HB0279

HOUSE BILL 279

57th legislature - STATE OF NEW MEXICO - second session, 2026

INTRODUCED BY

Christine Chandler and Linda M. Trujillo

AN ACT

RELATING TO HEALTH CARE PRIVACY; STRENGTHENING PRIVACY PROTECTIONS FOR ELECTRONIC MEDICAL RECORDS BY LIMITING DISCLOSURE OF CERTAIN HEALTH CARE INFORMATION; RESTRICTING LOCATION TRACKING AT REPRODUCTIVE HEALTH CARE PROVIDER AND GENDER-AFFIRMING HEALTH CARE PROVIDER FACILITIES; AMENDING LICENSING REQUIREMENTS FOR CERTAIN HOSPITALS; STRENGTHENING PRIVACY PROTECTIONS FOR PROVIDERS WHO PRESCRIBE DRUGS FOR REPRODUCTIVE HEALTH CARE; PROVIDING FOR REPRODUCTIVE HEALTH CARE PROVIDERS AND GENDER-AFFIRMING HEALTH CARE PROVIDERS TO PARTICIPATE IN THE CONFIDENTIAL SUBSTITUTE ADDRESS ACT; PROVIDING CIVIL PENALTIES.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF NEW MEXICO:

SECTION 1. Section 24-14B-2 NMSA 1978 (being Laws 2009, Chapter 69, Section 2) is amended to read:

"24-14B-2. PURPOSE.--The purpose of the Electronic Medical Records Act is to provide for the use, disclosure, privacy and protection of electronic medical records."

SECTION 2. Section 24-14B-3 NMSA 1978 (being Laws 2009, Chapter 69, Section 3) is amended to read:

"24-14B-3. DEFINITIONS.--As used in the Electronic Medical Records Act:

A. "demographic information" means information that identifies the individual who is the subject of the health care information, including the individual's name, date of birth and address and other information necessary to identify the individual, that may be used to identify the individual or that associates the individual with the individual's electronic medical record;

B. "disclose" means to release, transfer, provide, give access to or otherwise divulge in any other manner information outside the entity holding the information;

C. "electronic" means relating to technology having electrical, digital, magnetic, wireless, optical, electromagnetic or similar capabilities;

D. "electronic health care service provider" means a person that:

(1) maintains health care information, or provides software or hardware designed to maintain health care information, and makes the health care information available to a patient, provider, health care institution, health information exchange or health care group purchaser at the request of an individual or a provider, health care institution, health information exchange or health care group purchaser for the purpose of:

(a) allowing a patient to manage the patient's own health care information; or

(b) aiding a provider in the diagnosis or treatment of a patient; or

(2) provides software or hardware to an individual that allows:

(a) the individual to manage the individual's own health care information; or

(b) for the diagnosis, treatment or management of a medical condition of the individual;

[D.] E. "electronic medical record" means [an electronic record of an individual patient's health care information that may contain demographic information] a medical record that is maintained, displayed or provided electronically;

F. "electronic medical record system" means a

system used to process, store and maintain the medical records of individuals, including individuals' health care information;

[E.] G. "electronic signature" means an electronic sound, symbol or process attached to or logically associated with a record and executed or adopted by an individual with the intent to sign the record;

H. "gender-affirming health care" means psychological, behavioral, surgical, pharmaceutical or medical health care, services, procedures or supplies provided to an individual in support of the individual's gender identity;

[F.] I. "health care" means care, services or supplies related to the health of an individual and includes:

(1) preventive, diagnostic, therapeutic, rehabilitative, maintenance or palliative care and counseling;

(2) services, tests, assessments or procedures that are concerned with the physical or mental condition or functional status of an individual or that affect the structure or function of the body of an individual; and

(3) the sale or dispensing of a drug, a device, a piece of equipment or other item in accordance with a prescription;

[G.] J. "health care group purchaser" means a person who is licensed, certified or otherwise authorized or permitted by the New Mexico Insurance Code to pay for or purchase health care on behalf of an identified individual or group of individuals, regardless of whether the cost of coverage or services is paid for by the purchaser or the persons receiving coverage or services, and includes a contractor or an employee of a health care group purchaser;

[H.] K. "health care information" means any information, whether oral or recorded in any form or medium, related to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual, and includes health care claims and other administrative data from a provider, a health care institution, a health care group purchaser or an electronic health care service provider;

[I.] L. "health care institution" means an institution, facility or agency licensed, certified or otherwise authorized or permitted by law to provide health care in the ordinary course of business and includes a contractor or an employee of a health care institution;

M. "health care service plan" means a plan that arranges for the provision of health care to subscribers or

enrollees, or for the payment or reimbursement of any part of the cost for that health care, in return for a prepaid or periodic charge paid by or on behalf of the subscribers or enrollees and includes a contractor or an employee of the health care service plan;

