Delaware Healthcare Compliance Requirements

Delaware medical practices operate under 6 Del. C. §12B-101 et seq., which requires breach notification within 60 days after determination of the breach. The Delaware Attorney General must be notified whenever 500 or more Delaware residents are affected, and the Consumer Protection Unit of the AGO is the primary enforcer with civil penalties up to $10,000 per violation. Medical records carry a 7-year retention floor from last contact under 24 Del. Admin. Code §4304. The Delaware PMP (administered through the PMP AWARxE platform) requires every prescriber to query before every controlled-substance prescription, with carve-outs for hospice, cancer, post-surgical 14-day supplies, and inpatient administration. Child-abuse reporting routes through the Division of Family Services Report Line or local law enforcement under 16 Del. C. §902, with serious penalties: a Class A misdemeanor for a first offense and a Class E felony for subsequent offenses — among the most punitive failure-to-report regimes in the Northeast.

Delaware's enforcement posture is moderate. The Attorney General's Consumer Protection Unit has clear authority under 6 Del. C. §12B-101 and has historically followed up on breach notifications, particularly those above the 500-resident AG-notification threshold. The 60-day notification deadline is a hard procedural cap, and the $10,000 per-violation penalty range gives the office meaningful leverage even in smaller cases. Delaware's Division of Professional Regulation provides parallel enforcement on the 7-year retention rule through licensure surveys. Practices that meet the 60-day clock, document a harm analysis, and notify the AG above the 500-resident threshold are well-positioned. The escalating child-abuse-reporting penalty structure (misdemeanor → felony for repeat offenders) makes documented training and clear reporting protocols essential.

Guides & Articles