HIPAA Compliance Services in North Carolina
North Carolina's independent practices live in the shadow of very large health systems: Atrium Health and Advocate Health in Charlotte, Duke Health and UNC Health in the Triangle, Atrium Health Wake Forest Baptist in Winston-Salem, ECU Health in Greenville. The hospitals have compliance departments. The orthopedic group in Cary, the dental practice in Gastonia and the behavioral health clinic in Asheville have an office manager, an EHR vendor and a HIPAA binder nobody has opened. NetSys runs the Security Rule's technical side for those practices, remotely from Brooklyn.
The short answer
NetSys provides HIPAA compliance services to North Carolina practices remotely: a documented Security Rule risk analysis, technical safeguards configured in Microsoft 365, Intune and Entra ID, business associate agreements tracked, and evidence collected all year, run month to month with your compliance officer in Eastern time. The practice keeps its privacy decisions; NetSys certifies no one.
Service information by The NetSys Group. Our editorial standards.
City and area pages in North Carolina
These places in North Carolina have pages of their own. If your office is in one of them, its page covers that place in more detail than this statewide page.
- Charlotte, NC: managed IT services in Charlotte · IT support in Charlotte · IT consulting in Charlotte · cybersecurity services in Charlotte
- Raleigh, NC: managed IT services in Raleigh · IT support in Raleigh · IT consulting in Raleigh · cybersecurity services in Raleigh
- Cary, NC: managed IT services in Cary · IT support in Cary
- Durham, NC: managed IT services in Durham · IT support in Durham
- Greensboro, NC: managed IT services in Greensboro · IT support in Greensboro
- Winston-Salem, NC: managed IT services in Winston-Salem · IT support in Winston-Salem
- Asheville, NC: managed IT services in Asheville
- High Point, NC: managed IT services in High Point
- Wilmington, NC: managed IT services in Wilmington, North Carolina
How HIPAA compliance work is delivered across North Carolina
The Security Rule is enforced through configuration, and configuration is remote work. From Brooklyn we administer the practice's Microsoft 365 tenant, Entra ID and Conditional Access, Intune device management and encryption, email encryption and data loss prevention, audit logging, endpoint detection and backups, and we reach the EHR, imaging and billing systems through authorized access or the vendor. Meetings with the practice's security and privacy officers, the risk analysis interviews and the quarterly evidence reviews run on video, all in Eastern time, the same time zone as the practice. NetSys does not send engineers to North Carolina. The physical safeguards, locked server rooms, screen placement, visitor rules, device disposal, belong to the practice, and we supply the checklist and record the evidence the practice produces. New devices ship configured through Windows Autopilot and Intune, so a laptop for a new hire in Wilmington enrolls itself. For a practice with offices in Charlotte, Raleigh and Greenville, one risk analysis covers all three, and the same policies, controls and evidence apply at each site without anyone driving between them.
The state's healthcare hubs and the practices between them
North Carolina's care is organized around four hubs. Charlotte is home to Atrium Health and the headquarters of Advocate Health, which describes itself as the third-largest nonprofit health system in the United States. The Triangle has Duke Health's four hospitals, UNC Health and the research employers of Research Triangle Park. Winston-Salem has Atrium Health Wake Forest Baptist, an academic system with a 933-bed hospital and more than 300 care locations. Greenville has ECU Health, which serves 29 counties across the east of the state. Around and between them sit the practices HIPAA actually falls hardest on: independent primary care and specialty groups, orthopedics and physical therapy, dental and orthodontic offices, behavioral health and substance use clinics, dermatology, optometry, home health agencies and the billing companies and IT vendors that serve them as business associates. These practices exchange referrals, images and records with the hospital systems every day, which makes the interfaces, the shared portals and the fax-to-email workflows part of the risk analysis. NetSys works with healthcare organizations of this size nationally, and our managed IT and cybersecurity pages for North Carolina cover the day-to-day support the HIPAA program runs on.
