Dental Cybersecurity in North Carolina: 10-Year Records, Retiring Old Computers and Breach Notice

This month, a Durham office manager is replacing four front-desk PCs and the server in the back closet. The cyber-insurance renewal on her desk asks one new question: does the practice have a written data-disposal policy?

That is the whole map, and the rest of this page fills it in. Each rule is given by its title, one plain sentence and a link to the official text, followed by the job it creates for whoever runs your computers. Every legal paragraph here is a summary of the rule text, not legal advice. Your counsel decides what applies to your practice, and the official text is the version that counts.

This page is written for the person who keeps the records, books the shredding company, signs for new computers and would take the first phone call if something went wrong. It doesn't sell a product. What it gives you is three tables you can fill in this week, eight pieces of evidence worth having on file, and a list of questions for whoever supports your network, whether that is Legend Networking or another provider.

What does North Carolina add to HIPAA for a dental office?

Three texts sit beside the federal rules. The dental board's record rule fixes how long a chart stays on file. The Identity Theft Protection Act has a section on disposing of personal information and a section on notice after a security breach. Each one turns into a specific IT task and a specific record to file.

HIPAA's rules sit underneath all of this. Its Security Rule asks for administrative, physical and technical safeguards around electronic patient information. North Carolina doesn't replace that. What the state texts add is a time horizon (a decade of records), an end point (what happens to the device when it leaves) and a named state office to tell after a breach. For the federal side, Legend's page on HIPAA safeguards for dental practices is the starting point. For the controls themselves, see Legend's dental cybersecurity services.

Read the table below across, one row per stage of a record's life.

Table 1. North Carolina's rules across a record's life

This is a summary of the rule texts, not legal advice; your counsel decides what applies.

How long must a North Carolina dentist keep records, and what does that mean for IT?

The dental board's rule is direct: "A dentist shall maintain treatment records on all patients for a period of 10 years from the last treatment date, except that work orders must only be maintained for a period of two years." For IT, that means a practice's imaging archive and database must still open a decade after a patient's last visit.

It sits in subchapter 16T, Patient Records, under the heading Record Content, and was readopted effective January 1, 2019. It lists twelve things a treatment record includes. Four of them matter most to whoever runs the computers:

• • "the diagnostic radiographs, orthodontic study models, and other diagnostic aids, if taken" (item 9)
• • "the patient's financial records and copies of all insurance claim forms" (item 10)
• • the treatment plans for patients of record (item 8)
• • a written record of the patient's informed consent (item 12)

Read the rule text at the Office of Administrative Hearings yourself; it fits on one page.

Here is what ten years looks like in an office. The clock runs from the last treatment date, so a patient who stops coming in 2026 has records that still matter in 2036. In that time a practice may replace its workstations more than once. It may move from a server in the closet to a cloud-hosted practice-management system. It may switch imaging software, or add a CBCT unit whose studies are far larger than intraoral images. Each change is a moment where old records can quietly become unreadable.

Three IT consequences follow.

The imaging archive grows for a decade. Radiographs sit in the imaging system (DEXIS, Carestream, Planmeca Romexis, Vatech or Dolphin Imaging in many offices), not only in the chart. Pruning old studies to free disk space runs straight into item 9. Storage planning should assume the archive only grows, and backups need to cover it in full, not just the current year.

Backups have to restore old studies, not just yesterday's. A backup that reports "success" every night proves the copy ran. It doesn't prove that a 2019 panoramic image opens in today's viewer. The test that matters is to pick a patient last seen years ago, restore their chart and images to a separate machine, and open them. Write down the date, the patient's chart number (not their name) and the result. Legend's dental backup and disaster recovery services page covers the backup side of that test.

Exports have to survive a software change. When a practice changes from one practice-management system to another (Dentrix, Eaglesoft, Open Dental and Archy all have their own data formats), the conversion may not carry everything; check claim forms, scanned consent documents and attachments in particular. Before any migration, agree in writing where the old system's full data will live, in what format, and how someone would open it in year eight. Legend's dental software migration backup checklist walks through that preparation.

Work orders are the exception at two years. Whether a particular document counts as a treatment record or a work order is a question for the dentist and counsel, not for IT.

This is a summary of the rule text, not legal advice; ask counsel how it applies to your records.

What protections should be in place while the records are kept?

Ten years of records need ten years of protection, and the useful test is what the practice can show, not what it says. An insurer, an auditor or your own counsel will ask for evidence: a report, a log, a dated test. These eight items cover most of what gets asked, without turning into a full checklist.

Think of each item as a piece of paper (or a file) you could hand over on request.

