Current through Register Vol. 35, No. 18, September 24, 2024
A.
Reporting: In accordance with Subsections 24-14A-3(D) (6),
24-14A-4.3
& 24-14A-6(D) of the HIS Act, data may be reported routinely to authorized
federal, state, and local public agencies. Record-level data shall be reported
to the agency for healthcare research and quality (AHRQ) for incorporation into
the healthcare cost and utilization project (HCUP) databases as part of the
federal-state-industry partnership.
B.
Access requirements: Data and
reports based on the HIS may be obtained only in accordance with the
requirements of the HIS Act and this rule. Any request for information that
would not be contained in routine reports will require completion of a data
request form available on the division's website or by contacting the
division.
C.
Evaluation of
requests: In addition to other requirements stated in this rule, all
requests for HIS data and reports, other than routine reports, shall be
evaluated by the division and shall satisfy the following criteria for
approval.
(1) The specific intended use of the
data shall comport with the purposes of the HIS Act, as stated in
24-14A-3
A and rules promulgated pursuant to the act, including use of data to assist
in:
(a) the performance of health planning,
policy making functions, and research conducted for the benefit of the
public;
(b) informed health care
decision making by consumers;
(c)
surveillance for the control of disease and conditions of public health
significance as required by Public Health Act, Subsection 24-1-3(C) NMSA
1978;
(d) administration,
monitoring, and evaluation of a statewide health plan.
(2) The request shall be consistent with the
responsibilities of the division in accomplishing the priorities of the
HIS.
(3) The request is for data
that are either:
(a) in a routine report
previously published by the division, or
(b) aggregate data in or reports based on a
subset or portion of the HIS database that is relevant to the individual's
stated purpose upon approval of the request by the division , or
(c) record-level data, such that an
individual patient or healthcare professional cannot be identified, pursuant to
the HIS Act, to federal, state, and local public agencies, and upon approval of
the request by the division.
D.
Request procedures: All
requests for data shall be made pursuant to the requirements of 7.1.27.14
NMAC.
E.
Fees: Fees
for access to data and reports shall be paid pursuant to the requirements of
7.1.27.18 NMAC.
F.
Restrictions on access to sensitive data: The division shall have
the authority to deny access to information from the HIS database where use of
the information, as determined by the division, could result in violation of a
patient's privacy.
G.
Compliance with other laws: The division shall ensure that any
access to data that is subject to restrictions on use pursuant to state,
federal, or tribal law or regulation, or any other legal agreement, complies
with those restrictions.
H.
Disclaimer: The division shall include a disclaimer in all HIS
data and reports released pursuant to this rule stating that the accuracy of
the original data is the responsibility of the submitting data provider and
that the division assumes no responsibility for any use made of or conclusions
drawn from the data.
I.
Agency contractors:
(1) A state
or federal agency that receives HIS data or reports under an agreement with the
division pursuant to 7.1.27.15 NMAC, 7.1.27.16 NMAC, and 7.1.27.17 NMAC shall
be solely responsible for fulfillment of the agreement, including
responsibility for the actions of any subcontractor engaged to perform services
that require access to HIS data or reports.
(2) No state or federal agency shall
subcontract any portion of services to be performed under an agreement with the
division without prior written approval of the division.
(3) A state or federal agency subcontractor
that is provided access to HIS data or reports shall be subject to the full
provisions of the HIS Act, and this rule, including 7.1.27.15 NMAC, 7.1.27.16
NMAC, and 7.1.27.17.
J.
Public data: The restrictions that apply to the release of data do
not apply when the data provider is a government agency and the data provided
to the HIS otherwise would be considered public data in accordance with the
Public Records Act, Sections
14-3-1 to
14-3-23,
NMSA 1978, and the Open Meetings Act, Sections
10-15-1
to
10-15-4, NMSA
1978.
K.
Proprietary and
confidential information:
(1)
Proprietary information and patient confidential information shall not be
routinely disclosed in or as part of a public health information report by the
division.
(2) A data provider that
objects on proprietary grounds to the potential release in a public health
information report, or a record level data disclosure, of its reported data or
information derived from its reported data shall submit to the division a
written request to exempt its data from such disclosures. By the end of each
fiscal year (June 30th) data providers must notify,
in writing, the division regarding data items that they deem proprietary.
Application for an exemption must be addressed by a representative of the data
provider to the division.
L.
Final determination:
(1) The division shall prepare a recommended
written decision in the format required by Subsection
39-3-1.1
NMSA 1978. The recommended written decision shall be approved or disapproved by
the department division director or designee within 10 days or as expeditiously
as possible after the issuance of the division's written
recommendation.
(2) The decision by
the department division director or designee is subject to review by the
secretary at the secretary's discretion and is the final determination for
purpose of judicial review.
(3) The
department shall issue a final decision that includes an order granting or
denying relief. The final decision may incorporate the division's recommended
decision or the department may render any other final decision supported by
law. The final decision shall include a statement of the factual and legal
basis for the decision.
