SENATE FLOOR SUBSTITUTE FOR

SENATE BILL 278

49th legislature - STATE OF NEW MEXICO - first session, 2009

AN ACT

CREATING THE ELECTRONIC MEDICAL RECORDS ACT; ALLOWING THE CREATION, MAINTENANCE AND USE OF ELECTRONIC MEDICAL RECORDS; CLARIFYING INDIVIDUAL RIGHTS WITH RESPECT TO THE DISCLOSURE OF INFORMATION CONTAINED IN ELECTRONIC MEDICAL RECORDS; CLARIFYING THE PROTECTION OF PRIVACY OF ELECTRONIC MEDICAL RECORDS.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF NEW MEXICO:

     Section 1. SHORT TITLE.--This act may be cited as the "Electronic Medical Records Act".

      Section 2. PURPOSE.--The purpose of the Electronic Medical Records Act is to provide for the use, disclosure and protection of electronic medical records.

     Section 3. DEFINITIONS.--As used in the Electronic Medical Records Act:

          A. "demographic information" means information that identifies the individual who is the subject of the health care information, including the individual's name, date of birth and address and other information that identifies the individual, that may be used to identify the individual or that associates the individual with the individual's electronic medical record;

          B. "disclose" means to release, transfer, provide, give access to or otherwise divulge in any other manner information outside the entity holding the information;

          C. "electronic" means relating to technology having electrical, digital, magnetic, wireless, optical, electromagnetic or similar capabilities;

          D. "electronic medical record" means an electronic record of an individual patient's health care information that may contain demographic information;

          E. "electronic signature" means an electronic sound, symbol or process attached to or logically associated with a record and executed or adopted by an individual with the intent to sign the record;

          F. "health care" means care, services or supplies related to the health of an individual and includes:

                (1) preventive, diagnostic, therapeutic, rehabilitative, maintenance or palliative care and counseling;

                (2) services, assessments or procedures that are concerned with the physical or mental condition or functional status of an individual or that affect the structure or function of the body of an individual; and

                (3) the sale or dispensing of a drug, a device, a piece of equipment or other item in accordance with a prescription;

          G. "health care group purchaser" means a person who is licensed, certified or otherwise authorized or permitted by the New Mexico Insurance Code to pay for or purchase health care on behalf of an identified individual or group of individuals, regardless of whether the cost of coverage or services is paid for by the purchaser or the persons receiving coverage or services;

          H. "health care information" means any information, whether oral or recorded in any form or medium, related to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual;

          I. "health care institution" means an institution, facility or agency licensed, certified or otherwise authorized or permitted by law to provide health care in the ordinary course of business;

          J. "health information exchange" means an arrangement among persons participating in a defined secure electronic network service, such as a regional health information organization, that allows the sharing of health care information about individual patients among different health care institutions or unaffiliated providers. The use of an electronic medical record system by a health care provider, by or within a health care institution or by an organized health care arrangement as defined by the federal Health Insurance Portability and Accountability Act of 1996 does not constitute a health information exchange;

          K. "information" means data, including text, images, sounds and codes and computer programs, software and databases;

          L. "provider" means an individual who is licensed, certified or otherwise authorized or permitted by law to provide health care in the ordinary course of business or practice of a profession;

          M. "record" means information that is inscribed on a tangible medium or that is stored in an electronic or other medium and is retrievable in perceivable form;

          N. "record locator service" means an information service that contains demographic information and the location of health care information of a specified individual across different health care institutions or unaffiliated providers that participate in the service. The use of an electronic medical record system by a health care provider or by an organized health care arrangement as defined by the federal Health Insurance Portability and Accountability Act of 1996 does not constitute a record locator service; and

          O. "treatment" means the provision, coordination or management of health care and related services by one or more providers, including the coordination or management of health care by a provider with a third party; consultation between providers relating to an individual; or the referral of an individual for health care from one provider to another.

     Section 4. ELECTRONIC MEDICAL RECORDS--ELECTRONIC SIGNATURES--LEGAL RECOGNITION.--If a law or rule requires a medical record to be in writing, or if a law or rule requires a signature pertaining to a medical record, an electronic medical record or an electronic signature satisfies that law or rule, except for a court rule.

