North Dakota Privacy Law Compliance Checklist for Patient Acquisition Agencies

North Dakota Privacy Law Overview

Who must comply

As a patient acquisition agency, you routinely handle sensitive intake data, inquiries, and marketing interactions that can reveal health conditions. If you serve healthcare providers, you may be a HIPAA business associate; if you market directly to consumers, you still must protect patient health information privacy under state-specific privacy regulations and federal consumer protection rules.

What data you handle

• Protected health information (PHI): names, contact details, treatment interests, referral sources, and web or call data linked to a person’s health.
• Personal data used for targeting: device identifiers, cookies, IP addresses, chat transcripts, and CRM records that can infer health status.
• Consent artifacts: web form submissions, call or SMS opt-ins, and signed authorizations that prove patient consent documentation.

Legal foundations to anchor your program

• HIPAA/HITECH when you create, receive, maintain, or transmit PHI for covered entities, including the need for Business Associate Agreements (BAAs).
• Federal marketing rules (TCPA for calls/texts, CAN-SPAM for email), plus state advertising and data breach notification requirements.
• North Dakota medical confidentiality expectations and unfair/deceptive practice prohibitions, requiring clear disclosures, confidentiality protocols, and secure handling of health-related leads.

Use this North Dakota Privacy Law Compliance Checklist to align marketing, intake, and analytics with strict data security measures while respecting patient expectations and rights.

Compliance Requirements for Patient Acquisition

Operational checklist

1. Map data flows: identify every point where health-related data is collected, stored, shared, or analyzed (web, landing pages, call centers, chat, SMS, CRM, analytics, ads platforms).
2. Determine your role: confirm whether you are a HIPAA business associate, a subcontractor to one, or a non-HIPAA marketer handling health-adjacent data, and apply the strictest controls across all contexts.
3. Execute BAAs: sign BAAs with provider clients and any downstream vendors that touch PHI. Verify each vendor’s security posture and scope of permitted uses.
4. Establish lawful bases: obtain HIPAA-compliant authorization for marketing that uses PHI; rely on permitted uses for care coordination or operations; apply opt-in consent for calls/texts under TCPA.
5. Capture consent clearly: design forms and scripts that specify purpose, channel, frequency, and data categories. Timestamp, source, and retain patient consent documentation.
6. Honor opt-outs: implement immediate suppression across email, SMS, calls, and audience lists. Log the date, channel, and method of each opt-out.
7. Limit tracking: avoid transmitting PHI or identifiers correlated to health conditions to non-HIPAA analytics, ad pixels, or CDPs. Use de-identification and server-side controls where appropriate.
8. Minimize data: collect only what you need for stated purposes. Separate lead-qualification data from clinical intake whenever possible.
9. Apply confidentiality protocols: standardize need-to-know access, call handling, screen privacy, and secure note-taking for agents and marketers.
10. Publish precise notices: maintain a privacy notice that reflects state-specific privacy regulations, data uses, retention, rights, and contact methods for requests.
11. Audit regularly: test consent capture, suppression lists, and vendor data paths. Document findings and remediation in compliance auditing records.
12. Plan for incidents: maintain an incident response playbook with roles, forensics steps, and communication templates.

Patient Rights in Data Privacy

• Access: provide individuals with copies of their information upon request within HIPAA timelines, using secure delivery and identity verification.
• Amendment: allow patients to request corrections to inaccurate or incomplete data; track approvals or denials with reasons.
• Restrictions and preferences: record communication preferences, do-not-call/text flags, preferred channels, and confidential communication requests.
• Accounting of disclosures: maintain logs of non-routine disclosures of PHI and provide an accounting on request for the required look-back period.
• Authorization revocation: let individuals revoke marketing authorizations at any time and promptly stop further use or disclosure for that purpose.
• Marketing opt-outs: honor unsubscribe and do-not-sell/share style requests where applicable, and propagate them to partners and platforms.

Data Handling and Security Practices

Administrative safeguards

• Governance: assign a privacy officer and a security officer; maintain current policies on confidentiality, retention, incident response, and vendor risk.
• Risk analysis: perform periodic assessments that cover web properties, martech stacks, call flows, and remote work arrangements.
• Vendor management: evaluate third parties for data security measures, breach history, and minimum-necessary data scopes.

