sb0202jus

SENATE JUDICIARY COMMITTEE SUBSTITUTE FOR

SENATE BILL 202

54th legislature - STATE OF NEW MEXICO - first session, 2019

AN ACT

RELATING TO SOCIAL SERVICES; ENACTING THE CHILD AND FAMILY DATABANK ACT; PROVIDING FOR DATA SHARING AMONG STATE AGENCIES TO FACILITATE PROGRAM EVALUATION AND DEVELOP EVIDENCE-BASED POLICY; DEVELOPING A GOVERNANCE INFRASTRUCTURE TO ESTABLISH GUIDELINES FOR ACCESS, USE, STORAGE AND SHARING OF DATA; CREATING THE CHILD AND FAMILY DATABANK COMMISSION; AMENDING SECTIONS OF THE CHILDREN'S MENTAL HEALTH AND DEVELOPMENTAL DISABILITIES ACT AND THE MENTAL HEALTH AND DEVELOPMENTAL DISABILITIES CODE TO PROVIDE FOR DISCLOSURES; PROVIDING A PENALTY; MAKING AN APPROPRIATION.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF NEW MEXICO:

SECTION 1. [NEW MATERIAL] SHORT TITLE.--Sections 1 through 12 of this act may be cited as the "Child and Family Databank Act".

SECTION 2. [NEW MATERIAL] DEFINITIONS.--As used in the Child and Family Databank Act:

A. "administrative data" or "data" means information that a government agency or an organization collects for administrative purposes, usually during the delivery of a service;

B. "agency" means a governmental or quasi-governmental entity that collects, transmits or stores data relevant to the work of the commission;

C. "anonymized data" means information that does not identify an individual and for which there is no reasonable basis to believe could be used to identify an individual even when combined with other separate pieces of information;

D. "commission" means the child and family databank commission;

E. "commissioner" means a person who serves on the commission;

F. "databank" means a system for collecting, storing and using administrative data;

G. "databank host" means an entity that employs a method or device used to store data and provide networking capabilities;

H. "identifying data" means data that identify an individual or for which there is a reasonable basis to believe could be used to identify an individual;

I. "institutional review board" means a board, committee or other group that:

(1) is formally designated by an institution to approve research involving human subjects and to conduct periodic review of the research to ensure the protection of the rights and welfare of the human subjects but not to review a clinical trial for scientific merit;

(2) is a nonpartisan entity; and

(3) has been approved by the national institutes of health;

J. "multi-system" means an individual or family who is involved, as a client, participant, recipient of services or other affected party, with more than one state or federal social program, including child welfare, income support, corrections, health care and similar programs; and

K. "researcher" means an individual or entity that requests to use or access information in the databank.

SECTION 3. [NEW MATERIAL] CHILD AND FAMILY DATABANK COMMISSION--CREATION--APPOINTMENT--MEMBERSHIP.--

A. The "child and family databank commission" is created as a nonpartisan commission administratively attached to the department of health and consists of fifteen members as follows:

(1) the secretary of human services or the secretary's designee;

(2) the secretary of health or the secretary's designee;

(3) the secretary of public education or the secretary's designee;

(4) the secretary of children, youth and families or the secretary's designee;

(5) the secretary of aging and long-term services or the secretary's designee;

(6) the secretary of information technology or the secretary's designee;

(7) one representative who is a member of the New Mexico sentencing commission, appointed by the New Mexico sentencing commission;

(8) four members of the general public, appointed by the New Mexico legislative council, as follows:

(a) an individual with experience in human subjects research and a demonstrated understanding of the ethical considerations in that research who is affiliated with a research university located in the state;

(b) an individual with technical expertise and experience in the creation, design and maintenance of large data systems and data security;

(d) an individual from a nonprofit nonpartisan organization that focuses solely on legal and public policy on behalf of children and families;

(9) two members, appointed by the speaker of the house of representatives, who represent organizations that provide services in the state directly to multi-system children or families; and

(10) two members, appointed by the president pro tempore of the senate, who represent organizations that provide services in the state directly to multi-system children or families.

B. A member of the commission shall not simultaneously serve as a commissioner and as an employee of, or a contractor to, the commission.

