N.M. Admin. Code § 8.300.2.11

Current through Register Vol. 36, No. 1, January 14, 2025

Section 8.300.2.11 - RECIPIENT'S RIGHTS

HCA shall establish policies protecting a recipient's rights regarding HIPAA privacy practices.

A. Alternate means of communication: A recipient or their personal representative shall have the right to request an alternate means of communication and an alternative address to receive communications of protected health information (PHI) from the HCC. The HCC shall accommodate such requests when reasonable 45CFR 164.522(b).

(1) If the recipient or their personal representative is unable to write the request, the recipient or their personal representative may request assistance from the HCC. If assistance is provided, the HCC shall document that the assistance was given, have the recipient or their personal representative sign and date the document, co-sign and retain the document in the medical record.

(2) The HCC staff may determine the reasonableness of a request. If an HCC staff member is unable to determine if the request is reasonable, the staff member may request a supervisor's assistance.

(3) If the recipient or the recipient's personal representative is present when the request is approved or denied, HCC staff shall notify the recipient or the recipient's personal representative verbally of the decision, and shall document the notification in the recipient's file.

(4) If the recipient or their personal representative is not present when the request is approved or denied, HCC shall notify the recipient or their personal representative of the decision in writing and retain the copy of the decision in the recipient's file.

(5) If the request is approved, an HCC staff member shall record the alternative method or address in the medical record and in the PSO's database.

B.Inspect and copy: A recipient or their personal representative may inspect their own PHI in a medical file (designated record set) as maintained by the HCC. This does not include psychotherapy notes.

(1) For all requests received in writing, the HCC shall respond in writing to the request to inspect or to obtain a copy of HCC PHI no later than 60 calendar days after receipt of the request. The HCC shall then determine, using the criteria in HIPAA privacy rule, if the request will be granted in part, in full, or denied.

(a) If the request will be granted in full, the PSO shall provide a written response arranging with the recipient or their personal representative a convenient time and place to inspect or obtain a copy of the PHI, or may mail the copy of the PHI at the recipient's or their personal representative's request; and shall discuss the scope, format, and other aspects of the recipient's or their personal representative's request with the recipient or personal representative as necessary to facilitate timely provision.

(b) If the PSO is unable to gather the required data within the time period required, the PSO may extend the time for the action by no more than 30 calendar days so long as the recipient or their personal representative is provided with a written statement of the reason(s) for the delay and the date by which the PSO shall complete the action on the request. However, only one such extension of time shall be allowed.

(c) The PSO shall provide a copy of the recipient's PHI to the recipient or their personal representative in the format requested, if possible. If not, the PSO shall provide the PHI in a readable hard copy form or in another format mutually agreed upon by the PSO and the recipient or their personal representative.

(2) If the request is denied, in part or in full, the PSO shall either:

(a) give the recipient or their personal representative access to any permitted PHI requested to the extent possible; or

(b) provide a written denial to the recipient or their personal representative; the denial shall be written in plain language and contain:

(i) the basis for the denial,

(ii) if applicable, a statement of the recipient's review rights, and

(iii) a description of how the recipient or their personal representative may complain to the PSO or to the secretary of HCA; this description shall include the title and telephone number of the PSO and the secretary of HCA.

(3) If the HCC does not maintain the PHI that is the subject of the request for inspection or copying, the PSO shall inform the recipient or their personal representative where to direct the request, if known.

(4) Exceptions: A recipient or their personal representative may not inspect the recipient's own protected health information (PHI) in a medical record in connection with:

(a) psychotherapy notes;

(b) information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative proceeding;

(c) PHI maintained by the HCC that is subject to the clinical laboratory improvements amendments (CLIA) to the extent that access to the recipient or their personal representative is prohibited by CLIA;

(d) when the access to the PHI requested is reasonably likely to endanger the life or physical safety of the recipient or another person as determined by a licensed health care professional by using their professional judgment;

(e) when the PHI makes reference to another person (unless such other person is a health care provider) and a licensed health care professional has determined, in the exercise of professional judgment, that granting the access requested is reasonably likely to cause substantial harm to such other person; or

(f) when the request for access is made by recipient's personal representative and a licensed health care professional has determined, in the exercise of professional judgment, that the provision of access to such personal representative is reasonably likely to cause substantial harm to the recipient or another person 45CFR 164.524.

