can access, inspect, and request copies or amendments to their records, and they may request restrictions on certain disclosures. Track and respond to requests within policy timelines and maintain an accounting of disclosures when required.

Telehealth Records Compliance

Telehealth Patient Consent essentials

Before delivering care, obtain and document telehealth patient consent that explains the nature of telehealth, potential risks, privacy limitations, alternatives, and how to withdraw consent. Reconfirm consent when technology or clinical circumstances change.

What to document for each session

• Patient identity verification and location at the time of service.
• Provider location, licensure basis, and emergency contingency plan.
• Technology used, connectivity issues, and any limitations to assessment.
• Clinical content equal to an in‑person note: exam, interventions, response, and plan.

Platform and security expectations

Use platforms with encryption, access controls, and audit logging. Execute business associate agreements as needed and avoid consumer apps that lack enterprise safeguards. Store telehealth data within your EHR whenever possible to unify the record.

Licensure and the Physical Therapy Licensure Compact

If you treat a patient located outside North Dakota, confirm authority to practice through a full license or the Physical Therapy Licensure Compact. Your documentation should reflect how you verified licensure eligibility and complied with the patient’s location laws.

Disciplinary Actions for Violations

Board and administrative actions

Violations involving privacy, documentation, or unprofessional conduct may lead to board actions that include reprimand, fines, remedial education, probation, suspension, or license revocation. Repeated or willful violations typically result in more severe penalties.

Federal and civil exposure

Security failures and impermissible disclosures can trigger civil penalties, corrective action plans, and, in egregious cases, criminal liability. Contractual penalties from payers and reputational harm often follow a significant breach.

Reducing risk after an incident

Act quickly: contain the issue, perform a risk assessment, notify affected parties per data breach notification requirements, retrain staff, and document corrective actions. Demonstrated remediation can mitigate penalties and restore trust.

Health Information Network Participation

Participation and consent model

When joining a health information network, follow the participation agreement, data‑sharing rules, and the network’s consent model (opt‑in or opt‑out). Ensure patients receive clear notices about how their information flows through the network.

Access, break‑glass, and audit

Configure access so users can query only for legitimate treatment purposes. Enable break‑the‑glass protocols for emergencies and audit those events promptly. Retain query logs per your retention schedule.

Data quality and interoperability

Use standardized codes and complete demographics to improve patient matching. Reconcile imported data carefully, and correct errors through the network’s amendment process to keep longitudinal records accurate.

Operating across borders

Cross‑state exchange requires attention to both sending and receiving state rules. If you deliver care under Physical Therapy Licensure Compact privileges, ensure your sharing and receiving of records meet the most protective applicable standard.

Conclusion

Build a cohesive program that unites accurate documentation, a defensible record retention period, strong authorized access controls, and clear telehealth patient consent. Anchor your policies to the North Dakota Administrative Code, train your team, test your breach response, and review your workflows annually to stay compliant and patient‑centered.

FAQs.

What are the record retention requirements for physical therapy records in North Dakota?

Adopt a written schedule that meets or exceeds the North Dakota Administrative Code, HIPAA policy‑retention rules, and payer contracts. In practice, clinics commonly retain adult records at least several years from the last encounter and longer for minors (beyond the age of majority). Keep policy documents and acknowledgments for the required HIPAA period, and extend retention when audits, litigation, or program rules demand it.

How must telehealth physical therapy records be handled to ensure privacy?

Use secure, encrypted platforms, verify patient identity and location, obtain telehealth patient consent, and document clinical content to the same standard as in‑person care. Store telehealth notes and artifacts in your EHR, restrict access using role‑based controls, and audit activity regularly.

Who is authorized to access patient physical therapy encounter records?

The patient and personal representative, the treating physical therapist and supervised team members, and staff with a job‑related need may access records under authorized access controls. External parties need a valid authorization, a qualifying treatment relationship, or a lawful request such as a court order.

What disciplinary actions can occur for non-compliance with privacy laws?

Depending on severity, the board may issue a reprimand, impose fines, require education, or place your license on probation, suspension, or revocation. Separate from licensure actions, privacy violations can also lead to civil penalties, corrective action plans, contractual remedies by payers, and reputational damage.