North Carolina Healthcare Compliance Requirements
State-specific breach notification rules, medical records retention periods, PDMP requirements, and mandatory reporting obligations for medical practices operating in North Carolina.
Breach Notification Rules
Notification deadline
Most expedient time possible
Notification must be made without unreasonable delay. AG must be notified if 1,000+ North Carolina residents affected.
AG notification threshold
1000+ affected individuals
Notify: AG + Consumer Protection Division
Harm analysis required
Penalty range
Up to $5,000 per violation under Unfair and Deceptive Trade Practices Act
Medical Records Retention
| Record type | Retention period | Measured from |
|---|---|---|
| General medical | 11 years | Last treatment |
| Pediatric | 11 years | Patient turns 18 |
PDMP Requirements — NC Controlled Substances Reporting System
Check required
All controlled substances
Check frequency
Every prescription
Delegation allowed
Penalty range
Licensing board discipline; civil penalties; possible misdemeanor charges
Exemptions
Hospice patients, cancer treatment, ≤5 day supply in ER, inpatient hospital or long-term care administration
Mandatory Reporting Obligations
Mandated reporters
Any person or institution who has cause to suspect child abuse (universal mandatory reporting)
Report to
County Department of Social Services
Timeline
Immediately / as soon as possible
Penalty for failure
Class 1 misdemeanor
Immunity provision
Good faith reporters immune from civil and criminal liability under N.C.G.S. 7B-309
Mandated reporters
Any person who has reasonable cause to believe a disabled adult has been abused
Report to
County Department of Social Services, Adult Protective Services
Timeline
Immediately / as soon as possible
Penalty for failure
Class 1 misdemeanor
Immunity provision
Good faith reporters immune from civil and criminal liability
Mandated reporters
Healthcare providers treating injuries from suspected domestic violence or criminal acts
Report to
Local law enforcement
Timeline
Immediately / as soon as possible
Immunity provision
Good faith reporters immune from civil liability
Mandated reporters
Physicians, laboratories, and healthcare facility administrators
Report to
North Carolina Division of Public Health, local health department
Timeline
Within 24 hours
Penalty for failure
Class 2 misdemeanor
Immunity provision
Good faith reporters immune from civil liability
Mandated reporters
All healthcare providers treating gunshot wounds or stab wounds
Report to
Local law enforcement
Timeline
Immediately / as soon as possible
Penalty for failure
Class 3 misdemeanor
Immunity provision
Good faith reporters immune from civil and criminal liability
Stay compliant in North Carolina
GuardWell tracks North Carolina-specific breach deadlines, PDMP requirements, retention periods, and mandatory reporting obligations automatically.