C. Appointed commissioners shall serve for staggered three-year terms. Designated members shall serve for the duration of the designating official's tenure in office. Of the eight commissioners named in Paragraphs (8) through (10) of Subsection A of this section who are initially appointed to the board, four shall serve for a term of three years, three shall serve for a term of two years and one shall serve for a term of one year. At the first meeting of the commission, the commissioners shall determine by lot who shall serve three-, two- and one-year terms. Following the expiration of the initial terms, appointments shall be for terms of three years.

D. The governor shall call the initial meeting of the commission by September 1, 2019. At that meeting, the commissioners shall appoint a chair and a vice chair, each of whom shall serve for two-year terms, unless removed sooner by a vote of two-thirds of the commission. After the first meeting of the commission, the commission shall meet at least quarterly at the call of the chair.

E. An appointed commissioner may be removed by a vote of two-thirds of the commission.

F. A vacancy that occurs in the commission shall be filled in the same manner as the original appointment. An appointment to fill a vacancy shall be made only for the unexpired portion of the vacated term.

G. Members of the commission may receive per diem and reimbursement for mileage for work related to the commission in accordance with the Per Diem and Mileage Act and shall receive no other compensation, perquisite or allowance for their service on the commission.

SECTION 4. [NEW MATERIAL] POWERS AND DUTIES OF COMMISSION.--

A. The commission shall:

(1) promulgate rules to carry out its duties provided in the Child and Family Databank Act;

(2) ensure that data are received by the databank from each agency required to provide data for research, analysis and policy development related to addressing the needs of multi-system individuals or families;

(3) ensure that identifying data in the databank is stored and used in accordance with all applicable privacy and security laws and standards;

(4) contract with agencies to define and manage the process by which data are shared between agencies and the commission and to address relevant legal and privacy concerns of the commission and the agencies;

(5) define and manage the governance process by which a researcher or an agency may access and use data for research, while ensuring compliance with all applicable privacy and security laws and standards, adherence to an institutional review board process and the requirements of the commission's committee on ethical use of data, as provided for in Paragraph (8) of this subsection;

(6) ensure that the commission staff performs evaluation and analysis of data in the databank and provides support and assistance to agencies in the agencies' evaluation and analysis of data, which evaluation and analysis shall include a focus on:

(a) identifying and understanding risk and protective factors of families that are most vulnerable to experiencing housing, health, nutrition, financial and other hardships;

(b) evaluating existing programs and developing evidence-based programs and policies to address issues related to the safety, health and well-being of the state's children and families;

(d) developing a strategic plan or research agenda to identify and address questions related to programs, policies and rules of agencies;

(7) publish the results of any analysis or evaluation completed by commission staff, as well as summaries of reports and analyses conducted by researchers using data from the databank;

(8) establish a committee of the commission to address ethics and privacy issues related to data and the databank and any additional committees necessary for the work of the commission; and

(9) establish and maintain a publicly accessible website that includes access to:

(a) the commission's rules, meeting dates and meeting times;

(b) reports of research conducted by the commission staff; and

B. The commission may charge reasonable fees for:

(1) creating specialized or customized reports of information in the databank;

(2) assisting in the development of a research proposal;

(3) conducting a portion of data analysis for a researcher;

(4) producing anonymized data from data that include identifying data before providing data to a researcher; and

(5) preparing or publishing data to improve its utility in analysis.

C. An entity that is required to provide data to the databank shall not be charged any of the fees provided for in Subsection B of this section.

SECTION 5. [NEW MATERIAL] COMMISSION--EXECUTIVE DIRECTOR--STAFF.--

A. By October 1, 2019, the commission shall hire an executive director. The executive director shall have:

(1) a demonstrated competency in research and program analysis;

(2) a demonstrated breadth of knowledge on the social systems and programs that will be the subject of data in the databank;

(3) the knowledge and expertise to lead the work of the commission;

(4) a demonstrated familiarity with electronic systems used to collect, store and provide output of data received from multiple sources;

(5) extensive management experience; and

(6) an in-depth understanding of research and analysis using administrative data.

