New Mexico Administrative Code
Title 8 - SOCIAL SERVICES
Chapter 300 - MEDICAID GENERAL INFORMATION
Part 2 - HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) POLICIES
Section 8.300.2.12 - USE AND GENERAL DISCLOSURES OF PROTECTED HEALTH INFORMATION
Universal Citation: 8 NM Admin Code 8.300.2.12
Current through Register Vol. 35, No. 6, March 26, 2024
PHI shall be used or disclosed only by authorized HCC staff or contractors and only in accordance with HCC policies and procedures [ 45 CFR 164.502(a) and 45 CFR 164.530(i) ].
A. Making a disclosure when an authorization is required: When PHI is requested, an authorized HCC employee shall:
(1) determine if a valid
authorization is presented. See 8.300.2.13 NMAC;
(2) determine the identity and authority of
the requestor as per 8.300.2.21 NMAC;
(3) if a valid authorization is presented and
the identity and authority of the requestor is verified, the HCC is authorized
to disclose the PHI in accordance with the valid authorization's
instructions;
(4) HCC shall retain
the valid authorization in the recipient's file;
(5) the valid authorization and the
disclosure shall be documented in the PSO's database;
(6) if the request is not accompanied by a
valid authorization, the HCC shall determine if an exception to the
authorization requirement applies; and
(7) if no exception applies, the HCC shall
deny the request for disclosure of PHI, document the denial and instruct the
requestor that a valid authorization shall be obtained from the recipient or
their personal representative before MAD will disclose PHI.
B. Exceptions: A valid written authorization shall be required from a recipient or their personal representative before any use or disclosure of PHI, with the following exceptions:
(1) disclosures to the recipient
or personal representative pursuant to his/her request [
45
CFR 164.502(a)(1)(i)
];
(2) for purposes of TPO [
45
CFR 164.502 and 506 ];
(3) when a consent, authorization, or other
express legal permission in writing was obtained from the eligible recipient
prior to July 1, 2003, and is on file in an HCC location that permits the use
or disclosure of PHI [
45 CFR
164.532 ]; and
(4) when the use or disclosure of PHI is
limited to the minimum necessary to or for the following:
(a) assist disaster relief agencies [
45
CFR 164.510(b)(4)
];
(b) coroners, medical
investigators, funeral directors, and organ procurement organizations as
authorized by law [
45
CFR 164.512(g) and (h)
];
(c) avert a serious and imminent
threat to the health or safety of a person or the public [
45
CFR 164.512(j) ];
(d) health oversight activities [
45
CFR 164.512(d) ];
(e) disclosures required by law pursuant to a
legal duty to disclose or report, such as for law enforcement purposes, child
abuse or neglect, judicial or administrative proceedings, or workers
compensation proceedings pursuant to a subpoena [
45
CFR 164.512(a), (c), (e) and
(f) ];
(f) public health activities [
45
CFR 164.512(b) ];
(g) correctional institutions or law
enforcement officials who have custody of an inmate [
45
CFR 164.512(k)(5)
];
(h) government agencies which
administer a government program that provides public benefits, where the
disclosure is necessary to coordinate, improve, investigate, or manage the
program [
45
CFR 164.512(d)(1) and (3) ];
or
(i) research purposes that have
been granted a waiver of authorization by an appropriately constituted
institutional review board (IRB), a privacy board or representation that the
PHI is necessary for research purposes [
45
CFR 164.512(i) ].
Disclaimer: These regulations may not be the most recent version. New Mexico may have more current or accurate information. We make no warranties or guarantees about the accuracy, completeness, or adequacy of the information contained on this site or the information linked to on the state site. Please check official sources.
This site is protected by reCAPTCHA and the Google
Privacy Policy and
Terms of Service apply.