SB 282 — RELEASE OF CERTAIN MEDICAL RECORDS

SENATE BILL 282 55TH LEGISLATURE -STATEOFNEWMEXICO-- STATEOFNEWMEXICO- FIRST SESSION, 2021 INTRODUCED BY Martin Hickey 6This 8document 10may ANincorporate ACTamendments RELATINGproposed TOby MEDICALa RECORDS;committee, but not yet adopted, as well as amendments that have been adopted during the current legislative session.

ALLOWINGThe DISCLOSURESdocument FORis TREATMENT,a PAYMENTtool ANDto OTHERshow ACTIVITIES.amendments in context and cannot be used for the purpose of adding amendments to legislation.

14h BEAN ITACT ENACTEDg BYo THERELATING LEGISLATURETO OFMEDICAL THERECORDS; STATE OF NEW MEXICO:

SECTIONALLOWING 1.DISCLOSURES FOR t hr g e i k TREATMENT, PAYMENT AND OTHER ACTIVITIES.

Sectionh 24-14B-6r NMSAi 1978s (beingh Laws, 2009,t, ChapterBE 69,IT SectionENACTED 6)BY isTHE amendedLEGISLATURE toOF read:THE STATE OF NEW MEXICO:

e tu 17g "24-14B-6.e b l e e h SECTION 1.

USESection AND24-14B-6 DISCLOSURENMSA OF1978 ELECTRONIC(being HEALTHLaws CARE2009, w l n d 18d INFORMATION.--i = = 19o ah lChapter A.69, Section 6) is amended to read:

Al provider,] healthb care,d institution, health i a eº r 20 information exchange or health care group purchaser shall not a t m m 21 use or disclose health care information in an individual's d r e 22"24-14B-6. electronic medical record to another person without the consent c e s k 23 of the individual except as allowed by state or federal law.

USE AND DISCLOSURE OF ELECTRONIC HEALTH CARE r i = r t e w d m a n bo 24INFORMATION.-- B.d m :

Ab provider,e healthd cares institutionº oro healtht un [= care.218913.2AIC groupMarch purchaser2, may2021 disclose(4:31pm) demographics informationk andm .218913.2e informatione about the location of an individual's electronic medical records to a recordn locatore serviced inr accordancee withl stateu or[ federalA law.d A.

A providerprovider, or health care institutioninstitution, participating in a health information exchange usingor ahealth recordcare locatorgroup servicepurchaser shall not haveuse accessor todisclose demographichealth information,care information about the location of the individual's electronic medical records or information in an individual's electronic medical record exceptto inanother connectionperson withwithout the treatment of the individual or as permitted by the consent of the individual orexcept as otherwiseallowed permitted by state or federal law.

C.B.

A recordprovider, locatorhealth servicecare shallinstitution maintainor anhealth auditcare loggroup ofpurchaser personsmay obtainingdisclose accessdemographic toinformation and information inabout the recordlocation locatorof service,an whichindividual's auditelectronic logmedical shallrecords contain,to at a minimum,record informationlocator on:service in accordance with state or federal law.

(1)A provider or health care institution participating in a health information exchange using a record locator service shall not have access to demographic information, information about the identitylocation of the personindividual's obtainingelectronic emedical trecords 17or accessinformation toin an individual's electronic medical record except in connection with the information;treatment of the individual or as permitted by the consent of h the individual or as otherwise permitted by state or federal u » r law.

wt lh ng de 18 (2) the identity of the individual whose = = 19 a l informationi wasC. obtained;

iA arecord elocator service shall maintain an audit h r 20i (3)s log of persons obtaining access to information in the locationrecord fromh , e h locator service, which theaudit informationlog shall contain, at a minimum, t mu mg 21e wasb obtained;l e e , gh information on:

n d rd ei 22= (4)= o h (1) the specificidentity informationof obtained;the person obtaining l ] b ,d i a º r access to the information;

ande cr = t e sw kd 23m (5)a then dateo that(2) the informationidentity wasof ethe aindividual nwhose bd 24m obtained.:

b r e t º o t n = .218913.2AIC March 2, 2021 (4:31pm) s k m e - 2 - e a n e d r e l u [ D.A d information was obtained;

The(3) auditthe loglocation shallfrom bewhich made available by a .218913.2 - 2 - health information exchange on the request of an individual whose health care information iswas theobtained; subject of the audit log;

(4) the specific information obtained;

and (5) the date that the information was obtained.

