SB0189

SENATE BILL 189

53rd legislature - STATE OF NEW MEXICO - first session, 2017

INTRODUCED BY

Gerald Ortiz y Pino and Mary Kay Papen

AN ACT

RELATING TO HEALTH CARE INFORMATION; LIMITING LIABILITY FOR PARTICIPATION IN A HEALTH INFORMATION EXCHANGE; REQUIRING THE DEVELOPMENT OF A PLAN FOR THE INTEROPERABILITY OF ELECTRONIC HEALTH RECORDS ACROSS HEALTH CARE PROVIDERS STATEWIDE; REQUIRING PARTICIPATION IN A STATEWIDE INTEROPERABLE INTEGRATED HEALTH INFORMATION EXCHANGE; PROVIDING FOR CRIMINAL PENALTIES.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF NEW MEXICO:

SECTION 1. Section 24-14B-1 NMSA 1978 (being Laws 2009, Chapter 69, Section 1) is amended to read:

"24-14B-1. SHORT TITLE.--[This act] Chapter 24, Article 14B NMSA 1978 may be cited as the "Electronic [Medical] Health Records Act"."

SECTION 2. Section 24-14B-2 NMSA 1978 (being Laws 2009, Chapter 69, Section 2) is amended to read:

"24-14B-2. PURPOSE.--The purpose of the Electronic [Medical] Health Records Act is to provide for the use, disclosure and protection of electronic [medical] health records."

SECTION 3. Section 24-14B-3 NMSA 1978 (being Laws 2009, Chapter 69, Section 3) is amended to read:

"24-14B-3. DEFINITIONS.--As used in the Electronic [Medical] Health Records Act:

A. "demographic information" means information that identifies the individual who is the subject of the health care information, including the individual's name, date of birth and address and other information necessary to identify the individual, that may be used to identify the individual or that associates the individual with the individual's electronic [medical] health record;

B. "disclose" means to release, transfer, provide, give access to or otherwise divulge in any other manner information outside the entity holding the information;

C. "electronic" means relating to technology having electrical, digital, magnetic, wireless, optical, electromagnetic or similar capabilities;

D. "electronic [medical] health record" means an electronic record of an individual patient's health care information [that may contain demographic information];

E. "electronic health record system" means a system that meets requirements specified in Section 8 of this 2017 act, national requirements for certification pursuant to the federal Health Information Technology for Economic and Clinical Health Act, enacted as part of the federal American Recovery and Reinvestment Act of 2009, and federal regulations adopted pursuant to the Health Information Technology for Economic and Clinical Health Act;

[E.] F. "electronic signature" means an electronic sound, symbol or process attached to or logically associated with a record and executed or adopted by an individual with the intent to sign the record;

[F.] G. "health care" means care, services or supplies related to the health of an individual and includes:

(1) preventive, diagnostic, therapeutic, rehabilitative, maintenance or palliative care and counseling;

(2) services, assessments or procedures that are concerned with the physical or mental condition or functional status of an individual or that affect the structure or function of the body of an individual; and

(3) the sale or dispensing of a drug, a device, a piece of equipment or other item in accordance with a prescription;

[G.] H. "health care group purchaser" means a person who is licensed, certified or otherwise authorized or permitted by the New Mexico Insurance Code to pay for or purchase health care on behalf of an identified individual or group of individuals, regardless of whether the cost of coverage or services is paid for by the purchaser or the persons receiving coverage or services;

[H.] I. "health care information" means any information [whether oral or] recorded in any form or medium, related to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual;

[I.] J. "health care institution" means an institution, facility or agency licensed, certified or otherwise authorized or permitted by law to provide health care in the ordinary course of business;

[J.] K. "health information exchange" means an arrangement among persons participating in a defined secure electronic network service [such as a regional health information organization] that allows the sharing of health care information [about individual patients] among different health care institutions or unaffiliated providers. The use of an electronic [medical] health record system by a [health care] provider, by or within a health care institution or by an organized health care arrangement as defined by the federal Health Insurance Portability and Accountability Act of 1996 does not constitute a health information exchange;