B. The executive director, with the commission's authorization, shall hire staff as necessary to carry out the commission's duties, including staff that possess the following skills:

(1) experience and understanding of:

(a) integration and organization of varied data;

(b) communication of complex technical concepts to diverse audiences; and

(2) technical expertise to:

(a) support data integration; and

(b) assist researchers and analysts in obtaining the appropriate data to meet needs;

(3) experience in creating and maintaining large data systems, preparing or publishing data to improve its utility in analysis and data security;

(4) legal expertise related to:

(a) drafting and negotiating data-sharing agreements;

(b) the historical, cultural and ethical implications surrounding data use; and

(5) the ability to conduct qualitative and quantitative research and support; and

(6) the ability to assist in evaluating agency programming and developing evidence-based policy.

SECTION 6. [NEW MATERIAL] AGENCY CONTRACTS AND DATA SHARING.--

A. Absent a specific legal prohibition to the contrary and in accordance with contractual agreements with the commission, the following agencies shall share all available data with the databank that relates to the needs of multi-system individuals and families:

(1) the department of health;

(2) the human services department;

(3) the children, youth and families department;

(4) the public education department;

(5) the corrections department;

(6) the aging and long-term services department; and

(7) the New Mexico sentencing commission.

B. An agency shall cooperate with the commission in the drafting and execution of its contractual agreement with the commission. The contractual agreement between an agency and the commission shall be executed by September 1, 2020 and shall specify, at a minimum:

(1) the confidentiality of the agency's client data;

(2) the conditions for or restrictions on the release and use of data so as to comply with all applicable state and federal laws; and

(3) security measures to be taken to protect the confidentiality of the data.

C. At a minimum, the department of health shall share the following data with the databank:

(1) demographics relating to individuals to whom the department provides services and to public health measures that the department collects;

(2) vital records and statistics, including birth and death information;

(3) inpatient hospital discharge data, including emergency department usage;

(4) emergency department usage;

(5) emergency medical services data;

(6) environmental health and injury data; and

(7) family, infant, toddler program participation information.

D. At a minimum, the human services department shall share the following data with the databank:

(1) demographics relating to recipients of medical assistance;

(2) medicaid data, including both fee-for-service and managed care organization data and children's health insurance program claims data; and

(3) data from the following programs:

(a) the supplemental nutrition assistance program;

(b) cash assistance programs;

(d) child support enforcement; and

(e) behavioral health services.

E. The public education department shall share with the databank data regarding students and public schools in the state, including the following:

(1) student attendance;

(2) student demographics;

(3) graduation rates;

(4) student achievement, including proficiencies in math, reading and science;

(5) teachers' training and qualifications;

(6) course offerings;

(7) post-secondary education; and

(8) other information relevant to the well-being of children and families in the state.

F. The children, youth and families department shall share all federally reported data with the databank, as well as any other relevant data, from the following programs and areas:

(1) demographics on families and individuals to whom the department provides services or intervention;

(2) juvenile justice;

(3) behavioral health services;

(4) early childhood services, including pre-kindergarten, home visiting, daycare, family nutrition and head start; and

(5) the protective services division, including:

(a) foster care;

(b) adoptions;

(d) permanency planning; and

(e) youth services.

G. The corrections department shall share state-level corrections data with the databank, including information relating to:

(1) inmate and parolee demographics;

(2) offender intake and sentencing;

(3) probation and parole;

(4) community reentry and integration; and

(5) recidivism rates and information on how the rates were determined.

H. The New Mexico sentencing commission shall share with the databank data it collects and analyzes under agreements with other state agencies.

I. The aging and long-term services department shall share any data collected by the department related to kinship care programs with the databank.

J. In addition to the agencies and programs listed in Subsections C through I of this section, other agencies that the commission identifies as having data that are relevant to the well-being of children and families in the state shall share their data with the databank, to the extent legally permissible and upon execution of a contractual agreement as provided in this section. These data shall include demographic information.

K. The data shared by an agency as required in Subsection A of this section shall include historical administrative data created based on an individual interaction with a person, a claim made by a person or another incident or event that was documented for recordkeeping. Historical data shall include data that were created as far in the past as is practicable for the agency to share and shall include at least the previous five years' data, unless the data are unavailable.

