N.M. Admin. Code § 8.300.2.12 - USE AND GENERAL DISCLOSURES OF PROTECTED HEALTH INFORMATION

PHI shall be used or disclosed only by authorized HCC staff or contractors and only in accordance with HCC policies and procedures 45 CFR 164.502(a) and 45 CFR 164.530(i).

A. Making a disclosure when an authorization is required: When PHI is requested, an authorized HCC employee shall:

(1) determine if a valid authorization is presented. See 8.300.2.13 NMAC;

(2) determine the identity and authority of the requestor as per 8.300.2.21 NMAC;

(3) if a valid authorization is presented and the identity and authority of the requestor is verified, the HCC is authorized to disclose the PHI in accordance with the valid authorization's instructions;

(4) HCC shall retain the valid authorization in the recipient's file;

(5) the valid authorization and the disclosure shall be documented in the PSO's database;

(6) if the request is not accompanied by a valid authorization, the HCC shall determine if an exception to the authorization requirement applies; and

(7) if no exception applies, the HCC shall deny the request for disclosure of PHI, document the denial and instruct the requestor that a valid authorization shall be obtained from the recipient or their personal representative before MAD will disclose PHI.

B. Exceptions: A valid written authorization shall be required from a recipient or their personal representative before any use or disclosure of PHI, with the following exceptions:

(1) disclosures to the recipient or personal representative pursuant to their request 45 CFR 164.502(a)(1)(i);

(2) for purposes of TPO 45 CFR 164.502 and 506 ;

(3) when a consent, authorization, or other express legal permission in writing was obtained from the eligible recipient prior to July 1, 2003, and is on file in an HCC location that permits the use or disclosure of PHI 45 CFR 164.532; and

(4) when the use or disclosure of PHI is limited to the minimum necessary to or for the following:

(a) assist disaster relief agencies 45 CFR 164.510(b)(4);

(b) coroners, medical investigators, funeral directors, and organ procurement organizations as authorized by law 45 CFR 164.512(g) and (h);

(c) avert a serious and imminent threat to the health or safety of a person or the public 45CFR 164.512(j):

(d) health oversight activities 45CFR 164.512(d);

(e) disclosures required by law pursuant to a legal duty to disclose or report, such as for law enforcement purposes, child abuse or neglect, judicial or administrative proceedings, or workers compensation proceedings pursuant to a subpoena 45CFR 164.512(a), (c), (e) and (f):

(f) public health activities 45CFR 164.512(b):

(g) correctional institutions or law enforcement officials who have custody of an inmate 45CFR 164.512(k)(5):

(h) government agencies which administer a government program that provides public benefits, where the disclosure is necessary to coordinate, improve, investigate, or manage the program 45CFR 164.512(d)(1) and (3): or

(i) research purposes that have been granted a waiver of authorization by an appropriately constituted institutional review board (IRB), a privacy board or representation that the PHI is necessary for research purposes 45CFR 164.512(i).

Notes

N.M. Admin. Code § 8.300.2.12

8.300.2.12 NMAC - N, 7-1-03; A, 9-15-08, Adopted by New Mexico Register, Volume XXXV, Issue 12, June 25, 2024, eff. 7/1/2024