(5) The PSO shall record all actions pertaining to access to inspect and copy

C. Accounting of disclosures: Accounting of all disclosures of a recipient's PHI shall be produced via written report by the PSO when the request is made in writing by the recipient or their personal representative and sent to the PSO.

(1) All disclosures shall be reported except for those:

(a) made to carry out TPO 45 CFR 164.506;

(b) for a facility directory;

(c) for notification purposes that include disaster relief, emergencies, or in the case of recipient death;

(d) for national security purposes;

(e) to correctional institutions or law enforcement officials having custody of an inmate;

(f) made prior to July 1, 2003;

(g) made more than six years prior to the date the accounting is requested;

(h) made to the recipient or their personal representative of the recipient's own PHI; or

(i) made to individuals involved in the recipient's care 45 CFR 164.528.

(2) If the HCC does not maintain the PHI that is the subject of the request for accounting, the PSO shall inform the recipient or their personal representative where to direct the request, if known.

(3) When a recipient or their personal representative requests in writing to the PSO an accounting of disclosures of PHI:

(a) within 60 calendar days of receiving a recipient's or their personal representative's request, HCC prepares a report from the PSO's database that includes all required PHI disclosures that occurred during the six years prior to the date of the request for an accounting, unless the recipient or their personal representative requested an accounting for a shorter period of time than six years.

(b) the deadline for producing the disclosure report may be extended for up to 30 calendar days, provided that a written statement is sent to the recipient citing the reasons for the delay and the date by which the accounting shall be received;

(c) the HCC must provide free of charge the first accounting report within any 12-month period; if additional requests for an accounting are made within the same 12-month period, the HCC shall notify the recipient or their personal representative if a fee will be charged for the additional copies;

(d) the accounting disclosure information is entered into the PSO's database.

D. Setting restrictions: A recipient or their personal representative may request restrictions on the uses and disclosures of their own protected health information (PHI) by submitting a request in writing to the HIPAA privacy and security officer (PSO).

(1) The PSO shall approve or deny requests for restriction(s) in writing within 15 calendar days.

(2) If the HCC does not maintain the PHI that is the subject of the request for setting restrictions, the PSO shall inform the recipient or their personal representative where to direct the request, if known.

(3) If a restriction is approved by the PSO, the information shall be entered into the PSO's database and the HCC shall not use or disclose the restricted PHI 45CFR 164.522(a).

(4) If the recipient or their personal representative is unable to write the request, the recipient or their personal representative may request assistance from the HCC. If assistance is provided, the HCC shall document that the assistance was given, have the recipient or their personal representative sign and date the document, co-sign and retain the document in the recipient's file.

(5) Limited use and disclosure of PHI is allowable when the recipient or their personal representative is not present for an emergency or because of the incapacity of the recipient or their personal representative.

(6) The HCC shall approve or deny the request as appropriate and ensure that the approval or denial of the restriction is entered into the medical record.

(7) If the restriction would involve more than a single location, the HCC staff worker shall send the request to the HIPAA privacy and security officer.

(8) The PSO shall inform the recipient or their personal representative in writing of the approval or denial of the request to restrict use and disclosure.

(9) The PSO shall document the restriction(s) in the PSO's database.

E. Amendments: It is the policy of the HCC that the HCC shall allow a recipient to request that an amendment be made to the recipient's own protected health information (PHI) contained in a designated record set as long as the PHI was originated by the HCC.

(1) A request for an amendment shall be submitted in writing to the PSO 45 CFR 164.526.

(2) If the HCC does not maintain the PHI that is the subject of the request for amending, the PSO shall inform the recipient or their personal representative where to direct the request, if known.

(3) Within five working days of receiving the recipient's or their personal representative's written request for an amendment, the PSO shall forward the request to the possessor of the PHI requested to be amended for a determination on whether to grant or deny, in whole or in part, the recipient's or their personal representative's request.