[J.] N. "health information exchange" means an arrangement among persons participating in a defined secure electronic network service, such as a regional health information organization, that allows the sharing of health care information about individual patients among different health care institutions or unaffiliated providers, and includes a contractor or an employee of a health information exchange. The use of an electronic medical record system by a health care provider, by or within a health care institution or by an organized health care arrangement as defined by the federal Health Insurance Portability and Accountability Act of 1996 does not constitute a health information exchange;

[K.] O. "information" means data, including text, images, sounds and codes and computer programs, software and databases;

P. "medical record" means any record of an individual patient's health care information that may contain demographic information;

Q. "protected health care activity" means:

(1) seeking, receiving or providing reproductive health care or gender-affirming health care; or

(2) assisting an individual who is seeking, receiving or providing reproductive health care or gender-affirming health care, including by providing information, transportation, lodging or material support;

[L.] R. "provider" means an individual who is licensed, certified or otherwise authorized or permitted by law to provide health care in the ordinary course of business or practice of a profession;

[M.] S. "record" means information that is inscribed on a tangible medium or that is stored in an electronic or other medium and is retrievable in perceivable form;

[N.] T. "record locator service" means an information service that contains demographic information and the location of health care information of a specified individual across different health care institutions or unaffiliated providers that participate in the service and includes a contractor or an employee of a record locator service. The use of an electronic medical record system by a health care provider or by an organized health care arrangement as defined by the federal Health Insurance Portability and Accountability Act of 1996 does not constitute a record locator service; [and]

U. "reproductive health care" means psychological, behavioral, surgical, pharmaceutical or medical care, services or supplies that relate to the human reproductive system. "Reproductive health care" includes services related to:

(1) abortion;

(2) pregnancy prevention;

(3) managing the loss of a pregnancy;

(4) prenatal, perinatal and postpartum health;

(5) managing perimenopause and menopause;

(6) managing fertility and infertility;

(7) treating cancers of the reproductive system; and

(8) preventing sexually transmitted infections; and

[O.] V. "treatment" means the provision, coordination or management of health care and related services by one or more providers, including the coordination or management of health care by a provider with a third party; consultation between providers relating to an individual; or the referral of an individual for health care from one provider to another."

SECTION 3. Section 24-14B-6 NMSA 1978 (being Laws 2009, Chapter 69, Section 6, as amended) is amended to read:

"24-14B-6. USE AND DISCLOSURE OF ELECTRONIC HEALTH CARE INFORMATION.--

A. A provider, a health care institution, a health information exchange, [or] a health care group purchaser or an electronic health care service provider shall not use or disclose health care information in an individual's electronic medical record to another person without the consent of the individual except as allowed by state or federal law.

B. A provider, a health care institution, [or] a health care group purchaser or an electronic health care service provider may disclose demographic information and information about the location of an individual's electronic medical records to a record locator service in accordance with state or federal law. A provider or health care institution participating in a health information exchange using a record locator service shall not have access to demographic information, information about the location of the individual's electronic medical records or information in an individual's electronic medical record except in connection with the treatment of the individual or as permitted by the consent of the individual or as otherwise permitted by state or federal law.

C. A health information exchange or an electronic medical record system operating in the state that electronically stores or maintains electronic medical records, health-insurance-related claims, payments or other administrative data on behalf of an electronic health care service provider, a provider or a health care service plan shall, on or before July 1, 2028, develop capabilities, policies and procedures that allow for and ensure that the health information exchange or electronic medical record system:

(1) allows segregation of an individual's health care information related to reproductive health care and gender-affirming health care from the rest of the individual's health care information;

(2) allows for an individual to provide written authorization to allow or disallow access to the individual's segregated records related to reproductive health care and gender-affirming health care; and

(3) limits access privileges of a user of electronic medical records systems that contain medical records related to reproductive health care and gender-affirming health care to only those persons or entities for whom the individual has provided written authorization for access.

[C.] D. A record locator service shall maintain an audit log of persons obtaining access to information in the record locator service, which audit log shall contain, at a minimum, information on:

(1) the identity of the person obtaining access to the information;

(2) the identity of the individual whose information was obtained;

(3) the location from which the information was obtained;

(4) the specific information obtained; and

(5) the date that the information was obtained.

[D.] E. The audit log shall be made available by a health information exchange on the request of an individual whose health care information is the subject of the audit log; provided, however, that the audit log made available to the individual shall include only information related to that individual. The audit log shall be made available to the requesting individual annually for a fee not to exceed twenty-five cents ($.25) per page as established by the [department of] health care authority.

