SENATE BILL 463
57th legislature - STATE OF NEW MEXICO - first session, 2025
INTRODUCED BY
Martin Hickey
AN ACT
RELATING TO HEALTH; AMENDING THE DEFINITION OF "RECORD-LEVEL DATA" IN THE HEALTH INFORMATION SYSTEM ACT; ALLOWING THE STAFF OF THE LEGISLATIVE FINANCE COMMITTEE TO ACCESS INFORMATION AND DATA THAT ARE RELATED TO PAYER SOURCES.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF NEW MEXICO:
SECTION 1. Section 24-14A-2 NMSA 1978 (being Laws 1989, Chapter 29, Section 2, as amended) is amended to read:
"24-14A-2. DEFINITIONS.--As used in the Health Information System Act:
A. "aggregate data" means data that are obtained by combining like data elements in a manner that precludes specific identification of a single client;
B. "data source" or "data provider" means a person that possesses health information, including the health care authority, any public or private sector licensed health care practitioner, primary care clinic, ambulatory surgery center, ambulatory urgent care center, ambulatory dialysis unit, home health agency, long-term care facility, hospital, pharmacy, third-party payer and any public entity that has health information;
C. "department" means the department of health;
D. "health information" or "health data" means any data relating to health care; health status, including environmental, social and economic factors; the health system; or health costs and financing;
E. "hospital" means any general or special hospital licensed by the health care authority, whether publicly or privately owned;
F. "long-term care facility" means any skilled nursing facility or nursing facility licensed by the health care authority, whether publicly or privately owned;
G. "record-level data" means a medical record that contains unique [and nonaggregated data elements that relate to a single identifiable individual] identifying data, including a name, personal address, personal phone number, social security number, patient record or other unique identifying data that could be used to identify a specific person; and
H. "third-party payer" means any public or private payer of health care services and includes health maintenance organizations and health insurers."
SECTION 2. Section 24-14A-6 NMSA 1978 (being Laws 1989, Chapter 29, Section 6, as amended) is amended to read:
"24-14A-6. HEALTH INFORMATION SYSTEM--ACCESS.--
A. Access to data in the health information system shall be provided in accordance with rules adopted by the department pursuant to the Health Information System Act.
B. A data provider may obtain data it has submitted to the system, as well as aggregate data, but, except as provided in Subsection [D] E of this section, it shall not have access to data submitted by another provider that are limited only to that provider unless those data are aggregated data and publicly disseminated by the department. Except as provided in Subsection [D] E of this section, in no event may a data provider obtain data regarding an individual patient except in instances where the data were originally submitted by the requesting provider. Prior to the release of any data, in any form, data sources shall be permitted the opportunity to verify the accuracy of the data pertaining to that data source. Data identified in writing as inaccurate shall be corrected prior to the data's release. Time limits shall be set for the submission and review of data by data sources, and penalties shall be established for failure to submit and review the data within the established time.
C. Any person may obtain any aggregate data publicly disseminated by the department.
D. Health care claims information and data that are related to payer sources shall be provided to the staff of the legislative finance committee, as long as the information or data does not reveal the personal information of any patient that is included in the information or the data.
[D.] E. Through a secure delivery or transmission process, the department may share record-level data with the health care authority or a federal agency that is authorized to collect, analyze or disseminate health information. The department shall remove identifiable individual or provider information from the record-level data prior to its disclosure to the federal agency. In providing hospital information under an agreement or arrangement with a federal agency, the department shall ensure that any identifiable hospital information disclosed is necessary for the agency's authorized use and that its disclosure meets with state and federal privacy and confidentiality laws, rules and regulations."
SECTION 3. Section 24-14A-8 NMSA 1978 (being Laws 1989, Chapter 29, Section 8, as amended) is amended to read:
"24-14A-8. HEALTH INFORMATION SYSTEM--CONFIDENTIALITY.--
A. Health information collected and disseminated pursuant to the Health Information System Act is strictly confidential and shall not be a matter of public record or accessible to the public except as provided in this section and Sections 24-14A-6 and 24-14A-7 NMSA 1978. No data source shall be liable for damages to any person for having furnished the information to the department.
B. Record-level data provided to the department pursuant to Section 24-14A-6 NMSA 1978 are confidential. The agency that receives record-level data shall not disclose the data except to the extent that they are included in a compilation of aggregate data.
C. Health care claims information and data that are related to payer sources that are provided to the staff of the legislative finance committee shall have all confidential record-level data removed, including identifiable patient information, and the department shall replace the confidential record-level data with a unique code to identify each unique patient.
[C.] D. The individual forms, electronic information or other forms of data collected by and furnished for the health information system shall not be public records subject to inspection pursuant to Section 14-2-1 NMSA 1978. The department may release or disseminate aggregate data, including those data that pertain to a specifically identified hospital or other type of health facility. These data shall be public records if the release of these data does not violate state or federal law relating to the privacy and confidentiality of individually identifiable health information."
- 6 -