N.M. Admin. Code § 8.300.2.17

Current through Register Vol. 36, No. 1, January 14, 2025

Section 8.300.2.17 - DEIDENTIFICATION OF PROTECTED HEALTH INFORMATION

The HCC may de-identify PHI on recipients by removing all recipient identifiable information 45CFR 164.514(a)(b). Authorized HCC employees shall forward the PHI to be deidentified to a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable; or they shall remove all the following recipient identifiable information.

A. Names.

B. Location: All geographic subdivisions smaller than a state, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the bureau of the census:

(1) the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and

(2) the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.

C. Dates: All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;

D. Numbers: All elements of numbers, or combination of alpha-numeric and special characters, for identification directly related to an individual, including:

(1) telephone numbers;

(2) fax numbers;

(3) e-mail addresses;

(4) social security numbers;

(5) medical record numbers;

(6) health plan beneficiary numbers;

(7) account numbers;

(8) certificate/license numbers;

(9) vehicle identifiers and serial numbers, including license plate numbers;

(10) device identifiers and serial numbers;

(11) web universal resource locators; (URLs);

(12) internet protocol (IP) address numbers;

(13) any other unique identifying number, characteristic, or code, except as otherwise permitted.

E. Imagery: All elements of physical characteristics captured in any format, or combination of formats, for identification directly related to an individual, including:

(1) biometric identifiers, including finger and voiceprints; and

(2) full face photographic images and any comparable images.

N.M. Admin. Code § 8.300.2.17

8.300.2.17 NMAC - N, 7-1-03, Adopted by New Mexico Register, Volume XXXV, Issue 12, June 25, 2024, eff. 7/1/2024