[E.] F. A record locator service shall provide a mechanism under which individuals may exclude their demographic information and information about the location of their electronic medical records from the record locator service. A person operating a record locator service or a health information exchange that receives an individual's request to exclude all of the individual's information from the record locator service is responsible for removing that information from the record locator service within thirty days. An individual's request for exclusion of information shall be in writing and shall include a waiver of liability for any harm caused by the exclusion of the individual's information.

[F.] G. When information in an individual's electronic medical record is requested using a record locator service or a health information exchange:

(1) the requesting provider or health care institution shall warrant that the request is for the treatment of the individual, is permitted by the individual's written authorization or is otherwise permitted by state or federal law; and

(2) the person disclosing the information may rely upon the warranty of the person making the request that the request is for the treatment of the individual, is permitted with the consent of the individual or is otherwise permitted by state or federal law.

H. Notwithstanding any other provision of law, a provider, a health care service plan, a health care group purchaser, a health information exchange or an electronic health care service provider shall:

(1) not release an individual's health care information in response to a request, including a foreign subpoena, summons or other civil, criminal or regulatory inquiry or investigation request, if the provider, health care service plan, health care group purchaser, health information exchange or electronic health care service provider knows or has reason to believe that the request is based on another state's law that interferes with a protected health care activity or with a person's rights under the Reproductive and Gender-Affirming Health Care Freedom Act or the Reproductive and Gender-Affirming Health Care Protection Act;

(2) notify an individual whose health care information is the subject of a request described in Paragraph (1) of this subsection of the existence of the request within thirty days of receipt of the request; and

(3) notify each provider that rendered reproductive health care or gender-affirming health care as documented in the health care information sought in a request described in Paragraph (1) of this subsection of the existence of the request within thirty days of receipt of the request.

I. A provider, a health care service plan, a health care group purchaser, a health information exchange or an electronic health care service provider shall not be subject to any civil, criminal or administrative liability or professional disciplinary action for refusing to disclose health care information in accordance with Subsection H of this section.

[G.] J. Notwithstanding any other provision of law, information in an individual's electronic medical record may be disclosed:

(1) to a provider that has a need for information about the individual to treat a condition that poses an immediate threat to the life of any individual and that requires immediate medical attention;

(2) except as provided in the Electronic Medical Records Act, to a record locator service or a health information exchange for the development and operation of the record locator service and the health information exchange; and

(3) to a provider, health care institution or health care group purchaser for treatment, payment or health care operation activities, in compliance with the federal Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated pursuant to that act, and if applicable, in compliance with 42 U.S.C. Section 290dd-2 and the regulations promulgated pursuant to that section.

[H.] K. For the purposes of this section, "health care operation activities" includes administrative, financial, legal and quality improvement activities of a covered entity that are necessary to conduct business and to support the core functions of treatment and payment and are limited to the activities listed in the definition of "health care operations" at 45 C.F.R. 164.501."

SECTION 4. Section 24-14B-7 NMSA 1978 (being Laws 2009, Chapter 69, Section 7) is amended to read:

"24-14B-7. LIABILITY.--If an individual requests to exclude all of the individual's information from the record locator service pursuant to Subsection [E] F of Section [6 of the Electronic Medical Records Act] 24-14B-6 NMSA 1978, the record locator service, health information exchange, health care institution or provider shall not be liable for any harm to the individual caused by the exclusion of the individual's information."

SECTION 5. A new section of the Electronic Medical Records Act, Section 24-14B-11 NMSA 1978, is enacted to read:

"24-14B-11. [NEW MATERIAL] ENFORCEMENT.--

A. A health information exchange or an electronic medical record system determined to be in violation of the Electronic Medical Records Act shall be:

(1) subject to injunctive relief to cease or correct the violation;

(2) liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) for each negligent violation; or

(3) liable for a civil penalty of not more than ten thousand dollars ($10,000) for each intentional violation.

B. The attorney general or a district attorney may

institute a civil action in district court if the attorney general or district attorney has reasonable cause to believe

that a violation of the Electronic Medical Records Act has occurred or to prevent a violation of that act."

SECTION 6. A new section of the Electronic Medical Records Act, Section 24-14B-12 NMSA 1978, is enacted to read:

"24-14B-12. [NEW MATERIAL] VIOLATIONS--REMEDIES.--In addition to any other remedies available by law, an individual who claims to have suffered a loss or a deprivation of a right under the Electronic Medical Records Act may maintain an action to establish liability and to recover damages and equitable or injunctive relief in a New Mexico district court."

SECTION 7. Section 24-35-1 NMSA 1978 (being Laws 2023,

Chapter 167, Section 1) is amended to read:

"24-35-1. SHORT TITLE.--[Sections 1 through 8 of this

act] Chapter 24, Article 35 NMSA 1978 may be cited as the

"Reproductive and Gender-Affirming Health Care Protection

Act"."

