HOUSE BILL 5

48th legislature - STATE OF NEW MEXICO - second special session, 2008

INTRODUCED BY

Peter Wirth

AN ACT

CREATING THE ELECTRONIC MEDICAL RECORDS ACT; AUTHORIZING THE CREATION, MAINTENANCE AND USE OF ELECTRONIC MEDICAL RECORDS; CLARIFYING INDIVIDUAL RIGHTS WITH RESPECT TO THE DISCLOSURE OF INFORMATION CONTAINED IN ELECTRONIC MEDICAL RECORDS; CLARIFYING THE PROTECTION OF PRIVACY OF ELECTRONIC MEDICAL RECORDS.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF NEW MEXICO:

     Section 1. SHORT TITLE.--This act may be cited as the "Electronic Medical Records Act".

      Section 2. PURPOSE.--The purpose of the Electronic Medical Records Act is to provide for the use, disclosure and protection of electronic medical records.

     Section 3. DEFINITIONS.--As used in the Electronic Medical Records Act:

          A. "demographic information" means information in an electronic medical record that identifies the individual who is the subject of the medical record, including the individual's name, date of birth and address and other information that identifies the individual, that may be used to identify the individual or that associates the individual with the individual's electronic medical record;

          B. "disclosure" means the release, transfer, provision or otherwise divulging of an individual's electronic medical records to a person other than the holder of the records and includes having access to those records;

          C. "electronic" means relating to technology having electrical, digital, magnetic, wireless, optical, electromagnetic or similar capabilities;

          D. "electronic medical record" means an electronic record of an individual patient's health information that contains demographic or health care information;

          E. "electronic signature" means an electronic sound, symbol or process attached to or logically associated with a record and executed or adopted by an individual with the intent to sign the record;

          F. "health care" means care, services or supplies related to the health of an individual and includes:

                (1) preventive, diagnostic, therapeutic, rehabilitative, maintenance or palliative care and counseling;

                 (2) services, assessments or procedures that are concerned with the physical or mental condition or functional status of an individual or that affect the structure or function of the body of an individual; and

                (3) the sale or dispensing of a drug, a device, a piece of equipment or other item in accordance with a prescription;

          G. "health care group purchaser" means a person, other than a person licensed as a property and casualty or workers' compensation insurer, who is licensed, certified or otherwise authorized or permitted by the New Mexico Insurance Code to pay for or purchase health care on behalf of an identified individual or group of individuals, except for life insurers and disability income insurers, regardless of whether the cost of coverage or services is paid for by the purchaser or the persons receiving coverage or services;

          H. "health care information" means any information, whether oral or recorded in any form or medium, related to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual;

          I. "health care institution" means an institution, facility or agency licensed, certified or otherwise authorized or permitted by law to provide health care in the ordinary course of business;

          J. "health information exchange" means an electronic system that searches, identifies or locates an individual patient's health information from one or more sources for disclosure in accordance with state and federal law;

          K. "information" means data, including text, images, sounds and codes and computer programs, software and databases;

          L. "medical record" means a record of health care information;

          M. "provider" means an individual who is licensed, certified or otherwise authorized or permitted by law to provide health care in the ordinary course of business or practice of a profession;

          N. "record" means information that is inscribed on a tangible medium or that is stored in an electronic or other medium and is retrievable in perceivable form;

          O. "record locator service" means a system that provides a means of identification of the existence and location of the electronic medical records of a specified individual; and

          P. "treatment" means the provision, coordination or management of health care and related services by one or more providers, including the coordination or management of health care by a provider with a third party; consultation between providers relating to an individual; or the referral of an individual for health care from one provider to another.

     Section 4. ELECTRONIC MEDICAL RECORDS--ELECTRONIC SIGNATURES--LEGAL RECOGNITION.--If a law or rule requires a medical record to be in writing, or if a law or rule requires a signature pertaining to a medical record, an electronic medical record or an electronic signature satisfies that law or rule.