     Section 5. RETENTION OF ELECTRONIC MEDICAL RECORDS.--

          A. If a law or rule requires that a medical record be retained, the requirement is satisfied by retaining an electronic record that:

                (1) accurately reflects the medical record; and

                (2) remains accessible and is capable of being accurately reproduced for later reference.

          B. If a law or rule requires a medical record to be presented or retained in its original form or provides consequences if the medical record is not presented or retained in its original form, that law or rule is satisfied by an electronic medical record retained in accordance with Subsection A of this section.

          C. A medical record retained as an electronic medical record in accordance with Subsection A of this section satisfies a law or rule requiring a person to retain a medical record for evidentiary, audit or other purposes.

     Section 6. USE AND DISCLOSURE OF ELECTRONIC HEALTH CARE INFORMATION.--

          A. A provider, health care institution, health information exchange or health care group purchaser shall not use or disclose health care information in an individual's electronic medical record to another person in violation of state or federal law and without the consent of the individual.

          B. A provider, health care institution or health care group purchaser may disclose demographic information and information about the location of an individual's electronic medical records to a record locator service in accordance with state or federal law. A provider or health care institution participating in a health information exchange using a record locator service shall not have access to demographic information, information about the location of the individual's electronic medical records or information in an individual's electronic medical record except in connection with the treatment of the individual or as permitted by the consent of the individual or as otherwise permitted by state or federal law.

          C. A record locator service shall maintain an audit log of persons obtaining access to information in the record locator service, which audit log shall contain, at a minimum, information on:

                (1) the identity of the person obtaining access to the information;

                (2) the identity of the individual whose information was obtained;

                (3) the location from which the information was obtained;

                (4) the specific information obtained; and

                (5) the date that the information was obtained.

          D. The audit log shall be made available by a health information exchange on the request of an individual whose health care information is the subject of the audit log; provided, however, that the audit log made available to the individual shall include only information related to that individual. The audit log shall be made available to the requesting individual annually for a fee not to exceed twenty-five cents ($.25) per page as established by the department of health.

          E. A record locator service shall provide a mechanism under which individuals may exclude their demographic information and information about the location of their electronic medical records from the record locator service. A person operating a record locator service or a health information exchange that receives an individual's request to exclude all of the individual's information from the record locator service is responsible for removing that information from the record locator service within thirty days. An individual's request for exclusion of information shall be in writing and shall include a waiver of liability for any harm caused by the exclusion of the individual's information.

          F. When information in an individual's electronic medical record is requested using a record locator service or a health information exchange:

                (1) the requesting provider or health care institution shall warrant that the request is for the treatment of the individual, is permitted by the individual's written authorization or is otherwise permitted by state or federal law; and

                (2) the person disclosing the information may rely upon the warranty of the person making the request that the request is for the treatment of the individual, is permitted with the consent of the individual or is otherwise permitted by state or federal law.

          G. Notwithstanding any other provision of law, information in an individual's electronic medical record may be disclosed:

                (1) to a provider that has a need for information about the individual to treat a condition that poses an immediate threat to the life of any individual and that requires immediate medical attention; and

                (2) except as provided in the Electronic Medical Records Act, to a record locator service or a health information exchange for the development and operation of the record locator service and the health information exchange.

     Section 7. LIABILITY.--If an individual requests to exclude all of the individual's information from the record locator service pursuant to Subsection E of Section 6 of the Electronic Medical Records Act, the record locator service, health information exchange, health care institution or provider shall not be liable for any harm to the individual caused by the exclusion of the individual's information.

     Section 8. OUT-OF-STATE DISCLOSURES.--A disclosure otherwise permissible under the Electronic Medical Records Act may be made to providers, health care group purchasers, health care institutions, health information exchanges or record locator services located or operating outside of the state.

     Section 9. EXCLUSION OF CERTAIN INSURERS.--Nothing in the Electronic Medical Records Act shall be construed to apply to a person operating as a property and casualty insurer, workers' compensation insurer, life insurer, long-term care insurer or disability income insurer.

- 10 -