New Mexico Administrative Code
Title 7 - HEALTH
Chapter 5 - VACCINATIONS AND IMMUNIZATIONS
Part 2 - IMMUNIZATION REQUIREMENT
Section 7.5.2.10 - IMMUNIZATION RECORD SHARING

A. Under the Health Insurance Portability and Accountability Act (HIPAA), immunization data are protected health information; however, HIPAA permits covered entities to disclose, without individual authorization or prior notification, protected health information to public health authorities authorized by law to collect or receive such information for the purpose of prevention or controlling disease ( 45 CFR § 164.502 ). Under federal guidelines, the definition of a "public health authority" requires that an agency's official mandate include the responsibility for public health matters. The mandate can be responsibility for public health matters, generally, or it can be for specific public health matters. An agency's official mandate does not have to be exclusively or primarily for public health. To the extent a public health authority is authorized by law to collect or receive information for the public health purposes specified in the public health provision, covered entities protected health information to such public health authorities without authorization pursuant to the public health provision.

B. Public health authorities include federal public health agencies, tribal health agencies, state public health agencies, local public health agencies, and anyone performing public health functions under a grant of authority from the department.

C. New Mexico schools shall act as a "public health authority" in cooperation with the department when they track immunization status of enrolled students and those in the process of enrolling.