N.M. Code R. § 7.1.20.8 – General Provisions on Access to His Data

A. Access requirements: Data and reports based on access levels in the HIS may be obtained only in accordance with the requirements of the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978, and this rule.
B. Evaluation of requests: In addition to other requirements stated in this rule, all requests for HIS data and reports, other than routine reports, shall be evaluated by the commission and commission staff and shall satisfy the following criteria for approval:
(1) the specific intended use of the data shall comport with the purposes of the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978, as stated in Section 24-14A-3A and rules promulgated pursuant to the act, including use of data to assist in:
(a) the performance of health planning and policy making functions for the benefit of the public;
(b) informed health care decision making by consumers;
(c) administration, monitoring and evaluation of a statewide health plan; and
(2) the request shall be consistent with the responsibilities of the commission in accomplishing the priorities of the HIS.
C. Request procedures: All requests for data shall be made pursuant to the requirements of 7.1.20.14 NMAC.
D. Fees: Fees for access to data and reports shall be paid pursuant to the requirements of 7.1.20.15 NMAC.
E. Restrictions on specificity: Information at a level of specificity that might compromise patient confidentiality or data provider proprietary information, as determined by commission staff, shall not be released.
F. Restrictions on access to sensitive data: The commission shall have the authority to deny access to information in the research, clinical or linking database where use of the information, as determined by the commission, could result in violation of a patient’s privacy, such as data on certain diagnosis codes or code ranges.
G. Compliance with other laws: The commission shall ensure that any access to data that is subject to restrictions on use pursuant to state, federal or tribal law or regulation, or any other legal agreement, complies with those restrictions.
H. Disclaimer: The commission shall include a disclaimer in all HIS data and reports released pursuant to this rule stating that the accuracy of the original data is the responsibility of the submitting data provider and that the commission assumes no responsibility for any use made of or conclusions drawn from the data.
I. Agency contractors:
(1) A state or federal agency that receives HIS data or reports under an agreement with the commission pursuant to Sections 11, 12 or 13 of 7.1.20 NMAC shall be solely responsible for fulfillment of the agreement, including responsibility for the actions of any subcontractor engaged to perform services that require access to HIS data or reports.
(2) No state or federal agency shall subcontract any portion of services to be performed under an agreement with the commission without prior written approval of the commission.
(3) A state or federal agency subcontractor that is provided access to HIS data or reports shall be subject to the full provisions of the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978, and this rule, including Sections 18, 19 and 20 of 7.1.20 NMAC.
(4) In no event shall a data provider engaged as a subcontractor to a state or federal agency obtain access to data in the research, analytical or linking database.
J. Public data: The restrictions that apply to the release of data provider specific information do not apply when the data provider is a government agency and the data provided to the HIS otherwise would be considered public data in accordance with the Public Records Act, Section 14-3-1 et seq. NMSA 1978, and the Open Meetings Act, Section 10-15-1 et seq. NMSA 1978.
[12/16/1994; Rn, 7 NMAC 1.1.9.1 & 7 NMAC 1.1.9.2, 8/30/1997; A, 8/30/1997; 7.1.20.8 NMAC - Rn, 7 NMAC 1.20.8, 03/31/2008]