HIPAA policies for solo therapists in North Dakota

What federal law requires of every North Dakota practice

The HIPAA Security Rule (45 CFR § 164.316) requires written policies covering ten domains: designated privacy and security officials, risk analysis, workforce sanctions, access management, audit controls, contingency planning, breach notification, business associate agreements, workforce training, and device and media security. Policies must be retained for six years, carry effective dates, and be updated when your practice or the rules change.

What North Dakota adds

North Dakota follows the federal HIPAA baseline without a major state-specific health-privacy overlay, but its breach notification statute applies to practices alongside HIPAA's rules, and professional licensing boards in North Dakota expect confidentiality practices consistent with your written policies. State law changes frequently — which is exactly why policies need maintenance, not a one-time download.

The practical standard: adopted, dated, versioned

Regulators don't ask whether you own policy documents — they ask for the policy in effect on a given date, with its adoption record and revision history. A static template pack can't answer that. A policy set with attestations, effective dates, and version history can.