     Section 5. RETENTION OF ELECTRONIC MEDICAL RECORDS.--

          A. If a law or rule requires that a medical record be retained, the requirement is satisfied by retaining an electronic record that:

                (1) accurately reflects the medical record after it was first generated and in its final form as an electronic medical record or otherwise; and

                (2) remains accessible and is capable of being accurately reproduced for later reference.

          B. A requirement to retain a medical record in accordance with Subsection A of this section does not apply to any information the sole purpose of which is to enable the medical record to be sent, communicated or received.

          C. If a law or rule requires a medical record to be presented or retained in its original form or provides consequences if the medical record is not presented or retained in its original form, that law or rule is satisfied by an electronic medical record retained in accordance with Subsection A of this section.

          D. A medical record retained as an electronic medical record in accordance with Subsection A of this section satisfies a law or rule requiring a person to retain a medical record for evidentiary, audit or other purposes.

     Section 6. USE AND DISCLOSURE OF ELECTRONIC HEALTH CARE INFORMATION.--

          A. A provider, health care institution, health information exchange or health care group purchaser shall not use or disclose health care information in an individual's electronic medical record to another person in violation of state or federal law.

          B. A provider, health care institution or health care group purchaser may disclose demographic information and information about the location of an individual's electronic medical records to a record locator service in accordance with state or federal law. A provider or health care institution participating in a health information exchange using a record locator service shall not have access to demographic information, information about the location of the individual's electronic medical records or information in an individual's electronic medical record except in connection with the treatment of the individual or as permitted by the individual's written authorization or as otherwise permitted by state or federal law.

          C. A health information exchange maintaining a record locator service shall maintain an audit log of persons obtaining access to information in the record locator service, which audit log shall contain, at a minimum, information on:

                (1) the identity of the person obtaining access to the information;

                (2) the identity of the individual whose information was obtained;

                (3) the location from which the information was obtained;

                (4) the specific information obtained; and

                (5) the date that the information was obtained.

          D. A person operating a record locator service or a health information exchange shall provide a mechanism under which individuals may exclude their demographic information and information about the location of their electronic medical records from the record locator service. A person operating a record locator service or a health information exchange that receives an individual's request to exclude all of the individual's information from the record locator service is responsible for removing that information from the record locator service within thirty days; provided, however, that the request to exclude information shall not apply to a provider that has provided a service to the patient and retains information about that service.

          E. When demographic information or information in an individual's electronic medical record is requested using a record locator service or a health information exchange:

                (1) the requesting provider or health care institution shall warrant that the request is for the treatment of the individual; and

                (2) the person releasing the information may rely upon the warranty of the person making the request that the request is for the treatment of the individual, is permitted by the individual's written authorization or is otherwise permitted by state or federal law.

          F. Notwithstanding any other provision of law, information in an individual's electronic medical record may be disclosed to a provider that has a need for information about the individual to treat a condition that poses an immediate threat to the life of any individual and that requires immediate medical attention.

          G. Notwithstanding any other provision of law, information in an individual's electronic medical record may be disclosed to a person that uses non-patient-specific information to maintain or improve the health of the general public or to conduct research that has been sanctioned by a legally authorized medical review board; provided, however, that the information disclosed does not include any data that could serve to identify specifically an individual patient and provided further that any individual whose data is disclosed for these purposes has provided written authorization for its use or is otherwise permitted by state or federal law.

     Section 7. OUT-OF-STATE DISCLOSURES.--A disclosure otherwise permissible under the Electronic Medical Records Act may be made to providers, health care group purchasers, health care institutions, health information exchanges or record locator services located or operating outside of the state.

     Section 8. HEALTH CARE REPRESENTATIVES.--A provider, health care institution, health information exchange or health care group purchaser is not subject to regulatory or disciplinary actions or civil liability for:

          A. complying with a request or authorization made by a person having apparent authority to exercise the rights and powers of an individual pursuant to the Electronic Medical Records Act; or

          B. declining to comply with a request or authorization made by a person based on a reasonable belief that the person lacked authority to exercise the rights and powers of an individual pursuant to the Electronic Medical Records Act.

- 9 -