N.M. Admin. Code § 8.300.2.9

Current through Register Vol. 36, No. 1, January 14, 2025

Section 8.300.2.9 - GENERAL HIPAA APPLICATION AND INTERPRETATION

This part describes HIPAA policies including health plan responsibilities, disclosure requirements, minimum necessary, business associates, sanctions, reporting, and documentation requirements. The HCC shall meet all requirements in this chapter.

A. Medicaid is a health plan and a covered entity under HIPAA: The New Mexico medicaid program under title XIX of the Social Security Act qualifies as a health plan under HIPAA regulations at 45 CFR 160.103 and is considered a covered entity.

B. Inconsistency between state and federal law: In the event of any inconsistency between the federal HIPAA privacy rule and New Mexico statutes or regulations, the HIPAA privacy rule shall preempt state law, except where 45CFR 160.203] :

(1) a determination is made by the secretary of the United States department of health and human services pursuant to 45 CFR 160.204;

(2) the provision of state law relates to the privacy of individually identifiable health information and is more stringent than a standard, requirement, or implementation specification under the HIPAA privacy rule;

(3) the provision of state law and procedures established thereunder provides for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation or intervention; or

(4) the provision of state law requires the HCC to report, or to provide access to, information for the purpose of management audits, financial audits, program monitoring and evaluation, or the licensure or certification of facilities or individuals.

N.M. Admin. Code § 8.300.2.9

8.300.2.9 NMAC - N, 7-1-03; A, 9-15-08, Adopted by New Mexico Register, Volume XXXV, Issue 12, June 25, 2024, eff. 7/1/2024