SECTION 8. Section 24-35-6 NMSA 1978 (being Laws 2023, Chapter 167, Section 6) is amended to read:

"24-35-6. HEIGHTENED PROTECTION FOR ELECTRONICALLY TRANSMITTED INFORMATION RELATED TO A PROTECTED HEALTH CARE ACTIVITY.--

A. For purposes of this section, "third party" means an individual or entity who transmits information related to a protected health care activity, in the normal course of business, in an electronic format. "Third party" does not mean a covered entity or business associate as defined by the federal Health Insurance Portability and Accountability Act of 1996 and related regulations.

B. It shall be a violation of the Reproductive and Gender-Affirming Health Care Protection Act to request from a third party, or for a third party to transmit, information related to an individual's or entity's protected health care activity with the intent to:

(1) identify or track an individual engaged in a protected health care activity;

[(1)] (2) harass, humiliate or intimidate that individual or entity;

[(2)] (3) incite another to harass, humiliate or intimidate that individual or entity;

[(3)] (4) cause that individual to reasonably fear for that individual's own or family members' safety;

[(4)] (5) cause that individual to suffer unwanted physical contact or injury;

[(5)] (6) cause that individual to suffer substantial emotional distress; or

[(6)] (7) deter, prevent, sanction or penalize an individual or entity for engaging in a protected health care activity.

C. This section shall not apply to a lawsuit or judgment entered in another state that is based on conduct for which a cause of action exists under the laws of New Mexico."

SECTION 9. A new section of the Reproductive and Gender-Affirming Health Care Protection Act is enacted to read:

"[NEW MATERIAL] HEALTH AND LOCATION DATA PRIVACY.--

A. Except as provided in this section, it is unlawful to geofence a health care facility or the offices and treatment rooms or other facilities of a private licensed provider of reproductive health care or gender-affirming health care to:

(1) identify or track a person engaged in a protected health care activity;

(2) collect, use, disclose, sell, share or retain personal data from a person engaged in a protected health care activity; or

(3) send notifications or advertisements to a person related to the person's personal data or the person's reproductive health care or gender-affirming health care.

B. It is unlawful to sell personal data to or share personal data with a third party if the personal data is used by the third party to identify or track a person engaged in a protected health care activity or send notifications or advertisements to a person related to the person's personal data or the person's reproductive health care or gender-affirming health care.

C. A statement signed under penalty of perjury made by a person authorized to enter into an agreement on behalf of a third party that receives personal data that affirms that personal data received will not be used for a purpose prohibited by Subsection B of this section shall be prima facie evidence that the personal data was not sold or shared in violation of Subsection B of this section.

D. Nothing in this section shall be construed to prohibit a person that owns, operates, manages or otherwise provides services to an in-person health care facility from geofencing the facility's own location, including offices and treatment rooms of a private licensed health care provider:

(1) to provide necessary health care services, including the use of location-based alarm devices to monitor newborns and memory-impaired individuals; or

(2) for the purpose of providing security services to protect patients, staff or property.

E. Nothing in this section shall exempt a person from complying with a lawfully executed search warrant or a lawful subpoena issued pursuant to New Mexico law.

F. Nothing in this section abrogates or limits the requirements of the Electronic Communications Privacy Act or rights and remedies otherwise available by law.

G. Nothing in this section shall apply to geofencing activities conducted solely for research purposes by an investigator within an institution that holds an assurance with the United States department of health and human services pursuant to Part 46 of Title 45 of the Code of Federal Regulations and who obtains informed consent in the method and manner required by those regulations.

H. As used in this section:

(1) "collect" means to rent, gather, obtain, receive or access by any means a person's personal data, including receiving a person's personal data directly from the person, actively or passively, or by observing the person's behavior;

(2) "geofence" means any technology that enables spatial or location detection to establish a virtual boundary around, and detect an individual's presence within, a precise geolocation;

(3) "personal data" means information, including derived data, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable natural person, and includes:

(a) biometric or genetic data;

(b) data revealing citizenship, ethnic origin, immigration status or national origin;

(c) financial data, including a credit card number, a debit card number, a financial account number or information that describes or reveals the bank account balances or income level of a natural person;

(d) a government-issued identifier, such as a social security number, passport number or driver's license number, that is not required by law to be displayed in public;

(e) data describing or revealing the past, present or future mental or physical health or condition or status of a natural person;

(f) data revealing gender, gender identity, sex or sexual orientation;

(g) religious affiliation;

(h) union membership; or

(i) precise geolocation;

(4) "precise geolocation" means a geographic area that is equal to or less than the area of a circle with a radius of two thousand feet as derived from a device that is used or intended to be used to locate a person; and

(5) "share" means to provide, rent, release, disclose, disseminate, make available, transfer or otherwise communicate, whether orally, in writing or by electronic or other means, a person's personal data, regardless of whether monetary or other consideration is provided for the data."