L. Agencies shall provide their data to the commission in the formats and on the schedules determined by the commission's rule but, in any event, no less frequently than annually.

M. Agencies shall cooperate with the commission and other agencies in the evaluation of programs and policy development and for the purpose of cross-sector collaboration in the provision of services to children and families statewide.

SECTION 7. [NEW MATERIAL] DATABANK POLICY OFFICER.--

A. The contractual agreements between the commission and the department of health, human services department, public education department and children, youth and families department shall each provide for a databank policy officer within each department, and that position shall be funded by the commission.

B. A databank policy officer shall:

(1) coordinate and liaise with the commission;

(2) assist with the identification of data sets to share with the databank; and

(3) coordinate with the commission and the databank host to transmit and share data, assist agencies in identifying priority programs and policies for analysis and work within the agency and with the commission to identify and implement areas of cross-sector collaboration and improved delivery of services.

SECTION 8. [NEW MATERIAL] DATABANK HOST--DUTIES.--

A. The commission shall enter into a contractual operating agreement with a databank host.

B. The databank host shall:

(1) cooperate with the commission in the expeditious negotiation and execution of the contractual operating agreement;

(2) provide access to data in response to research requests; and

(3) at least annually, ensure that the databank is updated with new data received from agencies.

SECTION 9. [NEW MATERIAL] PUBLICATION OF RESEARCH SUMMARIES.--

A. The commission shall require that a researcher that uses databank data provide the commission with a summary of the researcher's findings for publication by the commission.

B. An agency shall not prevent publication of a summary because the agency disagrees with a researcher's findings or conclusions.

SECTION 10. [NEW MATERIAL] DATA OWNERSHIP.-- Notwithstanding the data sharing requirements set forth in the Child and Family Databank Act, an agency that shares data shall retain ownership of its original data set.

SECTION 11. [NEW MATERIAL] COMPLIANCE WITH OTHER LAWS.--If the disclosure of data to the commission is specifically prohibited by state or federal law, an agency shall work with the commission to identify any ways in which data could be edited, redacted or otherwise protected to allow the data to be provided to the commission in compliance with state and federal law.

SECTION 12. [NEW MATERIAL] REDISCLOSURE OF INFORMATION.--Neither the commission nor the databank host shall disclose information released to the databank in violation of state or federal law. A person who violates this section is guilty of a misdemeanor and shall be sentenced in accordance with Section 31-19-1 NMSA 1978.

SECTION 13. Section 32A-6A-24 NMSA 1978 (being Laws 2007, Chapter 162, Section 24, as amended) is amended to read:

"32A-6A-24. DISCLOSURE OF INFORMATION.--

A. Except as otherwise provided in the Children's Mental Health and Developmental Disabilities Act, a person shall not, without the authorization of the child, disclose or transmit any confidential information from which a person well-acquainted with the child might recognize the child as the described person or any code, number or other means that could be used to match the child with confidential information regarding the child.

B. When the child is under fourteen years of age, the child's legal custodian is authorized to consent to disclosure on behalf of the child. Information shall also be disclosed to a court-appointed guardian ad litem without consent of the child or the child's legal custodian.

C. A child fourteen years of age or older with capacity to consent to disclosure of confidential information shall have the right to consent to disclosure of mental health and habilitation records. A legal custodian who is authorized to make health care decisions for a child has the same rights as the child to request, receive, examine, copy and consent to the disclosure of medical or other health care information when evidence exists that such a child whose consent to disclosure of confidential information is sought does not have capacity to give or withhold valid consent and does not have a treatment guardian appointed by a court. If the legal custodian is not authorized to make decisions for a child under the Children's Mental Health and Developmental Disabilities Act, the person seeking authorization shall petition the court for the appointment of a treatment guardian to make a decision for such a child.