North Carolina's Identity Theft Protection Act alongside HIPAA
HIPAA is federal, but a North Carolina practice also answers to the state's Identity Theft Protection Act, N.C. Gen. Stat. 75-60 through 75-66. Section 75-65 requires a business that owns or licenses personal information of North Carolina residents to notify affected persons of a security breach without unreasonable delay, with a clear and conspicuous notice describing the incident, the information involved, the steps taken, and contact information for the consumer reporting agencies, the Federal Trade Commission and the Attorney General; the business must also notify the Consumer Protection Division of the Attorney General's Office, and when more than 1,000 persons are notified at once, the consumer reporting agencies as well. Section 75-64 requires reasonable measures when disposing of records containing personal information, 75-62 restricts how Social Security numbers may be used and transmitted, and a violation of the article is an unfair trade practice under 75-1.1. These duties sit beside the HIPAA Breach Notification Rule's 60-day clock rather than replacing it, and which notices a given incident requires is for the practice's counsel. What NetSys supplies is the part counsel needs first: the logs, the device records and the access history that show what happened and to whose data (checked on November 7, 2026).
Where the HIPAA Security Rule update stands
The Security Rule a North Carolina practice complies with today is the one written in 2003 and amended in 2013, but it is under revision. On January 6, 2025, the Department of Health and Human Services published a proposed rule, HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information (90 FR 898), with comments closed March 7, 2025. As published, the proposal would require regulated entities to inventory their technology assets and map the movement of ePHI through their systems and would expressly require encryption of ePHI with limited exceptions, among other changes that would make safeguards mandatory which are addressable today. The Unified Agenda entry for the rule lists final action in July 2027, moved from the May 2026 target in the previous edition, so the proposal is not in force and its final shape is not settled. NetSys builds to the stricter reading anyway: an asset inventory, a data flow map, MFA on every account, encryption on every device and in transit, and tested restores are what a current risk analysis calls for regardless of when the final rule lands, and a practice that has them will not have to rebuild its program when it does (checked on November 7, 2026).
Contingency planning for a state that floods, freezes and loses power
The Security Rule's contingency plan standard, 45 CFR 164.308(a)(7), requires a data backup plan, a disaster recovery plan and an emergency mode operation plan, and North Carolina tests those plans more often than most states. Tropical Storm Helene's 2024 disaster declaration covered the western counties and cut power and connectivity for days; Hurricane Florence in 2018 flooded the east. A practice whose EHR is cloud-hosted still loses access when the office has no power and no internet, and a practice with an on-premises server loses everything if the server room floods. Our HIPAA work therefore treats recovery as a technical safeguard with evidence: Microsoft 365 and practice data backed up with an immutable copy, restores tested and the results written down, a recovery order and time for the systems the practice cannot see patients without, and a written plan for operating in emergency mode, including which staff may access what from home and on which devices. The plan is reviewed in the quarterly evidence cycle, and the risk analysis names the regional hazards for each office so an Asheville location and a Wilmington location are not planned identically.
HIPAA Compliance in North Carolina: what NetSys delivers
Risk analysis and documentation
- Inventory of the systems, devices and vendors that create, receive, store or transmit ePHI
- Technical risk analysis with likelihood, impact and a remediation plan with dates on it
- Security Rule policy templates, tailored with your compliance officer
- Business associate agreements tracked, including Microsoft's agreement covering your tenant
Security Rule technical safeguards
- Unique accounts, MFA and conditional access in Entra ID, with automatic logoff on shared workstations
- Full-disk encryption on every laptop and desktop through Intune, recovery keys escrowed
- Email encryption and data loss prevention rules that protect patient identifiers automatically
- Audit logging retained and reviewed, with alerts on unusual access to patient data
Monitoring and incident readiness
- Endpoint detection and response on every device, watched around the clock
- Practice data and Microsoft 365 backed up and test-restored, with a written recovery plan
- Incident response runbook built around the Breach Notification Rule's decision points and North Carolina's notice duties
- Security awareness training with phishing simulations that use healthcare lures
Evidence all year
- Quarterly access reviews, exported and signed off by the practice
- Configuration and log exports organized against the Security Rule standards
- Vendor and BAA register kept current as systems come and go
- Delivered remotely across North Carolina, with the physical safeguards checklist completed by the practice
An eight-provider orthopedic group with offices in Raleigh and Cary
This planning example shows how we could scope the work. It is not a claim about a customer in this market or a measured result. For published customer work, see our case studies.
Illustrative planning example, not a client. An orthopedic and sports medicine group with eight providers and 45 staff runs two offices in Raleigh and Cary, a cloud-hosted EHR, an on-site imaging workstation that stores studies locally, Microsoft 365 for email and files, and a billing company that works from its own systems. The last risk analysis is a vendor's checklist from 2021. Several surgeons read images and messages on personal phones, and nobody can say which vendors have signed business associate agreements.