SECTION 10. Section 24A-1-7 NMSA 1978 (being Laws 2003, Chapter 426, Section 1, as amended) is amended to read:

"24A-1-7. LEGISLATIVE FINDINGS--DEFINITIONS--LICENSING REQUIREMENTS FOR CERTAIN HOSPITALS.--

A. The legislature finds that:

(1) acute care general hospitals throughout New Mexico operate emergency departments and provide vital emergency medical services to patients requiring immediate medical care; and

(2) federal and state laws require hospitals that operate an emergency department to provide certain emergency services and care to any person, regardless of that person's ability to pay. Accordingly, these hospitals encounter significant financial losses when treating uninsured or underinsured patients.

B. As used in this section:

(1) "emergency medical condition" means:

(a) a medical or behavioral health condition manifesting itself by acute symptoms of sufficient severity, including severe pain, such that a prudent layperson who possesses an average knowledge of health and medicine could reasonably expect that the absence of immediate medical attention may result in: 1) placing the health of the individual at risk; 2) impairment to bodily functions; or 3) dysfunction of any bodily organ or part;

(b) with respect to a pregnant person who is experiencing contractions, inadequate time to effectuate a safe transfer to another facility before delivery, or that transferring the patient may pose a threat to the health or safety of the patient, and includes: active labor; an ectopic pregnancy; a complication resulting from pregnancy; pregnancy loss; attempted termination of pregnancy; risk to future fertility; previable, preterm or premature rupture of membranes; risk of infection; cervical insufficiency; and emergent hypertensive disorders when the absence of immediate medical attention could reasonably be expected to result in placing the health of the patient in serious jeopardy, serious impairment to bodily functions or serious dysfunction of any bodily organ or part; and

(c) any other condition a health care practitioner acting within the practitioner's lawful scope of practice determines, in the practitioner's reasonable medical judgment, to be an emergency medical condition;

[(1)] (2) "limited service hospital" means a hospital that limits admissions according to medical or surgical specialty, type of disease or medical condition, or a hospital that limits its inpatient hospital services to surgical services or invasive diagnostic and treatment procedures; provided, however, that a "limited service hospital" does not include:

(a) a hospital licensed by the authority as a special hospital;

(b) an eleemosynary hospital that does not bill patients for services provided; or

(2)] (3) "low-income patient" means a patient whose family or household income does not exceed two hundred percent of the federal poverty level; and

(4) "stabilize" means to provide medical treatment that may be necessary to ensure, within reasonable medical probability, that no material deterioration of the patient's condition, serious impairment of bodily functions or dysfunction of any bodily organ or part or a threat to the patient's life is likely to result from or occur during the transfer or discharge of the patient.

C. The authority shall issue a license to an acute-care or general hospital or a limited services hospital that agrees to:

(1) continuously maintain and operate an emergency department that provides emergency medical services, including:

(a) appropriate medical screenings and examinations, within the capability of the facility, to determine whether a patient is experiencing an emergency medical condition;

(b) the medical treatment necessary to stabilize the emergency medical condition that is within the capability of the staff and facilities available at the hospital;

(c) the transfer of a patient to another medical facility in accordance with the hospital's written policies and procedures for transferring a patient to an appropriate facility when the patient's medical status indicates the need for emergency care that the facility cannot provide;

(d) the provision of an abortion or sterilization procedures when a patient has an emergency medical condition and an abortion or sterilization procedures are necessary to stabilize the patient and the provision of which is within the capability of the staff and facilities available at the facility; and

(e) other services as determined by the authority;

(2) participate in the medicaid, medicare and county indigent care programs;

(3) require a physician owner to disclose a financial interest in the hospital before referring a patient to the hospital;

(4) comply with the same quality standards applied to other hospitals;

(5) provide emergency services and general health care to nonpaying patients and low-income reimbursed patients in the same proportion as the patients are treated in acute-care general hospitals in the local community, as determined by the authority in consultation with a statewide hospital organization, the government of the county in which the facilities are located and the affected hospitals; provided that:

(a) a hospital may appeal the determination of the authority as a final agency decision as provided in Section 39-3-1.1 NMSA 1978; and

(b) the annual cost of the care required to be provided pursuant to this paragraph shall not exceed an amount equal to five percent of the hospital's annual revenue; and

(6) require a health care provider to disclose a financial interest before referring a patient to the hospital."

SECTION 11. Section 26-1-16 NMSA 1978 (being Laws 1967, Chapter 23, Section 16, as amended) is amended to read:

"26-1-16. DANGEROUS DRUGS--CONDITIONS FOR SALE--PRESCRIPTION REFILLING--LIMITATIONS.--

A. It is unlawful for a person to sell, dispose of or possess any dangerous drugs, except:

(1) manufacturers, wholesalers or distributors, their agents or employees licensed by the board to ship dangerous drugs into the state; or

(2) distributors, wholesalers, hospitals, nursing homes, clinics or pharmacies and other authorized retailers of dangerous drugs in this state licensed by the board, and appropriate records of dangerous drugs receipt and disposition are kept. These records shall be open to inspection by any enforcement officer of this state.