1. 1. A sign-in protection report. Multi-factor authentication on email (for many offices that means Microsoft 365) and on every route into the network from outside, such as remote desktop, the VPN and the practice-management cloud portal. The report lists which accounts have it and which don't.
2. 1. A patch status report for workstations and servers. Which machines are current, which are behind, and why. Imaging acquisition PCs are often held back for driver reasons; if so, note the reason and the compensating step.
3. 1. A restore test result. Dated, with what was restored and whether it opened. Tie at least one test each year to an old record, so it doubles as evidence for the 10-year rule above.
4. 1. An offboarding record for each person who left. The date their accounts were disabled, across the practice-management system, imaging, email, the phone system and any payer portals.
5. 1. A vendor access log. Which outside companies (imaging, practice-management, phones) can connect, how they connect, and a record of each session.
6. 1. Log retention. Where sign-in and security logs are kept, and for how long. If something goes wrong, these are what show what happened.
7. 1. A device inventory. Every computer, server, NAS, copier and phone that can hold patient data, with its location. You can't retire a device you didn't know you had.
8. 1. The written disposal policy that the next section covers.

One more intake point belongs here. North Carolina's Social Security number section, N.C.G.S. § 75-62, includes a line about not requiring a person to send their number over the internet unless the connection is secure or the number is encrypted (official text). If your online forms or patient portal ask for it, ask your billing team whether you still need it, and ask your IT provider how the form is protected.

For the full control lists, Legend has a HIPAA compliance checklist for dental practices and a 25-point dental cybersecurity risk assessment. The point of this section is narrower. Each item above should exist as something you can print, and someone should own keeping it current.

What does North Carolina's text say when you retire a computer, server or drive?

N.C.G.S. § 75-64 deals with the end of a record's life: reasonable measures so a North Carolina resident's personal information can't be reached or misused when it is discarded. It names shredding-type methods for paper, destruction or erasure for electronic media, a written policy and a contract with any destruction company. It also lists exceptions.

Here is the section, one subsection at a time, in plain sentences. Read the official text of § 75-64 alongside it.

• • (a) Who: businesses operating in the state, and businesses holding any North Carolina resident's personal information. What: reasonable steps against unauthorized access or use, both in connection with disposal and afterwards.
• • (b)(1) For paper, the reasonable measures include policies, with monitoring, for burning, pulverizing or shredding.
• • (b)(2) For electronic and other non-paper media, they include policies, with monitoring, for destroying or erasing the media so the information can't practicably be read or reconstructed.
• • (b)(3) The procedures are described in writing as the business's official policy.
• • (c) A business may, after due diligence, use a company in the record-destruction business under a written contract, and monitor that company's compliance with the contract.
• • (e) The section lists organisations it doesn't apply to. One entry names health insurers and health care facilities that are subject to, and follow, the HIPAA privacy and security standards. Whether a dental practice falls inside that entry is a question for counsel.

Separately, the HIPAA Security Rule's device and media controls standard (45 CFR 164.310(d)) lists disposal and media re-use as required implementation specifications. So a written procedure for retiring devices does a job whichever text your counsel says governs.

The federal technical guideline for the "how" is NIST Special Publication 800-88 Revision 2, Guidelines for Media Sanitization, published in September 2025. It replaced the 2014 Revision 1. It's a guideline, not a legal requirement, but it gives you and your IT provider a shared vocabulary for clearing, purging and destroying media and recording that it was done.

A common gap is that paper and electronics are handled by different habits. The shredding bin gets picked up every month. The old PCs go into a storeroom, then to an e-waste event, with their drives still inside. A front-desk PC holds cached patient data, scanned insurance cards and saved passwords. A copier with a hard drive may hold every page it ever scanned. None of that is visible from the outside.

Table 2. Retiring a device in a North Carolina dental office

Two lines in Table 2 deserve emphasis. First, before a server or imaging PC is wiped, someone confirms that every record still inside the 10-year window lives somewhere else and opens. The disposal statute and the record rule pull in opposite directions at that moment; the archive check resolves it. Second, a destruction or e-waste company is only as good as the paperwork. Under (c), the arrangement is a written contract after due diligence, and the company's compliance is monitored. A certificate per batch, listing serial numbers, is one way to show that monitoring happened.

The policy itself, the (b)(3) item, can be short: what counts as a device that holds personal information, the method for each kind, who approves disposal, which vendors are used, and where the records go. A renewal question about data disposal is asking for exactly that document. If you work with IT support for Triangle dental practices, ask your provider to draft it with you from Table 2.

This is a summary of § 75-64, not legal advice; your counsel decides whether and how it applies.

What happens after a breach in North Carolina, and who is told?

Under N.C.G.S. § 75-65, a business that has a security breach gives notice to the affected people and, when it does, also notifies the Attorney General's Consumer Protection Division. A law-enforcement request can delay notice. When more than 1,000 people are notified at one time, the nationwide consumer reporting agencies are told as well.

Here are the subsections in plain sentences. Read the official text of § 75-65 with them.

• • (a) A business that owns or licenses personal information of North Carolina residents gives notice of a security breach to the affected person.
• • (c) Notice is delayed if a law enforcement agency tells the business that notice may impede a criminal investigation or jeopardize national or homeland security; the request is in writing or documented in writing at the time, and notice follows without unreasonable delay once the agency says it no longer stands in the way.
• • (e1) When a business notifies affected people under the section, it also notifies the Consumer Protection Division of the Attorney General's Office without unreasonable delay.
• • (f) When a business notifies more than 1,000 people at one time, it also notifies the Consumer Protection Division and the nationwide consumer reporting agencies.

