North Dakota Privacy Laws Checklist for General Thoracic Surgery Practices

Thoracic surgery practices in North Dakota must protect patient information under federal HIPAA rules and applicable state laws. Use this checklist to review how your practice handles medical records, breach notifications, telemedicine, and health information exchange access.

What HIPAA requirements apply to thoracic surgery practices in North Dakota?

A practice is generally a HIPAA-covered entity if it is a health care provider that conducts certain standard transactions electronically, such as submitting claims. HIPAA’s Privacy Rule governs uses and disclosures of protected health information (PHI), while the Security Rule requires safeguards for electronic PHI. Vendors that create, receive, maintain, or transmit PHI for the practice may be business associates, requiring an appropriate written agreement.

• Protect PHI. Use and disclose it only as HIPAA permits or requires, and provide the required privacy information to patients.
• Assess security risks. Conduct an accurate, thorough risk analysis and implement reasonable administrative, physical, and technical safeguards for electronic PHI. Review and update those measures as risks and systems change.
• Manage workforce access. Train staff on the practice’s policies and procedures, authorize access according to job responsibilities, and apply appropriate sanctions for violations.
• Prepare for incidents. Maintain procedures to identify, respond to, mitigate, and document security incidents.

HIPAA’s minimum necessary standard generally applies to many uses and disclosures, but not to disclosures to, or requests by, a health care provider for treatment. For example, a thoracic surgeon may share relevant records with another treating provider without obtaining a HIPAA authorization, while still using reasonable safeguards. See HHS guidance on the minimum necessary requirement and HHS guidance on treatment disclosures.

How should practices manage medical records and patient access?

Make sure staff can locate, protect, and release records through a documented process. Under HIPAA, patients generally have a right to access their medical and billing records held by a covered provider. The usual response deadline is 30 calendar days, with a possible one-time extension of up to 30 additional days when the practice gives the patient a written explanation. See HHS guidance on patients’ medical records rights.

North Dakota law separately addresses copies of medical records and bills. A provider must provide a free copy to a provider designated by the patient when the records are requested to transfer care for continued treatment. For other requests under that statute, a signed patient authorization is specified, and the law sets maximum charges for paper and electronic copies. Apply the state provision alongside—not as a substitute for—any applicable HIPAA access rights. Review North Dakota Century Code § 23-12-14.

• Verify the requester’s identity and authority before releasing records.
• Use the patient’s preferred access format when required and reasonably available under HIPAA.
• Document the request, response, any extension, and any lawful denial.
• Apply the practice’s retention and secure-disposal policies to paper and electronic records.

When must a practice notify patients of a data breach?

Under HIPAA, an impermissible use or disclosure of PHI is generally presumed to be a breach unless an exception applies or a documented risk assessment demonstrates a low probability that the PHI was compromised. The HIPAA Breach Notification Rule applies to breaches of unsecured PHI. A covered practice must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery; breaches affecting 500 or more individuals also require prompt notice to HHS, and breaches affecting more than 500 residents of a state or jurisdiction require notice to prominent media outlets serving that area. Breaches affecting fewer than 500 individuals must be reported to HHS annually. See the HHS Breach Notification Rule.

North Dakota’s breach law covers certain combinations of a person’s name and unencrypted personal information, including medical information and health insurance information. It generally calls for notice to affected residents without unreasonable delay and notice to the state attorney general when a breach exceeds 250 individuals. However, the law deems a HIPAA-covered entity, business associate, or subcontractor that complies with HIPAA breach-notification requirements to be in compliance with the state chapter. Review North Dakota Century Code Chapter 51-30 and assess which requirements apply to the practice and incident.

Keep a written response plan, involve the privacy or security lead promptly, preserve incident records, assess the information involved, and coordinate with affected business associates. Do not assume that every security incident is a reportable breach—or that an incident affecting fewer than 500 people needs no individual notice.

What privacy safeguards apply to telemedicine visits?

HIPAA’s privacy and security requirements continue to apply when a thoracic surgery practice provides care remotely. Use appropriate safeguards for the platform and the setting, such as access controls, private workspaces, and precautions against others overhearing or viewing the visit. The HHS guidance on incidental uses and disclosures explains that reasonable safeguards are required even though HIPAA does not require eliminating every incidental disclosure.

