HOUSE BILL 389

57th legislature - STATE OF NEW MEXICO - first session, 2025

INTRODUCED BY

Elizabeth "Liz" Thomson and Debra M. Sariñana

AN ACT

RELATING TO HEALTH; AMENDING AND ENACTING SECTIONS OF THE ELECTRONIC MEDICAL RECORDS ACT TO REQUIRE THAT THE ENTITY DESIGNATED AS THE STATE'S HEALTH INFORMATION EXCHANGE SHALL ALSO FUNCTION AS THE STATE'S HEALTH DATA UTILITY.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF NEW MEXICO:

     SECTION 1. Section 24-14B-1 NMSA 1978 (being Laws 2009, Chapter 69, Section 1) is amended to read:

     "24-14B-1. SHORT TITLE.--[This act] Chapter 24, Article 14B NMSA 1978 may be cited as the "Electronic Medical Records Act"." 

     SECTION 2. Section 24-14B-3 NMSA 1978 (being Laws 2009, Chapter 69, Section 3) is amended to read:

     "24-14B-3. DEFINITIONS.--As used in the Electronic Medical Records Act:

          A. "demographic information" means information that identifies the individual who is the subject of the health care information, including the individual's name, date of birth and address and other information necessary to identify the individual, that may be used to identify the individual or that associates the individual with the individual's electronic medical record;

          B. "disclose" means to release, transfer, provide, give access to or otherwise divulge in any other manner information outside the entity holding the information;

          C. "electronic" means relating to technology having electrical, digital, magnetic, wireless, optical, electromagnetic or similar capabilities;

          D. "electronic medical record" means an electronic record of an individual patient's health care information that may contain demographic information;

          E. "electronic signature" means an electronic sound, symbol or process attached to or logically associated with a record and executed or adopted by an individual with the intent to sign the record;

          F. "health care" means care, services or supplies related to the health of an individual and includes:

                (1) preventive, diagnostic, therapeutic, rehabilitative, maintenance or palliative care and counseling;

                (2) services, assessments or procedures that are concerned with the physical or mental condition or functional status of an individual or that affect the structure or function of the body of an individual; and

                (3) the sale or dispensing of a drug, a device, a piece of equipment or other item in accordance with a prescription;

          G. "health care group purchaser" means a person who is licensed, certified or otherwise authorized or permitted by the New Mexico Insurance Code to pay for or purchase health care on behalf of an identified individual or group of individuals, regardless of whether the cost of coverage or services is paid for by the purchaser or the persons receiving coverage or services;

          H. "health care information" means any information, whether oral or recorded in any form or medium, related to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual;

          I. "health care institution" means an institution, facility or agency licensed, certified or otherwise authorized or permitted by law to provide health care in the ordinary course of business;

          J. "health data utility" means an entity that combines and shares disparate electronic health care information sets for purposes that include treatment, care coordination, quality improvement, population health, managing public health emergencies or other public and community health services;

          [J.] K. "health information exchange" means an [arrangement among persons participating in a defined secure electronic network service, such as a regional health information organization, that allows the sharing of health care information about individual patients among different health care institutions or unaffiliated providers. The use of an electronic medical record system by a health care provider, by or within a health care institution or by an organized health care arrangement as defined by the federal Health Insurance Portability and Accountability Act of 1996 does not constitute a health information exchange] entity that provides services to enable the electronic and secure sharing of health care information;

          [K.] L. "information" means data, including text, images, sounds and codes and computer programs, software and databases;

          [L.] M. "provider" means an individual who is licensed, certified or otherwise authorized or permitted by law to provide health care in the ordinary course of business or practice of a profession;

          [M.] N. "record" means information that is inscribed on a tangible medium or that is stored in an electronic or other medium and is retrievable in perceivable form;

          [N.] O. "record locator service" means an information service that contains demographic information and the location of health care information of a specified individual across different health care institutions or unaffiliated providers that participate in the service. The use of an electronic medical record system by a health care provider or by an organized health care arrangement as defined by the federal Health Insurance Portability and Accountability Act of 1996 does not constitute a record locator service; and

          [O.] P. "treatment" means the provision, coordination or management of health care and related services by one or more providers, including the coordination or management of health care by a provider with a third party; consultation between providers relating to an individual; or the referral of an individual for health care from one provider to another."

     SECTION 3. Section 24-14B-6 NMSA 1978 (being Laws 2009, Chapter 69, Section 6, as amended) is amended to read:

     "24-14B-6. USE AND DISCLOSURE OF ELECTRONIC HEALTH CARE INFORMATION.--

          A. A provider, health care institution, health information exchange, health data utility or health care group purchaser shall not use or disclose health care information in an individual's electronic medical record to another person without the consent of the individual except as allowed by state or federal law.

