SENATE BILL 278
49th legislature - STATE OF NEW MEXICO - first session, 2009
INTRODUCED BY
Peter Wirth
AN ACT
CREATING THE ELECTRONIC MEDICAL RECORDS ACT; ALLOWING THE CREATION, MAINTENANCE AND USE OF ELECTRONIC MEDICAL RECORDS; CLARIFYING INDIVIDUAL RIGHTS WITH RESPECT TO THE DISCLOSURE OF INFORMATION CONTAINED IN ELECTRONIC MEDICAL RECORDS; CLARIFYING THE PROTECTION OF PRIVACY OF ELECTRONIC MEDICAL RECORDS.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF NEW MEXICO:
Section 1. SHORT TITLE.--This act may be cited as the "Electronic Medical Records Act".
Section 2. PURPOSE.--The purpose of the Electronic Medical Records Act is to provide for the use, disclosure and protection of electronic medical records.
Section 3. DEFINITIONS.--As used in the Electronic Medical Records Act:
A. "demographic information" means information that identifies the individual who is the subject of the health care information, including the individual's name, date of birth and address and other information that identifies the individual, that may be used to identify the individual or that associates the individual with the individual's electronic medical record;
B. "disclose" means to release, transfer, provide or otherwise divulge an individual's health care information to a person other than the holder of the records and includes having access to those records;
C. "electronic" means relating to technology having electrical, digital, magnetic, wireless, optical, electromagnetic or similar capabilities;
D. "electronic medical record" means an electronic record of an individual patient's health care information that may contain demographic information;
E. "electronic signature" means an electronic sound, symbol or process attached to or logically associated with a record and executed or adopted by an individual with the intent to sign the record;
F. "health care" means care, services or supplies related to the health of an individual and includes:
(1) preventive, diagnostic, therapeutic, rehabilitative, maintenance or palliative care and counseling;
(2) services, assessments or procedures that are concerned with the physical or mental condition or functional status of an individual or that affect the structure or function of the body of an individual; and
(3) the sale or dispensing of a drug, a device, a piece of equipment or other item in accordance with a prescription;
G. "health care group purchaser" means a person who is licensed, certified or otherwise authorized or permitted by the New Mexico Insurance Code to pay for or purchase health care on behalf of an identified individual or group of individuals, regardless of whether the cost of coverage or services is paid for by the purchaser or the persons receiving coverage or services;
H. "health care information" means any information, whether oral or recorded in any form or medium, related to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual;
I. "health care institution" means an institution, facility or agency licensed, certified or otherwise authorized or permitted by law to provide health care in the ordinary course of business;
J. "health information exchange" means an arrangement among persons participating in a defined secure electronic network service, such as a regional health information organization, that allows the sharing of health care information about individual patients among different health care institutions or unaffiliated providers. The use of an electronic medical record system by a health care provider or by an organized health care arrangement as defined by the federal Health Insurance Portability and Accountability Act of 1996 does not constitute a health information exchange;
K. "information" means data, including text, images, sounds and codes and computer programs, software and databases;
L. "provider" means an individual who is licensed, certified or otherwise authorized or permitted by law to provide health care in the ordinary course of business or practice of a profession;
M. "record" means information that is inscribed on a tangible medium or that is stored in an electronic or other medium and is retrievable in perceivable form;
N. "record locator service" means an information service that contains demographic information and the location of health care information of a specified individual across different health care institutions or unaffiliated providers that participate in the service. The use of an electronic medical record system by a health care provider or by an organized health care arrangement as defined by the federal Health Insurance Portability and Accountability Act of 1996 does not constitute a record locator service; and
O. "treatment" means the provision, coordination or management of health care and related services by one or more providers, including the coordination or management of health care by a provider with a third party; consultation between providers relating to an individual; or the referral of an individual for health care from one provider to another.
Section 4. ELECTRONIC MEDICAL RECORDS--ELECTRONIC SIGNATURES--LEGAL RECOGNITION.--If a law or rule requires a medical record to be in writing, or if a law or rule requires a signature pertaining to a medical record, an electronic medical record or an electronic signature satisfies that law or rule.
Section 5. RETENTION OF ELECTRONIC MEDICAL RECORDS.--
A. If a law or rule requires that a medical record be retained, the requirement is satisfied by retaining an electronic record that:
(1) accurately reflects the medical record after it was first generated and in its final form as an electronic medical record or otherwise; and
(2) remains accessible and is capable of being accurately reproduced for later reference.
