How to Comply with HIPAA Laws

in North Carolina

HIPAA Laws in North Carolina

If you’re a healthcare provider treating patients in North Carolina, you are likely wondering, what are HIPAA laws in North Carolina? While some states have their own privacy laws, some of which impose stricter requirements than HIPAA, North Carolina is not one of those states. Find out more about HIPAA laws in North Carolina here.

HIPAA Laws in North Carolina

To meet the requirements of the HIPAA regulations, healthcare organizations (healthcare providers, healthcare vendors, and MSPs) must implement a HIPAA compliance program. Most federal HIPAA requirements apply at the state level in North Carolina as well.

Security Risk Assessments, Gap Identification, and Remediation

To be HIPAA compliant, it is crucial to identify where your deficiencies lie. To do so, healthcare organizations must conduct six self-audits annually. These self-audits uncover weaknesses and vulnerabilities in your security practices. To ensure that your organization meets HIPAA safeguard requirements, you must create remediation plans. Remediation plans list your identified deficiencies and how you plan to address them, including actions and a timeline.

HIPAA Policies and Procedures

To ensure that you meet HIPAA Privacy, Security, and Breach Notification requirements, you must implement written policies and procedures. These policies and procedures must be customized for your practice’s specific needs, applying directly to how your business operates. To account for any changes in your business practices, you must review your policies and procedures annually and make amendments where appropriate.

North Carolina HIPAA Training

HIPAA imposes employee training requirements that are the same regardless of the state the healthcare organization operates in. North Carolina HIPAA training must be provided to each employee that has the potential to access PHI. HIPAA training must be provided annually, in which employees must legally attest that they understand and agree to adhere to the training material. 

Business Associate Agreements

Business associate agreements must be signed with each of your business associate vendors. HIPAA defines a business associate as any entity that performs a service for your practice that gives them the potential to access PHI. Common examples of business associates include electronic health records platforms, email service providers, online appointment scheduling software, and cloud storage providers. 

You cannot use any vendor and be HIPAA compliant. They need to be willing and able to sign a business associate agreement (BAA). A BAA is a legal contract that requires each signing party to be HIPAA compliant and be responsible for maintaining their compliance. When a vendor doesn’t sign a BAA, it cannot be used for business associate services.

Incident Management

To comply with the HIPAA Breach Notification Rule, you must have a system to detect, respond to, and report breaches. Employees must also have the means to report incidents anonymously and be aware of what to do if they suspect a breach has occurred.

Make Sure You Comply with State Law

Do you need to comply with HIPAA laws in North Carolina? We can help!

Become HIPAA Compliant

North Carolina HIPAA Authorization Form

A North Carolina HIPAA authorization form is required under certain circumstances. HIPAA regulations outline the uses and disclosures of PHI that require authorization to be obtained from a patient/plan member before that person’s PHI can be shared or used. 

A North Carolina HIPAA authorization form is required before:

  • The covered entity can use or disclose PHI whose use or disclosure is otherwise not permitted by the HIPAA Privacy Rule
  • The covered entity can use or disclose PHI for marketing purposes. If the marketing communication involves direct or indirect remuneration to the covered entity from a third party, the authorization must state that such remuneration is involved.

The law requires that a North Carolina HIPAA form contains specific “core elements” to be valid. 

These elements include:

  • A description of the specific information to be used or disclosed.
  • The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.
  • The name or other specific identification of any third parties (persons or classes of persons) to whom the covered entity may make the requested use or disclosure.
  • A description of each purpose of the requested use or disclosure. 
  • An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. 
  • The signature of the individual, and the date.