N.C. Gen. Stat. § 90-414.6
Any data pertaining to services rendered to Medicaid and other State-funded health care program beneficiaries submitted through and stored by the HIE Network pursuant to G.S. 90-414.4 or any other provision of this Article shall be and will remain the sole property of the State. Any data or product derived from the aggregated, de-identified data submitted to and stored by the HIE Network pursuant to G.S. 90-414.4 or any other provision of this Article, shall be and will remain the sole property of the State. The Authority shall not allow data it receives pursuant to G.S. 90-414.4 or any other provision of this Article to be used or disclosed by or to any person or entity for commercial purposes or for any other purpose other than those set forth in G.S. 90-414.4(a) or G.S. 90-414.2. To the extent the Authority receives requests for electronic health information as the term is defined in 45 C.F.R. § 171.102, or other medical records from an individual, an individual's personal representative, or an individual or entity purporting to act on an individual's behalf, the Authority (i) shall not fulfill the request and (ii) shall make available to the requester and the public, via the Authority's website, educational materials about how to access such information from other sources. Patient identifiers created and utilized by the Authority to integrate identity data in the HIE Network, along with the minimum necessary required demographic information related to those patients, shall be released to the GDAC and the Department by the Authority for purposes of entity resolution and master data management. These identifiers shall not be considered public records pursuant to Chapter 132 of the General Statutes.
N.C. Gen. Stat. § 90-414.6