On its Security Breach Information page, the Department of Justice puts the point plainly: a breach report also goes to its Consumer Protection Division. The report itself goes through the Department's online Report a Security Breach form. The page notes, "You do not have to complete the form in one session." The Department's main campus is at 114 West Edenton Street in Raleigh. Bookmark both pages now, on a machine that isn't the one you'd be worried about.

The NCDOJ page adds a point that matters to dental offices that use outside companies. A business that keeps personal information of North Carolina residents on behalf of another company notifies the owner "immediately following the discovery of the breach". Ask each vendor that holds your data how that notice would reach you, and to whom.

A dental practice may also have duties under the federal HIPAA Breach Notification Rule. The two sets of rules sit side by side; neither is a substitute for the other. Counsel decides what applies and in what order. For the practice-side controls and incident help, start with Legend's cybersecurity service page.

What you'll notice is missing here: a number of days. North Carolina's text, as summarised by the Department of Justice, speaks of notice "without unreasonable delay". This page doesn't turn that into a count, and you shouldn't let anyone else do it for you without counsel. What IT can do is make sure the facts are ready quickly, which is the next section.

This is a summary of § 75-65 and the NCDOJ pages, not legal advice; counsel decides who is told and when.

What does the notice have to say, and where does IT find it?

North Carolina's notice to affected people has set contents: a description of the incident, the type of information involved, what the business did to protect it, a phone number, advice to stay vigilant, and contact details for the consumer reporting agencies, the FTC and the Attorney General's Office. Most items depend on facts your IT records hold.

The NCDOJ's page says the notice "must be clear and conspicuous and given without unreasonable delay", and lists its contents. § 75-65(d) has the statutory list. Counsel writes the notice. Table 3 shows where each fact comes from, so it can be found in hours rather than reconstructed over weeks.

Table 3. What the notice must say, and where IT finds it

Two practical points come out of that table. First, four of the six rows rest on records that exist only if someone kept them before the incident: the alert history, the data map, the log retention and the containment notes. That's why the evidence list in the protections section matters more than any single tool. Second, the data map is the row offices are least ready for. A practice may know its practice-management system holds patient records. It may not know that the copier scans to a shared folder, that payroll exports sit on the office manager's desktop, or that the old imaging PC still holds a local cache.

If the incident involves ransomware, recovery and the notice work run in parallel. Legend's dental ransomware recovery playbook covers the recovery side. This page stays with the facts the notice needs.

This is a summary of the NCDOJ page and § 75-65, not legal advice; counsel drafts and approves the notice.

What phishing and access risks show up in a Triangle office?

The risks to train for in a Raleigh, Durham or Cary office are the ordinary ones in local dress: messages posing as the power company after a storm, requests for remote access that claim to come from a software vendor, and emails asking to change a bank account. Treat each as a rehearsal scenario, not a forecast.

Use these as three short drills with the front desk and the business office.

The storm follow-up. After a big Triangle storm, the office gets a text or email that looks like it comes from the electric utility, offering a credit or warning of a disconnection unless a payment is made through a link. The drill: nobody pays or signs in through a link in a message. They call the number on a past bill.

The vendor who wants in. Someone calls or emails saying they're from the imaging or practice-management vendor and need remote access to "push an update" today. The drill: no remote session starts unless it was scheduled through the IT provider or the vendor's known support number, and the session is logged. That ties back to the vendor access log above.

The bank change. An email that looks like it comes from a staff member, a lab or a supplier asks to update direct-deposit or payment details before the next run. The drill: any change to where money goes is confirmed by phone, using a number already on file, before anyone touches it.

Run the drills at a staff meeting, note who attended, and keep the note. It belongs with the evidence list, and a renewal form may ask whether staff are trained. For a wider look at the attack routes, Legend's guide to dental ransomware and phishing goes further.

What does cyber insurance ask a North Carolina practice to prove?

A renewal form may ask for evidence rather than yes-or-no answers, for example multi-factor authentication on email and remote access, tested backups kept separate from the network, a patching process, staff training and written policies. A written disposal policy and a device inventory are the North Carolina-flavoured additions that this page has already built.

Carriers and their forms differ, so read your own renewal question by question. Where a question asks for a policy, attach the document. Where it asks about a control, attach the report from the evidence list. If an answer depends on your IT provider, get their answer in writing before you sign, because the signature is the practice's. Legend's page on dental cyber insurance requirements sets out the controls these forms commonly ask about.

What to ask your IT provider about North Carolina data rules

Ask these in writing and keep the answers. The first five tie directly to the North Carolina texts above.

Where the rule texts live

Every rule on this page links to its official home. The dental board's rule comes from the North Carolina Office of Administrative Hearings, and the statute sections from the North Carolina General Assembly. The breach-reporting pages come from the North Carolina Department of Justice, the media-sanitization guideline from NIST, and the HIPAA device and media standard from the federal eCFR. When a statute is amended, the official site is updated first, so check it before relying on any summary, including this one.