- An inventory of every system, device and vendor touching ePHI at both offices, including the imaging workstation, the billing company's access and the personal phones with practice email
- A technical risk analysis written with the practice's security officer, with likelihood, impact and a dated remediation plan, following NIST SP 800-66 Rev. 2
- Safeguards configured remotely: MFA and Conditional Access in Entra ID, Intune enrollment and encryption for every device including the imaging workstation, app protection on personal phones, DLP rules for patient identifiers and audit logging retained
- A vendor and BAA register covering the EHR, imaging, billing and NetSys itself, with gaps flagged for the practice to close, and an incident runbook that covers HIPAA's 60-day clock and North Carolina's 75-65 notice
- Immutable backups of practice data and Microsoft 365 with a tested restore, a recovery plan for both offices, and a quarterly evidence cycle on video in Eastern time
The deliverables are the risk analysis and remediation register, the configured and documented safeguards, the vendor and BAA register, the recovery plan with its restore record and a quarterly evidence folder the practice owns. Whether the practice is compliant is its own determination with counsel; HHS recognizes no certification.
Multi-site medical practice: HIPAA on the line across seven locations
A seven-location medical practice with more than 200 staff had aging servers and HIPAA exposure across every site. NetSys replaced the infrastructure, connected the locations securely and put tested recovery in place, bringing the practice to a clean audit. The engagement was in the Lower Hudson Valley, New York; the structure, one risk analysis and one set of controls across several offices, is the one a multi-office North Carolina group needs.
HIPAA and North Carolina law, and where the Security Rule update stands
The HIPAA Security Rule (45 CFR Part 164, Subpart C) requires every covered entity and business associate to conduct a risk analysis and maintain administrative, physical and technical safeguards for ePHI, with documentation kept six years; HHS proposed a strengthened rule on January 6, 2025, and the Unified Agenda lists final action in July 2027. North Carolina's Identity Theft Protection Act (N.C. Gen. Stat. 75-60 to 75-66) adds breach notice to affected residents without unreasonable delay and to the Attorney General's Consumer Protection Division, record disposal duties and Social Security number restrictions, enforced as unfair trade practices. NetSys builds and evidences the technical controls; which rules apply and whether the practice is compliant are determinations for the practice and its counsel, and HHS recognizes no private certification. Checked on November 7, 2026.
Primary sources
- HHS: HIPAA Security Rule responsibilities and risk analysis
- Federal Register: HIPAA Security Rule proposed rule, January 6, 2025 (90 FR 898)
- Unified Agenda, RIN 0945-AA22: HIPAA Security Rule timetable
- N.C. Gen. Stat. Chapter 75, Article 2A: Identity Theft Protection Act
- N.C. Gen. Stat. 75-65: protection from security breaches
What HIPAA compliance services cost in North Carolina
NetSys publishes no price list for HIPAA work; a quote follows the practice, not a package. It is built from the size of the practice (users, workstations, locations and the devices that touch patient data), the systems that hold ePHI, whether a current risk analysis exists, the remediation the analysis finds, the ongoing evidence work and the number of vendors needing agreements. For NetSys managed IT clients much of the technical work, such as MFA, encryption, endpoint protection and backups, already runs inside the month-to-month agreement; the risk analysis and any remediation projects are scoped separately. Delivery is remote, so there is no travel in the price.
Who this fits, and who it does not
Best fit: an independent North Carolina practice or healthcare business associate with 5 to 150 staff and one to several offices, on or moving to Microsoft 365, with a compliance officer who wants the technical side of the Security Rule run and evidenced rather than a binder.
Not a fit: a practice that wants a certificate, or one whose IT must be handled by an engineer in the office; NetSys certifies no one and works remotely in North Carolina.
Read next
Industry pages: IT for Healthcare · IT for Medical Practices · IT for Dental Practices
Terms used on this page: HIPAA Security Rule · Electronic Protected Health Information (ePHI) · Multi-Factor Authentication (MFA)
Guides: configuring Microsoft 365 for HIPAA · the business associate agreement with your IT provider
Related pages
Read the full HIPAA Compliance Services service page. See all locations and service areas.