B. If a law or rule requires a medical record to be presented or retained in its original form or provides consequences if the medical record is not presented or retained in its original form, that law or rule is satisfied by an electronic medical record retained in accordance with Subsection A of this section.
C. A medical record retained as an electronic medical record in accordance with Subsection A of this section satisfies a law or rule requiring a person to retain a medical record for evidentiary, audit or other purposes.
Section 6. USE AND DISCLOSURE OF ELECTRONIC HEALTH CARE INFORMATION.--
A. A provider, health care institution, health information exchange or health care group purchaser shall not use or disclose health care information in an individual's electronic medical record to another person in violation of state or federal law and without the consent of the individual.
B. A provider, health care institution or health care group purchaser may disclose demographic information and information about the location of an individual's electronic medical records to a record locator service in accordance with state or federal law. A provider or health care institution participating in a health information exchange using a record locator service shall not have access to demographic information, information about the location of the individual's electronic medical records or information in an individual's electronic medical record except in connection with the treatment of the individual or as permitted by the consent of the individual or as otherwise permitted by state or federal law.
C. A health information exchange maintaining a record locator service shall maintain an audit log of persons obtaining access to information in the record locator service, which audit log shall contain, at a minimum, information on:
(1) the identity of the person obtaining access to the information;
(2) the identity of the individual whose information was obtained;
(3) the location from which the information was obtained;
(4) the specific information obtained; and
(5) the date that the information was obtained.
D. The audit log shall be made available by a health information exchange on the request of an individual whose health care information is the subject of the audit log; provided, however, that the audit log made available to the individual shall include only information related to that individual. The audit log shall be made available to the requesting individual annually for a reasonable fee as established by the department of health for access to medical records for disability benefits pursuant to Section 14-6-3 NMSA 1978.
E. A person operating a record locator service or a health information exchange shall provide a mechanism under which individuals may exclude their demographic information and information about the location of their electronic medical records from the record locator service. A person operating a record locator service or a health information exchange that receives an individual's request to exclude all of the individual's information from the record locator service is responsible for removing that information from the record locator service within thirty days; provided, however, that the request to exclude information shall not apply to a provider, a group of providers, a health care institution or an organization of providers that has provided health care to the individual and retains information about that health care. An individual's request for exclusion of information shall be in writing and shall include a waiver of liability for any harm caused by the exclusion of the individual's information.
F. When information in an individual's electronic medical record is requested using a record locator service or a health information exchange:
(1) the requesting provider or health care institution shall warrant that the request is for the treatment of the individual, is permitted by the individual's written authorization or is otherwise permitted by state or federal law; and
(2) the person disclosing the information may rely upon the warranty of the person making the request that the request is for the treatment of the individual, is permitted with the consent of the individual or is otherwise permitted by state or federal law.
G. Notwithstanding any other provision of law, information in an individual's electronic medical record may be disclosed to a provider that has a need for information about the individual to treat a condition that poses an immediate threat to the life of the individual and that requires immediate medical attention.
H. Notwithstanding any other provision of law, information in an individual's electronic medical record may be disclosed to a person that uses non-patient-specific information to maintain or improve the health of the general public or to conduct research that has been sanctioned by a legally authorized medical review board; provided, however, that the information disclosed does not include any data that could serve to identify specifically an individual patient and provided further that any individual whose data is disclosed for these purposes has provided written authorization for its use or is otherwise permitted by state or federal law.
Section 7. LIABILITY.--If an individual requests to exclude all of the individual's information from the record locator service pursuant to Subsection E of Section 6 of the Electronic Medical Records Act, the record locator service, health information exchange, health care institution or provider shall not be liable for any harm to the individual caused by the exclusion of the individual's information.
Section 8. OUT-OF-STATE DISCLOSURES.--A disclosure otherwise permissible under the Electronic Medical Records Act may be made to providers, health care group purchasers, health care institutions, health information exchanges or record locator services located or operating outside of the state.
Section 9. EXCLUSION OF CERTAIN INSURERS.--Nothing in the Electronic Medical Records Act shall be construed to apply to a person operating as a property and casualty insurer, workers' compensation insurer, life insurer, long-term care insurer or disability income insurer.
- 10 -