B. Practitioners licensed in this state may prescribe, provide samples of and dispense any dangerous drug to a patient where there is a valid practitioner-patient relationship. A record of all such dispensing shall be kept showing the date the drug was dispensed and bearing the name and address of the patient to whom dispensed. It is the duty of every licensed physician, dentist, veterinarian, pharmacist or person holding a limited license issued under Subsection B of Section 61-11-14 NMSA 1978, when dispensing any dangerous drug, to mark on the dispensing container the name of the patient, the date dispensed, the name and address of the person dispensing the drug, the name and strength of the drug, expiration date where applicable, adequate directions for use and the prescription number when applicable. All official compendium requirements for the preservation, packaging, labeling and storage of dangerous drugs are applicable where drugs are held for dispensing to the public, whether by a pharmacy, clinic, hospital or practitioner.

C. Notwithstanding the requirements of Subsection B of this section or any other law, a practitioner that has prescribed a drug used for medication abortion, including brand-name or generic mifepristone, may request that the drug be dispensed in a dispensing container marked with the name and address of the health care facility at which the practitioner practices. If a practitioner makes such a request, the dispensing container shall not be marked with the prescribing practitioner's personal name or address.

[C.] D. Pharmacists are prohibited from selling or dispensing a dangerous drug except on prescription or drug order of a practitioner and except as such sale or possession is authorized under Subsection A of this section. It is the duty of all pharmacists to keep an accurate record of all disposals, which record shall be open to inspection by an enforcement officer of this state.

[D.] E. No enforcement officer having knowledge by virtue of office of a prescription, order or record shall divulge such knowledge except in connection with a prosecution or proceeding in court or before a licensing or registration board or officer, to which prosecution or proceeding the person to whom such prescriptions, orders or records relate is a party.

[E.] F. It is unlawful, except as otherwise authorized under Subsection A of this section or the Controlled Substances Act and except for the college of pharmacy of the university of New Mexico or a public health laboratory, for a person to possess any dangerous drug unless such substance has been dispensed to the person either directly by a practitioner or on a prescription.

[F.] G. All records required to be kept under the provisions of the New Mexico Drug, Device and Cosmetic Act shall be preserved for a period of three years; provided that records requirements do not apply to the administration of a drug to a patient upon whom the practitioner personally attends; and provided that records of controlled substances shall be kept in accordance with the provisions of the Controlled Substances Act.

[G.] H. A prescription shall not be filled:

(1) as a refill if it is marked by the issuing practitioner to indicate that the prescription is not to be refilled;

(2) except in compliance with the provisions of the Controlled Substances Act if the drug is a controlled substance;

(3) unless the fill is made in accordance with the provisions of this section; and

(4) when the practitioner does not indicate fill instructions on the original prescription calling for a dangerous drug, unless:

(a) the practitioner is contacted orally, by telephone or other means of communication for instruction; and

(b) if authorization to fill is given the pharmacist, the following information will be immediately transferred to the original prescription: 1) date; 2) name of person authorizing the fill; 3) pharmacist's initials; and 4) amount dispensed if different from the amount indicated on the original prescription.

[H.] I. Nothing in this section shall prevent the owner of livestock or the owner's consignee or their employees to be in possession of drugs for their use in performing routine, accepted livestock management practices in the care of livestock belonging to the owner, and the drugs are labeled as being restricted to animal use only; provided, that if such drugs bear the legend: "CAUTION: federal law restricts this drug to use by or on the order of a licensed veterinarian", the drugs may be used or distributed only as provided in Subsection A of Section 26-1-15 NMSA 1978.

[I.] J. When, on the original prescription calling for a dangerous drug that is not a controlled substance, a practitioner indicates a specific number of fills or a specific period of time during which a prescription may be filled, a drug may be filled the number of times or for the period of time that the prescription indicates if the following information is provided with the prescription:

(1) the date of fill;

(2) the initials of the pharmacist filling the prescription; and

(3) the amount of drug dispensed, if it differs from the amount called for on the original prescription.

[J.] K. A pharmacist may dispense a quantity not to exceed a ninety-day supply of a dangerous drug by combining valid fills when:

(1) an indication on the prescription or label does not specifically prohibit a combined fill; and

(2) the dangerous drug to be filled is not a controlled substance.