D. Authorization from the child or legal custodian for a child less than fourteen years of age shall not be required for the disclosure or transmission of confidential information when the disclosure or transmission:

(1) is necessary for treatment of the child and is made in response to a request from a clinician;

(2) is necessary to protect against a clear and substantial risk of imminent serious physical injury or death inflicted by the child on self or another;

(3) is determined by a clinician not to cause substantial harm to the child and a summary of the child's assessment, treatment plan, progress, discharge plan and other information essential to the child's treatment is made to a child's legal custodian or guardian ad litem;

(4) is to the primary caregiver of the child and the information disclosed was necessary for the continuity of the child's treatment in the judgment of the treating clinician who discloses the information;

(5) is to an insurer contractually obligated to pay part or all of the expenses relating to the treatment of the child at the residential facility. The information disclosed shall be limited to data identifying the child, facility and treating or supervising physician and the dates and duration of the residential treatment. It shall not be a defense to an insurer's obligation to pay that the information relating to the residential treatment of the child, apart from information disclosed pursuant to this section, has not been disclosed to the insurer;

(6) is to a protection and advocacy representative pursuant to the federal Developmental Disabilities Assistance and Bill of Rights Act and the federal Protection and Advocacy for Individuals with Mental Illness Act; [or]

(7) is pursuant to a court order issued for good cause shown after notice to the child and the child's legal custodian and opportunity to be heard is given. Before issuing an order requiring disclosure, the court shall find that:

(a) other ways of obtaining the information are not available or would not be effective; and

(b) the need for the disclosure outweighs the potential injury to the child, the clinician-child relationship and treatment services; or

(8) is made to a governmental agency, its agent or a state education institution, a duly organized state or county association of licensed physicians or dentists, a licensed health facility or staff committee of a licensed health facility, for the purpose of research, subject to the provisions of Section 14-6-1 NMSA 1978 and subject to the review of an institutional review board in compliance with the federal Health Insurance Portability and Accountability Act of 1996 or any succeeding legislation.

E. A disclosure ordered by the court shall be limited to the information that is essential to carry out the purpose of the disclosure. Disclosure shall be limited to those persons whose need for the information forms the basis for the order. An order by the court shall include such other measures as are necessary to limit disclosure for the protection of the child, including sealing from public scrutiny the record of a proceeding for which disclosure of a child's record has been ordered.

F. An authorization given for the transmission or disclosure of confidential information shall not be effective unless it:

(1) is in writing and signed; and

(2) contains a statement of the child's right to examine and copy the information to be disclosed, the name or title of the proposed recipient of the information and a description of the use that may be made of the information.

G. The child has a right of access to confidential information about the child and has the right to make copies of information about the child and submit clarifying or correcting statements and other documentation of reasonable length for inclusion with the confidential information. The statements and other documentation shall be kept with the relevant confidential information, shall accompany it in the event of disclosure and shall be governed by the provisions of this section to the extent the statements or other documentation contain confidential information. Nothing in this subsection shall prohibit the denial of access to the records when a physician or other mental health or developmental disabilities professional believes and notes in the child's medical records that the disclosure would not be in the best interests of the child. In all cases, the child has the right to petition the court for an order granting access.

H. Information concerning a child disclosed under this section shall not be released to any other person, agency or governmental entity or placed in files or computerized data banks accessible to any persons not otherwise authorized to obtain information under this section. Notwithstanding the confidentiality provisions of the Delinquency Act and the Abuse and Neglect Act, information disclosed under this section shall not be re-released without the express consent of the child or legal custodian authorized under the Children's Mental Health and Developmental Disabilities Act to give consent and any other consent necessary for redisclosure in conformance with state and federal law, including consent that may be required from the professional or the facility that created the document.

I. Nothing in the Children's Mental Health and Developmental Disabilities Act shall limit the confidentiality rights afforded by federal statute or regulation.

J. The department shall promulgate rules for implementing disclosure of records pursuant to this section and in compliance with state and federal law and the Children's Court Rules."

SECTION 14. Section 43-1-19 NMSA 1978 (being Laws 1977, Chapter 279, Section 18, as amended) is amended to read:

"43-1-19. DISCLOSURE OF INFORMATION.--

A. Except as otherwise provided in the code, no person shall, without the authorization of the client, disclose or transmit any confidential information from which a person well acquainted with the client might recognize the client as the described person, or any code, number or other means that can be used to match the client with confidential information regarding the client.