D.

The audit log shall be made available by a health information exchange on the request of an individual whose health care information is the subject of the audit log;

A record locator service shall provide a h mechanism under which individuals may exclude their demographic g o t hr information and information about the location of their g e i k electronic medical records from the record locator service.

A h r i s person operating a record locator service or a health h , t, information exchange that receives an individual's request to e u g e b l e e h exclude all of the individual's information from the record n d d i = = o h locator service is responsible for removing that information el t] 17b ,d i a º e from the record locator service within thirty days.

An wr li n= r t e w d 18m a n o individual's request for exclusion of information shall be in =d =m 19: a l writing and shall include a waiver of liability for any harm i a e r 20 caused by the exclusion of the individual's information.

ab e d s º o t mn = .218913.2AIC March 2, 2021 (4:31pm) s k m 21e F.- 3 - e a n e d r e l u [ A d writing and shall include a waiver of liability for any harm caused by the exclusion of the individual's information.

WhenF. information in an individual's electronic d r e 22 medical record is requested using a record locator service or a c e s k 23 health information exchange:

eWhen ainformation nin ban 24individual's (1)electronic themedical requestingrecord provider or health care u [ institution shall warrant that the request is forrequested theusing treatmenta .218913.2record -locator 3service - of the individual, is permitted by the individual's written authorization or isa otherwisehealth permittedinformation byexchange: state or federal law;

(1) the requesting provider or health care institution shall warrant that the request is for the treatment of the individual, is permitted by the individual's written authorization or is otherwise permitted by state or federal law;

Notwithstanding any other provision of law, h information in an individual's electronic medical record may be u » r disclosed:

t h g e l i (1) to a provider that has a need for h r i s information about the individual to treat a condition that h , e h poses an immediate threat to the life of any individual and t u g e b l e e , gh that requires immediate medical attention;

[and][and ] n d d i = = o h (2) except as provided in the Electronic el t] 17b ,d i a º r Medical Records Act, to a record locator service or a health we lr n= t e w d 18m a n o information exchange for the development and operation of the =d =m 19: a l record locator service and the health information exchange;

andb ir a e rt 20º (3)o tot an provider,= health.218913.2AIC careMarch institution2, or2021 a(4:31pm) ts mk m 21e health- care4 group- purchasere fora treatment,n paymente or health d r e 22l careu operation[ activities,A ind compliancerecord withlocator theservice federal c e s k 23 Health Insurance Portability and Accountability Act of 1996 and e a n b 24 the regulationshealth promulgatedinformation pursuantexchange; to that act, and if u [ applicable, in compliance with 42 U.S.C.

Sectionand 290dd-d(3) to a provider, health care institution or health care group purchaser for treatment, payment or health care operation activities, in compliance with the federal Health Insurance Portability and .218913.2Accountability -Act 4of -1996 and the regulations promulgated pursuant to that section."act, SECTIONand 2.if applicable, in compliance with 42 U.S.C.

EFFECTIVESection DATE.--TheSHPACº290dd-d»SHPAC effectiveSHPACº290dd-2»SHPAC dateand of the provisionsregulations ofpromulgated thispursuant actto isthat Julysection. 1, 2021.

-SHPACº"»SHPAC 5SHPACºH. - 6 8 10 12 14 16 e t 17 w l n d 18 = = 19 a l i a e r 20 a t m m 21 d r e 22 c e s k 23 e a n b 24 u [ .218913.2

For the purposes of this section, "health care operation activities" includes administrative, financial, legal and quality improvement activities of a covered entity that are necessary to conduct business and to support the core functions of treatment and payment and are limited to the activities listed in the definition of "health care operations" at 45 CFR 164.501."»SHPAC h SECTION 2.

EFFECTIVE DATE.--The effective date of the u » r provisions of this act is July 1, 2021.