[K.] L. When the practitioner indicates on the original prescription calling for dangerous drugs that it may be filled "prn", the pharmacist may fill it within the limits of the dosage directions for a period of twelve months; provided that the date of filling and the initials of the pharmacist are recorded on the original prescription. At the expiration of the twelve-month period, the practitioner must be contacted for a new prescription; provided that this is not to be construed to apply to those drugs regulated by the Controlled Substances Act.

[L.] M. The board may adopt and promulgate regulations to permit the use of computer systems for the storage and retrieval of prescriptions, records for the purpose of filling prescriptions, receipt records, drug distribution records, drug withdrawals from stock, drug compounding records, drug disposition records and drug disposal records.

[M.] N. As used in this section, "fill" means a dispensing of a drug for the first time or as a refill."

SECTION 12. Section 40-13B-2 NMSA 1978 (being Laws 2018, Chapter 40, Section 2) is amended to read:

"40-13B-2. DEFINITIONS.--As used in the Confidential Substitute Address Act:

A. "agency" means an agency of the state or of a political subdivision of the state;

B. "applicant" means a person who submits an application to participate in the confidential substitute address program;

C. "application assistant" means a person who works or volunteers for a domestic violence or sexual assault program and who assists in preparing an application for the confidential substitute address program;

D. "confidential substitute address" means an address designated for a participant by the secretary of state pursuant to the Confidential Substitute Address Act;

E. "delivery address" means the address where an applicant or a participant receives mail, and it may be the same as the person's residential address;

F. "domestic violence" means "domestic abuse", as defined in the Family Violence Protection Act;

G. "participant" means a person certified to participate in the confidential substitute address program pursuant to the Confidential Substitute Address Act;

H. "protected health care provider" means a natural person engaged in a protected health care activity as defined in the Reproductive and Gender-Affirming Health Care Protection Act through the person's provision of or aid in the provision of reproductive health care or gender-affirming health care;

[H.] I. "public record" means "public records", as defined in the Inspection of Public Records Act; and

[I.] J. "residential address" means the street address where an applicant or participant resides or will relocate."

SECTION 13. Section 40-13B-3 NMSA 1978 (being Laws 2018, Chapter 40, Section 3, as amended) is amended to read:

"40-13B-3. CONFIDENTIAL SUBSTITUTE ADDRESS PROGRAM--APPLICATION.--

A. The "confidential substitute address program" is created in the office of the secretary of state to provide a process by which a natural person who is a victim of domestic violence or a protected health care provider may protect the confidentiality of the [victim's] natural person's residential and delivery addresses in public records.

B. [An applicant] A protected health care provider, or a victim of domestic violence who wishes to become a participant with the assistance of an application assistant, shall submit an application to the secretary of state on a form prescribed by the secretary of state. [The] An application assistant's signature shall serve as recommendation that the applicant participate in the confidential substitute address program. An application submitted by a protected health care provider shall only require the provider's signature confirming the provider's status as a protected health care provider.

C. An application shall be signed and dated by the applicant and, if applicable, the application assistant and shall include:

(1) the applicant's name;

(2) the applicant's statement that the applicant fears for the safety of the applicant, the applicant's child or another person in the applicant's household because of a threat of immediate or future harm;

(3) the applicant's statement that the disclosure of the applicant's residential or delivery address would endanger the applicant, the applicant's child or another person in the applicant's household;

(4) if the applicant is a victim of domestic violence, the applicant's statement that the applicant has confidentially relocated in the past ninety days or will relocate within the state in the next ninety days;

(5) a designation of the secretary of state as the applicant's agent for the purpose of receiving mail, deliveries and service of process, notice or demand;

(6) the names and ages of those persons in the applicant's household who will also be participants in the program if the applicant is admitted into the program. Each person in an applicant's household listed in the application shall be considered a separate participant in the program;

(7) the applicant's residential and delivery addresses, if different, the confidentiality of which the applicant seeks to protect;

(8) the applicant's telephone number and email address; and

(9) the applicant's statement under penalty of perjury that the information contained in the application is true."

SECTION 14. Section 40-13B-4 NMSA 1978 (being Laws 2018, Chapter 40, Section 4, as amended) is amended to read:

"40-13B-4. SECRETARY OF STATE--DUTIES--SERVICE ON PARTICIPANT.--

A. The secretary of state shall:

(1) certify applicants whose applications comply with the requirements of the Confidential Substitute Address Act to participate in the confidential substitute address program;

(2) upon certification with respect to each participant:

(a) issue a confidential substitute address identification card;

(b) designate a confidential substitute address that shall be used in place of the participant's residential or delivery address by state and local government agencies;

(c) receive mail and deliveries sent to a participant's confidential substitute address and forward the mail and deliveries to the participant's delivery address at no charge to the participant;

(d) accept service of process, notice or demand that is required or permitted by law to be served on the participant and immediately forward the process, notice or demand to the participant's delivery address at no charge to the participant; and

(e) maintain records of the following that are received and forwarded by the secretary of state: 1) a participant's certified and registered mail; and 2) any process, notice or demand that is served on a participant; and

(3) [administer the provisions of the Intimate Partner Violence Survivor Suffrage Act to] ensure that a participant who is eligible to vote in this state is able to be securely registered to vote and to automatically receive a ballot for each election, including through the secretary's administration of the Intimate Partner Violence Survivor Suffrage Act.

