Current through Register Vol. 35, No. 18, September 24, 2024
The Health Insurance Portability and Accountability Act of
1996 and children, youth and families department policies,
8.8.5.1 through
8.8.5.20 NMAC, provide that individuals have certain rights with respect to
their protected health information. Any requests to avail themselves of those
rights, as enumerated herein, must be in writing.
A. Individuals or their personal
representatives have a right to inspect and copy their own PHI as follows:
(1) Access is denied, with no right of
review, if:
(a) the individual is a resident
in a department correctional facility and obtaining such access would
jeopardize the health, safety, security, custody, or rehabilitation of the
individual or of other residents, or the safety of any officer, employee, or
other person at the correctional institution or responsible for the
transporting of the resident;
(b)
the information was compiled in reasonable anticipation of, or for use in, a
civil, criminal, or administrative proceeding;
(c) the information is contained in
psychotherapy notes;
(d) the PHI
was obtained from someone other than a health care provider under a promise of
confidentiality and the access requested would be reasonably likely to reveal
the source of the information, or
(e) any circumstances where access to PHI is
restricted by federal or state statute or regulation not otherwise pre-empted
by HIPAA.
(2) Access is
denied, with right of review, if:
(a) the
access to the PHI requested is determined by a licensed health care
professional to be likely to endanger the life or physical safety of the
individual or another person; and such determination is documented;
(b) the access is requested by a personal
representative and a licensed health care professional determines that such
access is reasonably likely to cause substantial harm to the individual or
another person, or
(c) the PHI
makes reference to another person (unless such person is a health care
provider) and a licensed health care professional has determined that granting
the access requested is reasonably likely to cause substantial harm to such
other person.
(3) If the
basis for the denial of access provides for a right of review, the individual
or his/her personal representative has a right to have the denial reviewed by
another licensed health care professional who did not participate in the
original denial decision. Such review must be completed within a reasonable
period of time, and the department must promptly provide the individual or
his/her personal representative with notice of the reviewer's decision and
comply with the determination to provide or deny access.
B. Individuals or their personal
representatives have a right to submit a written request for an amendment to
their own PHI for as long as the department maintains the PHI.
(1) The department must act on the request
within sixty (60) days of receipt of the request by the privacy office or
within ninety (90) days if the privacy office notifies the individual or
his/her personal representative within the first sixty (60) days of the reasons
for delay and the date by which action on the request will be taken. Requests
to amend the individual's record may be denied for the following reasons:
(a) PHI contained in the record is deemed to
be accurate and complete;
(b) PHI
contained in the record was not created by department employees, (unless the
individual or his/her personal representative provides reasonable basis to
believe that the originator of the records is no longer available to act on the
request), or
(c) the information
that is the subject of the request for amendment is not part of the designated
record set.
(d) would not be
available for inspection under Section 8.8.5.10(A)(1) above.
(2) Approved amendments will
become incorporated into the individual's record and the department will make
reasonable efforts to provide the amended information to those persons and
others, including business associates, that the department knows to have the
affected PHI and that may have relied, or be foreseen to rely, on that
information to the detriment of the individual. If the department rejects the
amendment, the individual or his/her personal representative will be provided
an opportunity to submit a written letter of disagreement that shall be
appended or otherwise linked to the part of the record containing the disputed
information.
C.
Individuals or their personal representatives have a right to request receipt
of the department's communications containing PHI by alternative means or at
alternative locations by submitting a request in writing to the department's
privacy officer. The department routinely accommodates all reasonable
requests.
D. Individuals or their
personal representatives have a right to submit a written request for a written
accounting of disclosures made by the department within the previous six years
as provided in Section 8.8.5.17 herein. The department acts on the request no
later than 60 days after receipt, and the time may be extended for a 30 day
period if the department provides a written statement of the reasons for the
delay. Health oversight agencies and law enforcement officials may require,
under certain circumstances provided in
45 CFR
Section 164.528(a)(2), a
suspension of the right to an accounting for a specified time. An accounting
does not include disclosures made:
(1) to
carry out treatment, payment and health care operations;
(2) to the individual or to the individual's
personal representative of his or her own PHI;
(3) incident to certain uses or disclosures
permitted or required pursuant to
45
CFR Section 164.502;
(4) pursuant to a written
authorization;
(5) to correctional
institutions or law enforcement officials pursuant to
45
CFR Section
164.512(k)(5);
(6) prior to the compliance date for
providers of April 14, 2003 or for the small health plan administered by the
prevention and intervention division of April 14, 2004.
(7) that are otherwise excepted in
45 CFR
Section
164.528(a)(1).
E. Individuals have a right to
complain to the department concerning the department's policies and procedures
implementing HIPAA. The complaint is made in writing either to the department
privacy office and/or to the secretary of the United States department of
health and human services. The complaint must be filed within 180 days of when
the complainant knew or should have known that the alleged violation occurred,
unless this time limit is waived for good cause shown. The complaint must name
the entity or person that is the subject of the complaint, describe the alleged
violation and the applicable requirements of the code or regulation.
