1. A. Transfer of medical records. Each health care insurer shall develop and implement a policy for the transfer of medical records of a covered person whenever the following occur:

   (1) change of physician or other health care professional;

   (2) disenrollment of enrollee from the managed health care plan; or

   (3) other circumstances where requests by covered persons or former covered persons is reasonable.

2. B. Confidentiality of medical records.

   (1) Any data or information pertaining to the diagnosis, treatment, or health of any covered person obtained from the covered person, from any provider, or from any other source, shall be held in confidence as otherwise required or permitted by New Mexico or federal law.

   (2) The data or information shall not be disclosed to any person except: 1) to the extent that it may be necessary to carry out the purposes of this rule; 2) upon the express consent of the covered person; 3) pursuant to state or court order for the production of evidence or the discovery thereof; 4) in the event of claim or litigation between a covered person and the health care insurer wherein such data or information is pertinent; or 5) where otherwise required or permitted by New Mexico or federal law.

   (3) A health care insurer shall be entitled to claim any statutory privileges against such disclosure which the provider who furnished such information to the health care insurer is entitled to claim.

3. C. Maintenance of medical records.

   (1) Any medical records directly maintained by the health care insurer shall be organized in a uniform format applicable to all medical records.

   (2) The health care insurer shall have policies governing the contents of medical records including maintenance of records by electronic means.

4. D. Copies of medical records.

   (1) Covered persons or their legally authorized representatives shall have a right to inspect and obtain a copy of their medical records maintained by the health care insurer.

   (2) Charges for copies of medical records must be based upon actual costs not to exceed the prevailing community market rates. For photocopying, the cost shall be twenty-five cents ($.25) per page or less.

5. E. Protection of medical records. Medical records maintained by health care insurers shall be protected by health care insurers against loss, destruction, or unauthorized use, and shall be retained for at least 10 years or until the covered person reaches age 21 years, whichever is longer.
6. F. Destruction of medical records. Destruction of medical records must be such that confidentiality is maintained. Records must be destroyed by shredding, incinerating (where permitted) or by other method of permanent destruction, including purging of medical records from a computer hard disk, server hard disk or other media or disk in accordance with current practices for data deletion. A log must be kept of all charts destroyed, including the patient’s name and date of record destruction.

[13.10.23.10 NMAC - Rp, 13.10.13.21 NMAC, 09/01/2009]