B. Authorization from the client shall not be required for the disclosure or transmission of confidential information in the following circumstances:

(1) when the request is from a mental health or developmental disability professional or from an employee or trainee working with a person with a mental disability or developmental disability, to the extent that the practice, employment or training on behalf of the client requires access to such information is necessary;

(2) when such disclosure is necessary to protect against a clear and substantial risk of imminent serious physical injury or death inflicted by the client on the client's self or another;

(3) when the disclosure is made pursuant to the provisions of the Assisted Outpatient Treatment Act, using reasonable efforts to limit protected health information to that which is minimally necessary to accomplish the intended purpose of the use, disclosure or request;

(4) when the disclosure of such information is to the primary caregiver of the client and the disclosure is only of information necessary for the continuity of the client's treatment in the judgment of the treating physician or certified psychologist who discloses the information; [or]

(5) when such disclosure is to an insurer contractually obligated to pay part or all of the expenses relating to the treatment of the client at the residential facility. The information disclosed shall be limited to data identifying the client, facility and treating or supervising physician and the dates and duration of the residential treatment. It shall not be a defense to an insurer's obligation to pay that the information relating to the residential treatment of the client, apart from information disclosed pursuant to this section, has not been disclosed to the insurer; or

(6) when the disclosure is made to a governmental agency, its agent or a state educational institution, a duly organized state or county association of licensed physicians or dentists, a licensed health facility or staff committees of such a facility for the purpose of research, subject to the provisions of Section 14-6-1 NMSA 1978 and subject to the review of an institutional review board in compliance with the federal Health Insurance Portability and Accountability Act of 1996 or any succeeding legislation.

C. No authorization given for the transmission or disclosure of confidential information shall be effective unless it:

(1) is in writing and signed; and

(2) contains a statement of the client's right to examine and copy the information to be disclosed, the name or title of the proposed recipient of the information and a description of the use that may be made of the information.

D. The client has a right of access to confidential information and has the right to make copies of any information and to submit clarifying or correcting statements and other documentation of reasonable length for inclusion with the confidential information. The statements and other documentation shall be kept with the relevant confidential information, shall accompany it in the event of disclosure and shall be governed by the provisions of this section to the extent they contain confidential information. Nothing in this subsection shall prohibit the denial of access to such records when a physician or other mental health or developmental disabilities professional believes and notes in the client's medical records that such disclosure would not be in the best interests of the client. In any such case, the client has the right to petition the court for an order granting such access.

E. Where there exists evidence that the client whose consent to disclosure of confidential information is sought is incapable of giving or withholding valid consent and the client does not have a guardian or treatment guardian appointed by a court, the person seeking such authorization shall petition the court for the appointment of a treatment guardian to make a substitute decision for the client, except that if the client is less than fourteen years of age, the client's parent or guardian is authorized to consent to disclosure on behalf of the client.

F. Information concerning a client disclosed under this section shall not be released to any other person, agency or governmental entity or placed in files or computerized [data banks] databanks accessible to any persons not otherwise authorized to obtain information under this section.

G. Nothing in the code shall limit the confidentiality rights afforded by federal statute or regulation.

H. A person appointed as a treatment guardian in accordance with the [Mental Health and Developmental Disabilities] code may act as the client's personal representative pursuant to the federal Health Insurance Portability and Accountability Act of 1996, Sections 1171-1179 of the Social Security Act, 42 U.S.C. Section 1320d, as amended, and applicable federal regulations to obtain access to the client's protected health information, including mental health information and relevant physical health information, and may communicate with the client's health care providers in furtherance of such treatment."

SECTION 15. APPROPRIATION.--Three million seven hundred thirty-eight thousand dollars ($3,738,000) is appropriated from the general fund to the department of health for expenditure in fiscal year 2020 and subsequent fiscal years to establish a child and family databank commission and a child and family databank and to implement the provisions of the Child and Family Databank Act. Any unexpended or unencumbered balance remaining at the end of a fiscal year shall not revert to the general fund.

- 28 -