(4) The possessor of the PHI shall:

(a) review the recipient's or their personal representative's request for an amendment;

(b) determine whether to grant or deny, in whole or in part, the recipient's or their personal representative's request;

(c) within 45 calendar days of receiving the recipient's or their personal representative written request for an amendment from the PSO, inform the PSO of the decision to grant or deny, in whole or in part, the recipient's or their personal representative's request and the reason(s) for reaching the decision;

(d) within 60 calendar days of the original receipt of the recipient's or their personal representative's request for an amendment, the PSO shall inform the recipient or their personal representative of the decision to grant or deny the requested amendment in whole or in part; and

(e) if the PSO is unable to act on the amendment within the required 60 calendar day period, the time may be extended by no more that 30 calendar days, provided that the PSO provides the recipient or their personal representative with a written statement of the reasons for the delay and the date the action on the request will be completed.

(5) If the recipient's or their personal representative's request is granted in whole or in part:

(a) the possessor shall make the appropriate amendment to the recipient's PHI in the designated record set;

(b) the PSO shall inform the recipient or their personal representative that the amendment is accepted;

(c) the PSO shall obtain the recipient's or their personal representative's agreement and identification of persons that the HCC is to notify of the amendment; and

(d) the PSO shall provide the amendment to those persons identified by the recipient or their personal representative and to persons, including business associates, that the PSO knows have received the PHI that is the subject of the amendment and who may have relied, or could predictably rely, on such information to the detriment of the recipient.

F. Complaints and appeals: It is the policy of the HCC to receive, investigate and resolve complaints made by a recipient or their personal representative of alleged violations of the HIPAA privacy rule. Complaints shall be made in writing, specifying how the recipient's privacy rights have been violated, and submitted to the PSO or to the secretary of HCA 45 CFR 164.530(d)(1), (e), and (f).

(1) Within five working days of receipt of the complaint, the PSO shall initiate a HIPAA privacy investigation.

(2) The PSO shall enter the complaint into the PSO's database.

(3) Within 30 calendar days of contact by the PSO, the appropriate HCC staff shall conduct the HIPAA privacy investigation and prepares a written report to the PSO documenting the details of the HIPAA privacy investigation and the findings.

(4) Within 30 calendar days after receiving the written report from the appropriate HCC staff, the PSO shall determine the validity of the complaint and notify the recipient or their personal representative, the HCC supervisor and the HCC staff of the action taken. In consultation with the HCC supervisor, the PSO shall take appropriate action to mitigate the adverse effects of any unauthorized disclosure.

(5) For valid complaints, the PSO shall ensure that the appropriate disciplinary action and training are applied as per 8.300.2.24 NMAC.

(6) The PSO shall enter the HIPAA privacy investigation results into the PSO's database.

(7) If the recipient's or their personal representative's request pursuant to this section is denied in whole or in part, the PSO shall:

(a) provide recipient or their personal representative with a timely, written denial, which includes the reason for the denial;

(b) inform the recipient or their personal representative of the recipient's right to submit, and the procedure for submission of a written statement disagreeing with the denial and also inform the recipient or their personal representative that if no statement of disagreement is submitted, the recipient or their personal representative may request that the HCC provide the recipient's or their personal representative's request for amendment and the denial with any future disclosures of the PHI that is the subject of the amendment request;

(c) if necessary, prepare a written rebuttal to the recipient's or their personal representative's statement of disagreement and provide a copy to the recipient or their personal representative;

(d) identify the record or PHI and append to the designated record set the:

(i) recipient's or their personal representative's request for an amendment;

(ii) the HCC's denial of the request;

(iii) the recipient's or their personal representative's statement of disagreement, if any; and

(iv) the HCC's rebuttal, if any.

N.M. Admin. Code § 8.300.2.11

8.300.2.11 NMAC - N, 7-1-03; A, 9-15-08, Adopted by New Mexico Register, Volume XXXV, Issue 12, June 25, 2024, eff. 7/1/2024