North Dakota holds physicians and physician assistants to the same standard of care and ethical standards in telemedicine as in in-person medicine. Before diagnosis or treatment, the practitioner must establish a bona fide patient relationship, verify the patient’s identity, and disclose their own identity and licensure status so the patient can verify them. An initial examination or evaluation must be equivalent to an in-person examination; a static online questionnaire or audio conversation alone does not meet the stated standard. See North Dakota Century Code § 43-17-44.

Choose a telemedicine method that supports appropriate clinical assessment and protects patient information. If a remote encounter cannot support diagnosis or complete treatment, the practitioner must be able to refer the patient for emergency or in-person care as appropriate.

How should staff manage access to health information exchanges?

Give staff access to the health information exchange only as appropriate for their roles and the purpose of their work. HIPAA requires appropriate access-management policies and safeguards for electronic PHI, including procedures to track access and detect security incidents. Use individual accounts, restrict unnecessary access, review audit records, and promptly remove or change access when a workforce member’s role changes.

North Dakota law allows an individual to opt out of the state health information organization. An individual may choose a full opt-out or a conditional opt-out that permits access when a provider determines it is needed for a medical emergency; the individual may change that choice by providing written notice. The law also bars withholding care or coverage solely because an individual participates or opts out. See North Dakota Century Code § 23-12-19.

Check the exchange’s applicable participation terms and procedures, honor a patient’s recorded choice, and document emergency access when relevant. North Dakota’s health information exchange chapter also provides that applicable federal and state confidentiality requirements continue to govern health information. See North Dakota Century Code Chapter 54-59.

What limits apply to North Dakota’s general privacy law coverage?

North Dakota has specific laws addressing subjects such as medical-record copies, health information exchange participation, and security breach notices. These provisions do not amount to a single comprehensive privacy framework for every health care practice and every kind of information. For covered practices, HIPAA remains the central federal framework for PHI, alongside applicable North Dakota statutes and professional rules.

Do not assume that every record, organization, or disclosure is governed in exactly the same way. HIPAA applies to covered entities and business associates within its scope, while North Dakota laws may apply according to their own definitions and conditions. Check the rule that covers the particular record or activity before using, disclosing, or retaining information.

In practice, a sound checklist combines HIPAA privacy and security procedures with North Dakota’s record-copy, breach-notice, telemedicine, and health information exchange rules. Review access controls, patient request workflows, and incident response procedures regularly so staff know what to do.

FAQs

Can a thoracic surgery practice share patient information for treatment?

Yes. HIPAA generally permits covered health care providers to share PHI with other providers for treatment without the patient’s authorization. The minimum necessary standard does not apply to disclosures to, or requests by, a health care provider for treatment, but the practice should still use reasonable safeguards and follow any applicable state requirements.

What medical records must a North Dakota telemedicine practitioner maintain?

A telemedicine practitioner is subject to the same North Dakota laws governing the adequacy of medical records and providing records to patients and other treating providers. North Dakota’s telemedicine statute does not set out a separate telemedicine-only record checklist. The practice should document the encounter sufficiently to support the evaluation, clinical decisions, treatment, and any referral, consistent with applicable recordkeeping rules and professional standards.

When does a North Dakota data breach require notification?

Under HIPAA, a breach of unsecured PHI generally requires notice to affected individuals without unreasonable delay and no later than 60 calendar days after discovery. HHS and, for a breach affecting more than 500 residents of a state or jurisdiction, media notice may also be required. North Dakota’s law addresses breaches involving certain unencrypted personal information, including medical and health insurance information, and calls for attorney general notice when a breach exceeds 250 individuals. HIPAA-regulated entities that comply with HIPAA breach-notification requirements are considered in compliance with the North Dakota breach chapter.

Is there a general North Dakota privacy law for healthcare practices?

North Dakota has several specific laws affecting health information, but no single comprehensive state privacy law that replaces HIPAA for health care practices. A practice should assess HIPAA coverage and follow any state laws or professional requirements that apply to its records, services, and disclosures.