New Mexico Administrative Code
Title 8 - SOCIAL SERVICES
Chapter 300 - MEDICAID GENERAL INFORMATION
Part 2 - HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) POLICIES
Section 8.300.2.12 - USE AND GENERAL DISCLOSURES OF PROTECTED HEALTH INFORMATION

Universal Citation: 8 NM Admin Code 8.300.2.12

Current through Register Vol. 35, No. 6, March 26, 2024

PHI shall be used or disclosed only by authorized HCC staff or contractors and only in accordance with HCC policies and procedures [ 45 CFR 164.502(a) and 45 CFR 164.530(i) ].

A. Making a disclosure when an authorization is required: When PHI is requested, an authorized HCC employee shall:

(1) determine if a valid authorization is presented. See 8.300.2.13 NMAC;

(2) determine the identity and authority of the requestor as per 8.300.2.21 NMAC;

(3) if a valid authorization is presented and the identity and authority of the requestor is verified, the HCC is authorized to disclose the PHI in accordance with the valid authorization's instructions;

(4) HCC shall retain the valid authorization in the recipient's file;

(5) the valid authorization and the disclosure shall be documented in the PSO's database;

(6) if the request is not accompanied by a valid authorization, the HCC shall determine if an exception to the authorization requirement applies; and

(7) if no exception applies, the HCC shall deny the request for disclosure of PHI, document the denial and instruct the requestor that a valid authorization shall be obtained from the recipient or their personal representative before MAD will disclose PHI.

B. Exceptions: A valid written authorization shall be required from a recipient or their personal representative before any use or disclosure of PHI, with the following exceptions:

(1) disclosures to the recipient or personal representative pursuant to his/her request [ 45 CFR 164.502(a)(1)(i) ];

(2) for purposes of TPO [ 45 CFR 164.502 and 506 ];

(3) when a consent, authorization, or other express legal permission in writing was obtained from the eligible recipient prior to July 1, 2003, and is on file in an HCC location that permits the use or disclosure of PHI [ 45 CFR 164.532 ]; and

(4) when the use or disclosure of PHI is limited to the minimum necessary to or for the following:
(a) assist disaster relief agencies [ 45 CFR 164.510(b)(4) ];

(b) coroners, medical investigators, funeral directors, and organ procurement organizations as authorized by law [ 45 CFR 164.512(g) and (h) ];

(c) avert a serious and imminent threat to the health or safety of a person or the public [ 45 CFR 164.512(j) ];

(d) health oversight activities [ 45 CFR 164.512(d) ];

(e) disclosures required by law pursuant to a legal duty to disclose or report, such as for law enforcement purposes, child abuse or neglect, judicial or administrative proceedings, or workers compensation proceedings pursuant to a subpoena [ 45 CFR 164.512(a), (c), (e) and (f) ];

(f) public health activities [ 45 CFR 164.512(b) ];

(g) correctional institutions or law enforcement officials who have custody of an inmate [ 45 CFR 164.512(k)(5) ];

(h) government agencies which administer a government program that provides public benefits, where the disclosure is necessary to coordinate, improve, investigate, or manage the program [ 45 CFR 164.512(d)(1) and (3) ]; or

(i) research purposes that have been granted a waiver of authorization by an appropriately constituted institutional review board (IRB), a privacy board or representation that the PHI is necessary for research purposes [ 45 CFR 164.512(i) ].

Disclaimer: These regulations may not be the most recent version. New Mexico may have more current or accurate information. We make no warranties or guarantees about the accuracy, completeness, or adequacy of the information contained on this site or the information linked to on the state site. Please check official sources.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.