Technical safeguards

• Access control: enforce least privilege, multifactor authentication, SSO, and session timeouts; segment PHI from general marketing data.
• Encryption: protect data in transit (TLS 1.2+) and at rest; use secure key management and encrypted backups.
• Logging and monitoring: retain immutable logs for access, changes, exports, and integrations; alert on anomalies and excessive queries.
• Secure development: sanitize inputs, restrict embedded third-party scripts, and review releases for unintended data leakage.

Physical and operational safeguards

• Device security: apply full-disk encryption, MDM, patching, and remote wipe on all endpoints touching sensitive data.
• Workstation privacy: prevent shoulder-surfing in call centers, disable USB write access, and restrict printing.
• Data lifecycle: define retention schedules and defensible deletion for recordings, chat logs, and ad platform exports.

Marketing technology controls

• Tag governance: inventory all pixels, SDKs, and tags; block those that collect or receive PHI or health-inference signals.
• Audience hygiene: use de-identified or aggregated audiences; prohibit raw PHI uploads; validate data-sharing toggles per platform.

Breach Notification Procedures

1. Identify and contain: isolate affected systems, rotate credentials, and preserve logs and evidence.
2. Assess risk: determine what data was involved, whether it was actually acquired or viewed, who was affected, and the likelihood of misuse.
3. Decide if it is a reportable breach: apply HIPAA’s risk assessment for PHI and North Dakota’s data breach notification requirements for personal information.
4. Notify promptly: issue individual notifications without unreasonable delay and within applicable deadlines; include required content elements and plain-language guidance.
5. Regulator and media notice: for HIPAA breaches affecting 500+ individuals in a jurisdiction, notify HHS and relevant media; for smaller events, report to HHS annually within the required window. Notify state authorities if required.
6. Offer remediation: provide support such as call center assistance and, when appropriate, credit or identity monitoring.
7. Document and improve: record timeline, decisions, and remedial actions; update safeguards and confidentiality protocols based on lessons learned.

Record Keeping Obligations

• Policies and procedures: maintain current versions and prior iterations; keep HIPAA documentation for at least six years.
• Consent and authorization logs: retain signed forms, web capture artifacts, call recordings, and audit trails tied to campaigns.
• Training records: store curricula, attendance, assessment scores, and dates for all staff.
• BAAs and vendor due diligence: archive contracts, risk questionnaires, and security reviews.
• Breach and complaint logs: keep incident records, investigation notes, notification copies, and corrective actions.
• Compliance auditing records: preserve risk analyses, monitoring outputs, tag audits, and remediation plans to show continuous compliance.

Employee Training on Privacy Compliance

• Onboarding and cadence: provide role-based training at hire, then refresh at least annually, with interim microlearning on emerging risks.
• Role-specific modules: teach call agents consent capture and verification; teach marketers limits on tracking, data sharing, and list management.
• Practical drills: run breach tabletop exercises, consent-capture role plays, and phishing simulations.
• Assessment and attestations: test comprehension, require policy attestations, and track completion rates.
• Localization: incorporate North Dakota scenarios and state-specific privacy regulations into scripts, FAQs, and job aids.

A disciplined privacy program—rooted in clear consent, least data, strong security, and rigorous documentation—lets you grow patient volume while honoring trust and legal obligations in North Dakota.

FAQs

What are the key privacy laws affecting patient acquisition agencies in North Dakota?

Expect to comply with HIPAA/HITECH when PHI is involved, federal marketing rules like TCPA and CAN-SPAM, and North Dakota confidentiality and breach laws. Platform and consumer protection standards also apply to how you collect, track, and share health-related data across websites, call centers, analytics, and ads.

How must patient consent be documented and maintained?

Capture specific, informed consent at the point of collection, disclose purposes and channels, and store proof with timestamps, source, and version of the disclosure. Keep signed authorizations, opt-in records for calls/texts, and opt-out logs, and link each to the relevant campaign and data fields for reliable retrieval.

What steps must be taken in the event of a data breach?

Contain and investigate, perform a risk assessment, determine reportability under HIPAA and state rules, notify affected individuals without unreasonable delay, and meet regulator and (if required) media notice obligations. Document actions, provide support to individuals, and strengthen controls to prevent recurrence.

How often should staff receive privacy law training?

Train at onboarding, refresh at least annually, and supplement with short, role-specific updates when laws, technologies, or campaigns change. Reinforce learning with assessments, scenario drills, and documented attestations to demonstrate ongoing compliance.