N.M. Admin. Code § 8.300.2.21 - VERIFYING IDENTITY AND AUTHORITY

If the identity or authority of a requestor of PHI is unknown, the identity and authority of that requestor shall be verified prior to any disclosure 45CFR 164.514(h).

A. Identification: Upon receipt of a request for PHI, an authorized HCC employee must determine whether the requestor is a recipient or personal representative of a recipient.

(1) If the requestor is unknown to the authorized HCC employee, the employee shall request proof of identity, such as a photograph ID, credit card issued to the requestor, or medicaid card issued to the requestor.

(2) If the request is made over the phone, the HCC employee shall require proof of identity by asking for a social security number or omnicaid system ID.

(3) If the requestor is the recipient, a valid signed authorization satisfies the authority requirement.

(4) If the requestor is the recipient's personal representative, the HCC employee shall require proof of authority to act on the recipient's behalf.

(5) If the request for PHI disclosure is by a government official, and the government official's identity is unknown, the HCC employee shall verify the identity of the government official by viewing an agency identification badge or other official credentials.

(6) The HCC employee shall forward all requests for PHI for research purposes to the PSO. See 8.300.2.14 NMAC.

B. Authority: Once the identity of the government official is verified (or if already known), the HCC employee shall verify the authority of the request. If the disclosure of PHI is required by law, the employee shall disclose the PHI and record the disclosure in the PSO's database. If there are questions as to whether PHI disclosure is required by law, the employee shall seek assistance from OGC prior to any PHI disclosure.

(1) HCC shall forward all requests for PHI from subpoenas, legal requests, or for law enforcement purposes to OGC within two working days.

(2) For any requests for PHI received, OGC shall determine the identity of the requestor and the authority of the requestor. OGC then shall approve or deny the request and take the appropriate legal action.

C. Restrictions or amendments: If a valid authorization from an ISD location is received because a restriction or amendment is recorded in the PSO's database, the HCC shall take the following action.

(1) If a restriction is already documented, and the valid authorization from the recipient is asking for the restricted PHI to be disclosed, the HCC shall notify the recipient in writing within three working days that a previously set restriction must be revoked in writing by the recipient before the disclosure can be made.

(2) If an amendment is requested, within three working days the HCC shall determine if the PHI to be disclosed has been amended. If yes, the HCC shall disclose the amended PHI.

(3) The HCC shall record the disclosure in the PSO's database.

Notes

N.M. Admin. Code § 8.300.2.21

8.300.2.21 NMAC - N, 7-1-03; A, 9-15-08, Adopted by New Mexico Register, Volume XXXV, Issue 12, June 25, 2024, eff. 7/1/2024