Also in North Carolina: managed IT services in North Carolina · cybersecurity services in North Carolina
Nearby states:
- South Carolina: managed IT services in South Carolina
- Virginia: managed IT services in Virginia · IT support in Virginia · IT consulting in Virginia · cybersecurity services in Virginia
- West Virginia: managed IT services in West Virginia
- Maryland: IT support for Maryland businesses · managed IT services in Maryland · IT consulting in Maryland · cybersecurity services in Maryland
- Georgia: managed IT services in Georgia · cybersecurity services in Georgia
Related services: Managed IT Services · Security Awareness & Phishing Training · Microsoft 365 Security Hardening · HIPAA Compliance Audit · Healthcare IT Consulting
HIPAA Compliance in North Carolina: FAQs
Do you work with North Carolina practices on site?
No. NetSys works from one office in Brooklyn and delivers HIPAA compliance services in North Carolina remotely: the risk analysis interviews, the safeguard configuration in Microsoft 365, Intune and Entra ID, the vendor register and the quarterly evidence reviews all run on video and through authorized remote access, in Eastern time. Physical safeguards belong to the practice, with our checklist. If you need an engineer in the office each week, a North Carolina provider is the better fit, and we will say so.
How much do HIPAA compliance services cost for a North Carolina practice?
NetSys publishes no price list for HIPAA work. The quote follows the practice: how many people, devices and locations touch patient data, which systems hold ePHI, whether a current risk analysis exists, what remediation it finds and how much ongoing evidence work you want. For NetSys managed IT clients most of the technical safeguards already run inside the month-to-month agreement, and the risk analysis and remediation are scoped separately. A quote follows an agreed scope.
What does North Carolina law add to HIPAA for a practice?
The Identity Theft Protection Act, N.C. Gen. Stat. 75-60 to 75-66. Section 75-65 requires notice of a security breach to affected North Carolina residents without unreasonable delay and to the Attorney General's Consumer Protection Division, with notice to the consumer reporting agencies when more than 1,000 persons are notified; 75-64 governs disposal of records and 75-62 restricts Social Security number use, and violations are unfair trade practices under 75-1.1. Those duties sit beside HIPAA's Breach Notification Rule; counsel decides which notices an incident requires. Checked on November 7, 2026.
Has the HIPAA Security Rule changed, and what should we do about it?
Not yet. HHS published a proposed rule on January 6, 2025 (90 FR 898) that would, among other things, require a technology asset inventory and a map of how ePHI moves and expressly require encryption, and the Unified Agenda now lists final action in July 2027. The current rule still governs. We build to the stricter reading anyway, because an inventory, MFA, encryption and tested restores are what a sound risk analysis already calls for. Checked on November 7, 2026.
Can NetSys certify our North Carolina practice as HIPAA compliant?
No, and neither can anyone else in a way HHS recognizes; HHS endorses no HIPAA certification. What carries weight with an investigator is a current risk analysis, documented safeguards, training records, business associate agreements and evidence that controls are reviewed. NetSys produces that evidence and keeps it current; the compliance determination stays with your practice and its counsel.
Is NetSys a business associate, and will you sign an agreement?
Yes. An IT provider that manages systems holding ePHI creates, receives, maintains or transmits protected health information for the practice, which makes it a business associate under 45 CFR 160.103. NetSys signs a business associate agreement with the practice before work on those systems begins, and we keep the register of your other vendors' agreements current, flagging any vendor without one. General information, not legal advice.
Our EHR is cloud-hosted. What is left for us to secure?
Most of what investigators ask about. The EHR vendor secures its platform under its own agreement; the practice still owns who can log in and from which devices, whether those devices are encrypted and managed, the email and files in Microsoft 365 that carry patient information, the imaging workstation, the backups of everything outside the EHR, the audit logs and the staff training. Those are the technical safeguards NetSys configures and evidences, and they are the same whether the practice is in Charlotte or Greenville.
How do you handle a practice with several North Carolina offices?
With one risk analysis that names every office, system and vendor, one set of policies and controls applied through Microsoft 365, Intune and Entra ID, and office-specific entries for the physical safeguards and the regional hazards that each location's contingency plan must address. Evidence is collected the same way at every site, remotely, so a group in Raleigh and Wilmington has one program rather than two.
Start with the systems that handle patient information.
Bring your EHR and imaging platforms, your Microsoft 365 use, your remote access methods and whatever risk analysis exists. We will define the technical review, who owns each next step and how the evidence cycle runs, all remotely from Brooklyn in Eastern time.