N.M. Admin. Code § 8.300.2.7 - DEFINITIONS

The following definitions apply to terms used in this chapter.

A. Alternate address: A location other than the primary address on file with HCA for the recipient or the recipient's personal representative.

B. Alternate means of communication: A communication made other than in writing on paper, or made orally to the recipient or their personal representative.

C. Amend or amendment: To make a correction to information that relates to the past, present, or future physical or mental health or condition of a recipient.

D. Authorized HCC employee: A person employed within the health care component (HCC) workforce who is authorized by the immediate supervisor or by HCC policies to perform the task.

E. Business associate: A person or entity that performs certain functions or services on behalf of the HCC involving the use or disclosure of individually identifiable health information. These include claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, billing, benefit management, and practice management. They also include, other than in the capacity of a member of the HCC workforce, legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services to or for the HCC.

F. Covered entity: A health plan, a health care clearinghouse, or a health care provider that transmits any health information in electronic form in connection with a recipient's health care transaction.

G. Disclose or disclosure: To release, transfer, provide access to, or divulge in any other manner (verbally, written, or electronic) protected health information outside the HCC workforce or to an HCC business associate.

H. Health care component (HCC): Those parts of the HCA, which is a "hybrid entity" under HIPAA 45CFR 164.105], that engage in covered health plan functions and business associate functions involving protected health information. HCA's health care component consists of the medical assistance division, supported by the income support division, the office of inspector general, the office of general counsel, and the office of the secretary.

I. Health care operations: Any of the following activities: quality assessment and improvement activities, credentialing activities, training, outcome evaluations, audits and compliance activities, planning, fraud and abuse detection and compliance activities, managing, and general administrative activities of the HCC, to the extent that these are related to covered health plan functions.

J. Health oversight agency: An agency or authority of the United States, a state, a territory, a political subdivision of a state or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is authorized by law to oversee the health care system (whether public or private) or government programs in which health information is necessary to determine eligibility or compliance, or to enforce civil rights laws for which health information is relevant.

K. Health Insurance Portability and Accountability Act (HIPAA) privacy rule: The federal regulation Section 45 CFR part 160 and Subparts A and E of Part 164.

L. Health plan: The medicaid program under Title XIX of the Social Security Act, 42 U.S.C. 1396, et seq., and the state children's health insurance program (SCHIP) under Title XXI of the Social Security Act, 42 U.S.C. 1397, et seq.

M. HCC workforce: Permanent, term, temporary and part-time employees (classified or exempt), university/federal government placements, volunteers, contractors and others conducting data entry tasks, and contractors and other persons whose conduct and work activities are under the direct control of HCC.

N. Medical record or designated record set: Any HCC item, collection, or grouping of information that includes protected health information (PHI) that is written or electronic and is used in whole or in part, by or for HCC to make decisions about the recipient. This applies to:

(1) the medical records and billing records about the recipient maintained by or for the HCC;

(2) the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for HCC; and

(3) this definition excludes HCC documents such as those related to accreditation compliance activities (e.g., JCAHO), quality assurance, continuous quality improvement, performance improvement, peer reviews, credentialing and incident reports, and investigations.

O. Minimum necessary: The least amount of information needed to accomplish a given task.

P. Notice of privacy practices, notice or NPP: The official HCA notice of privacy practices that documents for a recipient the uses and disclosures of PHI that may be made by HCC and the recipient's rights and HCC's legal duties with respect to PHI.

Q. Payment: All HCC activities undertaken in its role as a health plan to obtain premiums or to determine or fulfill its responsibility for coverage and provision of benefits under the health plan, and HCC activities undertaken to obtain or provide reimbursement for the provision of health care. Such activities include but are not limited to:

(1) determination of eligibility or coverage;

(2) risk adjusting amounts due based upon health status or demographic characteristics;

(3) billing, claims management, collection activities, and related health care data processing;

(4) review of health care services with respect to medical necessity, coverage, appropriateness of care, or justification of charges;

(5) utilization review activities; and

(6) disclosure to consumer reporting agencies of lawful elements of PHI relating to collection of premiums or reimbursement.

R. Personal representative: A person who has the legal right to make decisions regarding an eligible recipient's PHI, and includes surrogate decision makers, parents of unemancipated minors, guardians and treatment guardians, and agents designated pursuant to a power of attorney for health care.

S. Privacy and security officer (PSO): The individual appointed by HCA pursuant to HIPAA 45 CFR 164.530(a) who is responsible for development, implementation, and enforcement of the privacy policies and procedures required by HIPAA.

T. Protected health information (PHI): Health information that exists in any form (verbal, written or electronic) that identifies or could be used to identify a recipient (including demographics) and relates to the past, present, or future physical or mental health or condition of that recipient. It also includes health information related to the provision of health care or the past, present, or future payment for the provision of health care to a recipient.

U. Psychotherapy notes: Notes recorded (in any medium) documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the recipient's medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.

V. Public health agency: An agency or authority of the United States, a state, a territory, a political subdivision of a state or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate.

W. Requestor: A recipient, personal representative of a recipient, or any other person making a request.

X. Restrict or restriction: To limit the use or disclosure of PHI for purposes of TPO, or for purposes of disclosing information to a spouse, personal representative, close family member or person involved with the eligible recipient's care.

Y. Standard protocols: A process that details what PHI is to be disclosed or requested, to whom, for what purpose, and that limits the PHI to be disclosed or requested to the amount reasonably necessary to achieve the purpose of the disclosure or request.

Z. TPO: Treatment, payment or health care operations.

AA. Treatment: The provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a recipient; or the referral of a recipient for health care from one health care provider to another.

BB. Valid authorization: An authorization with all required elements, as specified in HIPAA privacy policy in Section 13 of 8.300.2 NMAC.

Notes

N.M. Admin. Code § 8.300.2.7

8.300.2.7 NMAC - N, 7-1-03; A, 9-15-08, Adopted by New Mexico Register, Volume XXXV, Issue 12, June 25, 2024, eff. 7/1/2024