N.M. Admin. Code § 8.8.5.10

Current through Register Vol. 35, No. 23, December 10, 2024

Section 8.8.5.10 - INDIVIDUAL RIGHTS RELATED TO PROTECTED HEALTH INFORMATION

The Health Insurance Portability and Accountability Act of 1996 and children, youth and families department policies, 8.8.5.1 through 8.8.5.20 NMAC, provide that individuals have certain rights with respect to their protected health information. Any requests to avail themselves of those rights, as enumerated herein, must be in writing.

A. Individuals or their personal representatives have a right to inspect and copy their own PHI as follows:

(1) Access is denied, with no right of review, if:

(a) the individual is a resident in a department correctional facility and obtaining such access would jeopardize the health, safety, security, custody, or rehabilitation of the individual or of other residents, or the safety of any officer, employee, or other person at the correctional institution or responsible for the transporting of the resident;

(b) the information was compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative proceeding;

(c) the information is contained in psychotherapy notes;

(d) the PHI was obtained from someone other than a health care provider under a promise of confidentiality and the access requested would be reasonably likely to reveal the source of the information, or

(e) any circumstances where access to PHI is restricted by federal or state statute or regulation not otherwise pre-empted by HIPAA.

(2) Access is denied, with right of review, if:

(a) the access to the PHI requested is determined by a licensed health care professional to be likely to endanger the life or physical safety of the individual or another person; and such determination is documented;

(b) the access is requested by a personal representative and a licensed health care professional determines that such access is reasonably likely to cause substantial harm to the individual or another person, or

(c) the PHI makes reference to another person (unless such person is a health care provider) and a licensed health care professional has determined that granting the access requested is reasonably likely to cause substantial harm to such other person.

(3) If the basis for the denial of access provides for a right of review, the individual or his/her personal representative has a right to have the denial reviewed by another licensed health care professional who did not participate in the original denial decision. Such review must be completed within a reasonable period of time, and the department must promptly provide the individual or his/her personal representative with notice of the reviewer's decision and comply with the determination to provide or deny access.

B. Individuals or their personal representatives have a right to submit a written request for an amendment to their own PHI for as long as the department maintains the PHI.

(1) The department must act on the request within sixty (60) days of receipt of the request by the privacy office or within ninety (90) days if the privacy office notifies the individual or his/her personal representative within the first sixty (60) days of the reasons for delay and the date by which action on the request will be taken. Requests to amend the individual's record may be denied for the following reasons:

(a) PHI contained in the record is deemed to be accurate and complete;

(b) PHI contained in the record was not created by department employees, (unless the individual or his/her personal representative provides reasonable basis to believe that the originator of the records is no longer available to act on the request), or

(c) the information that is the subject of the request for amendment is not part of the designated record set.

(d) would not be available for inspection under Section 8.8.5.10(A)(1) above.

(2) Approved amendments will become incorporated into the individual's record and the department will make reasonable efforts to provide the amended information to those persons and others, including business associates, that the department knows to have the affected PHI and that may have relied, or be foreseen to rely, on that information to the detriment of the individual. If the department rejects the amendment, the individual or his/her personal representative will be provided an opportunity to submit a written letter of disagreement that shall be appended or otherwise linked to the part of the record containing the disputed information.

C. Individuals or their personal representatives have a right to request receipt of the department's communications containing PHI by alternative means or at alternative locations by submitting a request in writing to the department's privacy officer. The department routinely accommodates all reasonable requests.

D. Individuals or their personal representatives have a right to submit a written request for a written accounting of disclosures made by the department within the previous six years as provided in Section 8.8.5.17 herein. The department acts on the request no later than 60 days after receipt, and the time may be extended for a 30 day period if the department provides a written statement of the reasons for the delay. Health oversight agencies and law enforcement officials may require, under certain circumstances provided in 45 CFR Section 164.528(a)(2), a suspension of the right to an accounting for a specified time. An accounting does not include disclosures made:

(1) to carry out treatment, payment and health care operations;

(2) to the individual or to the individual's personal representative of his or her own PHI;

(3) incident to certain uses or disclosures permitted or required pursuant to 45 CFR Section 164.502;

(4) pursuant to a written authorization;

(5) to correctional institutions or law enforcement officials pursuant to 45 CFR Section 164.512(k)(5);

(6) prior to the compliance date for providers of April 14, 2003 or for the small health plan administered by the prevention and intervention division of April 14, 2004.

(7) that are otherwise excepted in 45 CFR Section 164.528(a)(1).

E. Individuals have a right to complain to the department concerning the department's policies and procedures implementing HIPAA. The complaint is made in writing either to the department privacy office and/or to the secretary of the United States department of health and human services. The complaint must be filed within 180 days of when the complainant knew or should have known that the alleged violation occurred, unless this time limit is waived for good cause shown. The complaint must name the entity or person that is the subject of the complaint, describe the alleged violation and the applicable requirements of the code or regulation.

N.M. Admin. Code § 8.8.5.10

8.8.5.10 NMAC - N, 4/30/2003