1. A. Confidentiality. Any PBM data received by the superintendent in response to a specific request shall be deemed confidential, unless disclosure is required for a regulatory purpose, enforcement, rulemaking, to respond to a legislative request, or is otherwise required by law or directed by court order. Notwithstanding the foregoing, the superintendent may publish aggregated data that cannot be traced to a specific PBM, provided any published data is at least 12 months old.

2. B. Conflicts. The superintendent shall not share confidential data with a consultant or contractor unless that third-party:

   1. (1) discloses all potential conflicts of interest;
   2. (2) maintains appropriate data safeguards and firewalls; and
   3. (3) executes an agreement prohibiting unauthorized disclosure or use of the confidential data.

[13.10.30.17 NMAC – Rp, 13.10.30.17 NMAC, 3/1/2022]