Health record rights in North Carolina: what state law adds
In North Carolina, as of October 3, 2026, we found no law on health data held outside HIPAA; copy rights go no further than HIPAA; you can opt out of the health information exchange; no specific rule for genetic records is in force, while reproductive health, mental health and HIV records each have one; you can sue only in a narrow case; breach notices need not cover medical or health insurance information; and we found no law on AI in care. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No consumer privacy or consumer health data law found in the General Statutes. S757 (Consumer Privacy Act) sits in Senate Rules since 3/26/2025. H462 sits in House committee. Neither is enacted.
How we searched (October 3, 2026): the official code search for consumer health data, health data, sensitive data, data broker, medical records. Agency pages checked: ncdoj.gov, ncleg.gov.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
No. A law is in force, but it adds nothing to HIPAA's terms.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
G.S. 90-411 sets a per-page fee cap and a $10 minimum fee. No state deadline and no free-copy case found. A per-page cap is recorded as a fact only. Last amended by S.L. 2019-191, s. 42, effective October 1, 2019.
Fee rule: G.S. 90-411: 75 cents per page for pages 1 to 25, 50 cents for pages 26 to 100, 25 cents per page above 100.
Fee rule: G.S. 90-411: "the health care provider may impose a minimum fee of up to ten dollars ($10.00), inclusive of copying costs".
Fee rule: G.S. 90-411: workers' compensation record charges follow Industrial Commission fees under G.S. 97-26.1.
Fee rule: G.S. 90-411 does not apply to DHHS Disability Determination Services requests for Social Security or SSI disability applicants. It does not say these copies are free.
Goes beyond the federal floor: no.
Record copy fee. N.C. Gen. Stat. 90-411
In force · effective · read October 3, 2026 · source(ncleg.gov)
The maximum fee for each request shall be seventy-five cents (75¢) per page for the first 25 pages, fifty cents (50¢) per page for pages 26 through 100, and twenty-five cents (25¢) for each page in excess of 100 pages
Who it binds, in our words: A health care provider copying "medical records to the patient or the patient's designated representative"
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Statewide HIE Act gives a continuing opt-out. Medicaid and State-funded providers must connect (G.S. 90-414.4). The NC HIEA page publishes opt-out forms. Substance use facility data is excluded unless the patient authorizes it (G.S. 90-414.11(a)(2); NC HIEA patients page).
Set by state law.
Designated exchange: NC HealthConnex, run by the NC Health Information Exchange Authority (G.S. 90-414.7).
Some sensitive records need your consent even where routine records do not.
Continuing right to opt out; effect of opt out. N.C. Gen. Stat. 90-414.10
In force · effective · read October 3, 2026 · source(ncleg.gov)
Each individual has the right on a continuing basis to opt out or rescind a decision to opt out.
Who it binds, in our words: Data submitted through the statewide HIE Network under Article 29B of Chapter 90
N.C. Gen. Stat. 90-414.11(a)(2)
In force · effective · read October 3, 2026 · source(ncleg.gov)
Authorize the disclosure of protected health information through the HIE Network to the extent that the disclosure is restricted by federal laws or regulations, including the federal drug and alcohol confidentiality regulations set forth in 42 C.F.R. Part 2.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The rule covers abortion reports to DHHS. It bars identifiers in reports and bars matching the data to identify a woman absent a court order. Last amended by S.L. 2025-25, effective June 26, 2025.
Abortion reporting requirements, identifying information. N.C. Gen. Stat. 90-21.93(g)
In force · effective · read October 3, 2026 · source(ncleg.gov)
A report completed under this section shall not contain the woman's name, any common identifiers of the woman, or any other information that would make it possible to identify the woman subject to a report under this section
Who it binds, in our words: Abortion reports sent to the Department of Health and Human Services, and State agencies and contractors holding that data
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure is limited to the cases in G.S. 122C-53 to 122C-56. Unauthorized disclosure is a Class 3 misdemeanor, fine up to $500. Last amended by S.L. 2011-314, effective January 1, 2012.
Right to confidentiality. N.C. Gen. Stat. 122C-52(c)
In force · effective · read October 3, 2026 · source(ncleg.gov)
Except as provided by G.S. 122C-53 through G.S. 122C-56, each client has the right that no confidential information acquired be disclosed by the facility.
