N.M. Admin. Code § 8.300.2.13 - AUTHORIZATIONS

When a disclosure is made as a result of an exception to an authorization being required, the authorized HCC employee shall follow the specific procedure established for that exception 45CFR 164.502(b), 45 CFR 164.508, 45 CFR 164.512, 45 CFR 164.532.

A. Treatment, payment, or health care operations (TPO):

(1) When conducting daily business that involves the use or disclosure of PHI, the HCC shall determine whether the use or disclosure is for TPO.

(2) If the person who requested the PHI is unknown, the HCC shall verify the identity and authority in accordance with 8.300.2.21 NMAC.

(3) The HCC shall apply the minimum necessary criteria to disclosures of PHI for payment or health care operations.

(4) The HCC shall ensure that there are no restrictions to the requested disclosure for PHI.

(5) The HCC shall use or disclose the minimum necessary PHI. The minimum necessary criteria do not apply to disclosures or requests by a health care provider for treatment purposes.

(6) Disclosures made for the purpose of providing TPO are not required to be documented.

B. Averting a serious threat:

(1) If in good faith and using professional judgment, the HCC determines that the use or disclosure of PHI is necessary to avert a serious and imminent threat to the health or safety of a person or the public.

(a) If the identity of the requestor is unknown, the HCC shall verify the identity and authority of the requestor in accordance with 8.300.2.21 NMAC.

(b) The HCC shall apply the minimum necessary criteria per 8.300.2.16 NMAC for disclosing PHI to prevent or lessen the threat.

(c) The HCC shall disclose the PHI only to person(s) reasonably able to prevent or lessen the threat, including the target of the threat.

(2) The disclosure of PHI shall be documented in the PSO's database.

C. Workers compensation:

(1) If the identity and authority of the requestor is unknown, the HCC shall verify the information as required per 8.300.2.21 NMAC.

(2) The HCC shall disclose the required PHI to the workers' compensation administration in accordance with the minimum necessary criteria.

(3) The disclosure of PHI shall be documented in the PSO's database.

D. Coroners, medical investigators, funeral directors, and organ procurement organizations: When the PHI request is from coroners, medical investigators, funeral directors, or organ procurement organizations, the HCC shall:

(1) if unknown, verify the identity and authority of the requestor as per 8.300.2.21 NMAC;

(2) apply the minimum necessary criteria per 8.300.2.16 NMAC;

(3) disclose the minimum necessary PHI. Disclosures to the coroner or medical investigator require a valid subpoena; and

(4) record the disclosure in the PSO's database.

E. Disaster relief efforts: When an entity in disaster relief efforts requests PHI to assist in notifying, identifying, or locating a family member, personal representative or other person responsible for the care of the recipient regarding the recipient's location, general condition or death, the HCC shall:

(1) if unknown, verify the identity and authority of the requestor as per 8.300.2.21 NMAC;

(2) apply the minimum necessary criteria per 8.300.2.16 NMAC;

(3) provide recipients or their personal representatives the opportunity to agree to, restrict, or prohibit the use or disclosure of PHI to the disaster relief entity, unless the recipient is not present or is unable to agree to, restrict, or prohibit the disclosure; and

(4) record the disclosure in the PSO's database.

F. Health oversight activities: The health oversight agency may request documents related to a recipient's PHI and record the identity of recipients for whom PHI was accessed. The HCC shall then:

(1) if unknown, verify the identity and authority of the requestor as per 8.300.2.21 NMAC;

(2) apply the minimum necessary criteria per 8.300.2.16 NMAC;

(3) disclose the minimum necessary PHI;

(4) obtain the identity of recipients for whom PHI was accessed; and

(5) record the disclosure in the PSO's database.

G. Public health activities: A public health agency may request documents related to a recipient's PHI. The HCC shall then:

(1) if unknown, verify the identity and authority of the requestor as per 8.300.2.21 NMAC;

(2) apply the minimum necessary criteria per 8.300.2.16 NMAC;

(3) disclose the minimum necessary PHI if the purpose of requesting the information is for:

(a) the prevention or control of disease, injury, or disability including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health interventions; or, at the direction of a public health authority, to an official of a foreign government agency that is acting in collaboration with a public health authority;

(b) another public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect;

(c) a person subject to the jurisdiction of the food and drug administration:

(i) to report adverse events (or similar reports with respect to food or dietary supplements), product defects or problems (including problems with the use or labeling of a product), or biological product deviations if the disclosure is made to the person required or directed to report such information to the food and drug administration;

(ii) to track products if the disclosure is made to a person required or directed by the food and drug administration to track the product;

(iii) to enable product recalls, repairs, or replacement (including locating and notifying individuals who have received products subject to recalls, withdrawals, or other problems); or

(iv) to conduct postmarketing surveillance to comply with requirements or at the direction of the food and drug administration, or

(d) a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition.

(4) record the disclosure in the PSO's database.

H. Required by law:

(1) If the request for the disclosure of PHI appears to be required by law, the HCC shall verify the identity of the requestor and forward the request to the HCA office of general counsel (OGC) for a determination of the validity of the request.

(2) If advised by OGC that the request is valid, the HCC shall disclose the PHI in accordance with the minimum necessary criteria.

(3) The HCC shall record the disclosure in the PSO's database.

I. Law enforcement requests: When the disclosure of PHI is for law enforcement purposes, the HCC shall:

(1) verify identity and authority of the requestor;

(2) forward the request to OGC for a determination of the validity of the request;

(3) if advised by OGC that the request is valid, disclose the PHI in accordance with the minimum necessary criteria; and

(4) record the disclosure in the PSO's database.

J. Legal requests:

(1) If the request for PHI arises from legal proceedings and requests such as judicial or administrative proceedings or subpoenas, the HCC shall verify the identity of the requestor if practicable, and forward the request to OGC, unless documented exceptions from OGC have been received.

(2) If the identity of the requestor has not been previously verified to OGC, the HCC shall verify the identity of the requestor and determine the validity of the legal or law enforcement request.

(3) The HCC shall then disclose the PHI or direct the disclosure to be made.

(4) The HCC shall record the disclosure in the PSO's database.

K. When consent or authorization for the use or disclosure of PHI was made prior to July 1, 2003:

(1) The HCC shall determine if a valid authorization exists for the specific use or disclosure of PHI request.

(2) If a valid authorization does not exist, the HCC shall determine if a consent, an authorization, or other legal permission exists that was obtained before July 1, 2003.

(3) If a consent, an authorization, or other legal permission exists, the HCC shall verify that it is still in effect and that it is for the use or disclosure of the specific PHI requested.

(a) If yes, the HCC shall disclose the PHI and record the disclosure in the PSO's database.

(b) If no, the HCC shall deny the PHI request and instruct the requestor that a valid authorization must be obtained from the recipient. The requestor shall be provided a blank authorization form to be completed by recipient.

Notes

N.M. Admin. Code § 8.300.2.13

8.300.2.13 NMAC - N, 7-1-03, Adopted by New Mexico Register, Volume XXXV, Issue 12, June 25, 2024, eff. 7/1/2024