          B. A provider, health care institution or health care group purchaser may disclose demographic information and information about the location of an individual's electronic medical records to a record locator service in accordance with state or federal law. A provider or health care institution participating in a health information exchange or a health data utility using a record locator service shall not have access to demographic information, information about the location of the individual's electronic medical records or information in an individual's electronic medical record except in connection with the treatment of the individual or as permitted by the consent of the individual or as otherwise permitted by state or federal law.

          C. A record locator service shall maintain an audit log of persons obtaining access to information in the record locator service, which audit log shall contain, at a minimum, information on:

                (1) the identity of the person obtaining access to the information;

                (2) the identity of the individual whose information was obtained;

                (3) the location from which the information was obtained;

                (4) the specific information obtained; and

                (5) the date that the information was obtained.

          D. The audit log shall be made available by a health information exchange or a health data utility on the request of an individual whose health care information is the subject of the audit log; provided, however, that the audit log made available to the individual shall include only information related to that individual. The audit log shall be made available to the requesting individual annually for a fee not to exceed twenty-five cents ($.25) per page as established by the department of health.

          E. A record locator service shall provide a mechanism under which individuals may exclude their demographic information and information about the location of their electronic medical records from the record locator service. A person operating a record locator service, a health data utility or a health information exchange that receives an individual's request to exclude all of the individual's information from the record locator service is responsible for removing that information from the record locator service within thirty days. An individual's request for exclusion of information shall be in writing and shall include a waiver of liability for any harm caused by the exclusion of the individual's information.

          F. When information in an individual's electronic medical record is requested using a record locator service, a health data utility or a health information exchange:

                (1) the requesting provider or health care institution shall warrant that the request is for the treatment of the individual, is permitted by the individual's written authorization or is otherwise permitted by state or federal law; and

                (2) the person disclosing the information may rely upon the warranty of the person making the request that the request is for the treatment of the individual, is permitted with the consent of the individual or is otherwise permitted by state or federal law.

          G. Notwithstanding any other provision of law, information in an individual's electronic medical record may be disclosed:

                (1) to a provider that has a need for information about the individual to treat a condition that poses an immediate threat to the life of any individual and that requires immediate medical attention;

                (2) except as provided in the Electronic Medical Records Act, to a record locator service, a health data utility or a health information exchange for the development and operation of the record locator service, [and] the health data utility or the health information exchange; [and] or

                (3) to a provider, health care institution or health care group purchaser for treatment, payment or health care operation activities, in compliance with the federal Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated pursuant to that act, and if applicable, in compliance with 42 U.S.C. Section 290dd-2 and the regulations promulgated pursuant to that section.

          H. For the purposes of this section, "health care operation activities" includes administrative, financial, legal and quality improvement activities of a covered entity that are necessary to conduct business and to support the core functions of treatment and payment and are limited to the activities listed in the definition of "health care operations" at 45 C.F.R. 164.501."

     SECTION 4. Section 24-14B-7 NMSA 1978 (being Laws 2009, Chapter 69, Section 7) is amended to read:

     "24-14B-7. LIABILITY.--If an individual requests to exclude all of the individual's information from the record locator service pursuant to Subsection E of Section [6 of the Electronic Medical Records Act] 24-14B-6 NMSA 1978, the record locator service, health data utility, health information exchange, health care institution or provider shall not be liable for any harm to the individual caused by the exclusion of the individual's information."

     SECTION 5. Section 24-14B-8 NMSA 1978 (being Laws 2009, Chapter 69, Section 8) is amended to read:

     "24-14B-8. OUT-OF-STATE DISCLOSURES.--A disclosure otherwise permissible under the Electronic Medical Records Act may be made to providers, health care group purchasers, health care institutions, health data utilities, health information exchanges or record locator services located or operating outside of the state."

     SECTION 6. Section 24-14B-10 NMSA 1978 (being Laws 2009, Chapter 69, Section 10) is amended to read:

     "24-14B-10. STATE AGENCY--ELECTRONIC MEDICAL RECORDS.--If a state agency requires the use of electronic medical records for any type of health care or health coverage program, the agency shall allow a health care group purchaser, health care institution, health data utility, health information exchange, provider, record locator service or any other person to use any public, proprietary or open source hardware or software; provided that the hardware or software complies with federal interoperability-certified laws or rules."

     SECTION 7. A new section of the Electronic Medical Records Act is enacted to read:

     "[NEW MATERIAL] SELECTION OF STATE HEALTH DATA UTILITY.--

The entity designated as the state's health information exchange shall also function as the state's health data utility."

- 11 -