Who it binds, in our words: Facilities and individuals with access to confidential information about clients under Chapter 122C (mental health, developmental disabilities, substance use services)
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
G.S. 130A-143 covers all reportable conditions. The rule lists HIV and AIDS as reportable. Release is allowed only in listed cases, including written consent and court order with in camera review on request.
Confidentiality of records (reportable diseases). N.C. Gen. Stat. 130A-143
In force · effective · read October 3, 2026 · source(ncleg.gov)
All information and records, whether publicly or privately maintained, that identify a person who has or may have a disease or condition required to be reported pursuant to the provisions of this Article shall be strictly confidential.
Who it binds, in our words: Any holder, public or private, of records identifying a person with a reportable disease or condition
Reportable diseases and conditions. 10A NCAC 41A .0101(b)
In force · effective · read October 3, 2026 · source(reports.oah.state.nc.us)
For purposes of reporting, "confirmed human immunodeficiency virus (HIV) infection" is defined as a positive virus culture, repeatedly reactive EIA antibody test confirmed by western blot
Who it binds, in our words: Lists HIV infection and AIDS as reportable conditions, which brings them within G.S. 130A-143
Second check by a separate agent: confirmed.
Genetic records
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
G.S. 58-3-215 and 95-28.1A bar insurer and employer use of genetic information. Neither sets a confidentiality or disclosure rule for genetic records. No other genetic record provision found.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
An injured person may sue for a breach notice violation through G.S. 75-1.1 and 75-16. No private right found for unlawful use or disclosure of medical records generally.
Damages a court may award: No fixed statutory amount. Treble the actual damages fixed by the verdict under G.S. 75-16.
Protection from security breaches, enforcement. N.C. Gen. Stat. 75-65(i)
In force · effective · read October 3, 2026 · source(ncleg.gov)
A violation of this section is a violation of G.S. 75-1.1. No private right of action may be brought by an individual for a violation of this section unless such individual is injured as a result of the violation.
Who it binds, in our words: Businesses that own, license or maintain personal information of North Carolina residents
Civil action by person injured; treble damages. N.C. Gen. Stat. 75-16
In force · effective · read October 3, 2026 · source(ncleg.gov)
such person, firm or corporation so injured shall have a right of action on account of such injury done, and if damages are assessed in such case judgment shall be rendered in favor of the plaintiff and against the defendant for treble the amount fixed by the verdict.
Who it binds, in our words: Any person injured by a violation of Chapter 75
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The 14 items in G.S. 14-113.20(b) include biometric data but neither medical nor health insurance information. Every notice also goes to the AG Consumer Protection Division under 75-65(e1). Deemed-compliance clause covers financial institutions only.
Deadline to tell people: without unreasonable delay.
The attorney general or a regulator must also be told.
Definitions, personal information. N.C. Gen. Stat. 75-61(10)
In force · effective · read October 3, 2026 · source(ncleg.gov)
"Personal information". - A person's first name or first initial and last name in combination with identifying information as defined in G.S. 14-113.20(b).
Who it binds, in our words: Identity Theft Protection Act, Article 2A of Chapter 75
Identity theft, identifying information. N.C. Gen. Stat. 14-113.20(b)
In force · effective · read October 3, 2026 · source(ncleg.gov)
Any other numbers or information that can be used to access a person's financial resources.
Who it binds, in our words: The 14-item list of identifying information used by G.S. 75-61(10)
Protection from security breaches. N.C. Gen. Stat. 75-65(a), (e1)
In force · effective · read October 3, 2026 · source(ncleg.gov)
The disclosure notification shall be made without unreasonable delay, consistent with the legitimate needs of law enforcement
Who it binds, in our words: Any business that owns or licenses personal information of residents of North Carolina
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Code AI hits are criminal provisions only. Health AI bills S287, S624 and H565 sit in Senate Rules. H1161 sits in House Appropriations. DOI Bulletin 24-B-19 is guidance, not statute or rule.
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
10.2%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
93.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
87.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
9.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$66,186 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
3.8%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
5.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
12.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
11.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