B. Service made pursuant to the provisions of this section is perfected three days after it is accepted by the secretary of state."

SECTION 15. Section 40-13B-5 NMSA 1978 (being Laws 2018, Chapter 40, Section 5, as amended) is amended to read:

"40-13B-5. AGENCIES--USE OF CONFIDENTIAL SUBSTITUTE ADDRESS--PUBLIC RECORDS.--

A. A participant shall:

(1) contact each agency that requests or uses an address; and

(2) provide the agency with a copy of the participant's confidential substitute address identification card.

B. Agencies that receive copies of confidential substitute address identification cards submitted pursuant to this section shall use the participant's confidential substitute address for all purposes.

C. A school district shall use a participant's confidential substitute address as the participant's address of record and, if necessary, shall verify a student's enrollment eligibility with the secretary of state.

D. A county clerk shall transfer all records related to a participant's voter registration to the secretary of state [pursuant to the] and shall comply with all provisions of the Intimate Partner Violence Survivor Suffrage Act.

E. A participant's residential or delivery address, telephone number and email address that are maintained by an agency are not public records and shall not be disclosed pursuant to the Inspection of Public Records Act while a person is a participant."

SECTION 16. Section 40-13B-7 NMSA 1978 (being Laws 2018, Chapter 40, Section 7, as amended) is amended to read:

"40-13B-7. PARTICIPANT DECERTIFICATION.--

A. A participant shall be decertified from the confidential substitute address program if:

(1) the participant submits a request to withdraw from the confidential substitute address program to the secretary of state;

(2) the participant fails to notify the secretary of state of a legal name change or a change to the participant's residential address, delivery address, telephone number or email address;

(3) mail that is forwarded by the secretary of state to the participant's delivery address is returned as undeliverable; or

(4) the participant is a survivor of domestic violence and does not comply with the provisions of the Intimate Partner Violence Survivor Suffrage Act.

B. If the secretary of state determines that one or more of the causes for decertification provided in Subsection A of this section exist, the secretary of state shall send notice of the participant's decertification to the participant's delivery and residential addresses and shall attempt to notify the participant by telephone and email. The participant shall be given ten days from the date of decertification to appeal the decertification.

C. A person who is decertified from the confidential substitute address program shall not continue to use the person's confidential substitute address.

D. For six months after a participant has been decertified, the secretary of state shall forward mail and deliveries to an address provided by the former participant. Upon receipt of mail and deliveries pursuant to this subsection, a former participant shall provide an updated address to the sender."

SECTION 17. Section 40-13B-8 NMSA 1978 (being Laws 2018, Chapter 40, Section 8, as amended) is amended to read:

"40-13B-8. PARTICIPANT RECORDS--CONFIDENTIALITY--DISCLOSURE PROHIBITED.--

A. The secretary of state and an agency shall not disclose the residential address, delivery address, telephone number or email address of a participant unless the information is required to be disclosed pursuant to a court order. A person or agency that receives a participant's residential address, delivery address, telephone number or email address pursuant to a court order shall not in turn disclose that information unless pursuant to a court order or unless the person who was a participant has been decertified.

B. The secretary of state shall maintain the confidentiality of all records relating to an applicant for or participant in the confidential substitute address program while the person is a participant and shall:

(1) store all tangible copies of program records in locked equipment;

(2) store all electronic copies of program records in a password-protected system;

(3) restrict access to all program records to secretary of state staff members who are approved to access the records as provided in this section; and

(4) release program records only on a court's order.

C. The secretary of state shall establish a system for restricting access to program records to approved staff members. Before being approved and granted access to program records, the staff member shall:

(1) submit to a criminal background check performed by the department of public safety;

(2) not have a record of a sex offense, felony or a misdemeanor violation related to domestic violence or sexual assault on the results of the person's criminal background check; and

(3) complete forty hours of training, including a domestic violence training course provided by the children, youth and families department and sexual assault training provided by the department of health or the crime victims reparation commission or its successor.

D. The secretary of state shall appoint a person to be the administrator of the election component of the confidential substitute address program with respect to all participants and in accordance with the Intimate Partner Violence Survivor Suffrage Act. The administrator shall meet the requirements of Subsection C of this section, and administration of the Intimate Partner Violence Survivor Suffrage Act shall conform to the requirements of Subsections A and B of this section and Subsection E of Section 40-13B-5 NMSA 1978."

- 41 -