L. "health information organization" means an organization that oversees, governs and facilitates the exchange of health care information among providers that are not related health care entities to improve coordination of patient care and efficiency of health care delivery;

[K.] M. "information" means data, including text, images, sounds and codes and computer programs, software and databases;

[L. "provider" means an individual who, is licensed, certified or otherwise authorized or permitted by law to provide health care in the ordinary course of business or practice of a profession;]

N. "interoperable" means capable of:

(1) exchanging electronic health information with, and using electronic health information from, other systems without special effort on the part of the user;

(2) enabling users to send, receive, find and use electronic health information in a manner that is appropriate, secure, timely and reliable to support informed decision-making;

(3) supporting critical public health functions such as real-time case reporting, disease surveillance and disaster response; and

(4) supporting data aggregation for research;

O. "interoperable qualified electronic health record" means a qualified electronic health record that:

(1) securely exchanges health information with another electronic health record system;

(2) allows authorized users access to the entirety of a patient's data from any and all qualified electronic health records without restriction, in one location, without the need for multiple interfaces; and

(3) does not block access to other qualified electronic health records;

P. "laboratory" means a facility accredited pursuant to the federal clinical laboratory improvement amendments for the biological, microbiological, serological, chemical, immunohematological, hematological, biophysical, cytological, pathological or other examination of materials derived from the human body for the purpose of providing information for the diagnosis, prevention or treatment of any disease or impairment of, or the assessment of the health of, human beings and includes procedures to determine, measure or otherwise describe the presence or absence of various substances or organisms in the body;

Q. "provider" means:

(1) a health care institution;

(2) an individual or group of individuals licensed, certified or otherwise authorized to deliver health care in the ordinary course of business; and

(3) a laboratory;

R. "qualified electronic health record" means an electronic health record that includes patient demographic and clinical health information and that has the capacity to:

(1) provide clinical decision support;

(2) support provider order entry;

(3) capture and query information relevant to health care quality; and

(4) exchange electronic health information with, and integrate such information from, other sources;

[M.] S. "record" means information that is inscribed on a tangible medium or that is stored in an electronic or other medium and is retrievable in perceivable form

[N. "record locator service" means an information service that contains demographic information and the location of health care information of a specified individual across different health care institutions or unaffiliated providers that participate in the service. The use of an electronic medical record system by a health care provider or by an organized health care arrangement as defined by the federal Health Insurance Portability and Accountability Act of 1996 does not constitute a record locator service]; and

[O.] T. "treatment" means the provision, coordination or management of health care and related services by one or more providers, including the coordination or management of health care by a provider with a third party; consultation between providers relating to an individual; or the referral of an individual for health care from one provider to another."

SECTION 4. Section 24-14B-4 NMSA 1978 (being Laws 2009, Chapter 69, Section 4) is amended to read:

"24-14B-4. ELECTRONIC [MEDICAL] HEALTH RECORDS-- ELECTRONIC SIGNATURES--LEGAL RECOGNITION.--If a law or rule requires a [medical] health record to be in writing, or if a law or rule requires a signature pertaining to a [medical] health record, an electronic [medical] health record or an electronic signature satisfies that law or rule, except for a court rule."

SECTION 5. Section 24-14B-5 NMSA 1978 (being Laws 2009, Chapter 69, Section 5) is amended to read:

"24-14B-5. RETENTION OF ELECTRONIC [MEDICAL] HEALTH RECORDS.--

A. If a law or rule requires that a [medical] health record be retained, the requirement is satisfied by retaining an electronic record that:

(1) accurately reflects the [medical] health record; and

(2) remains accessible and is capable of being accurately reproduced for later reference.

B. If a law or rule requires a [medical] health record to be presented or retained in its original form or provides consequences if the [medical] health record is not presented or retained in its original form, that law or rule is satisfied by an electronic [medical] health record retained in accordance with Subsection A of this section.

C. A [medical] health record retained as an electronic [medical] health record in accordance with Subsection A of this section satisfies a law or rule requiring a person to retain a [medical] health record for evidentiary, audit or other purposes."

SECTION 6. Section 24-14B-6 NMSA 1978 (being Laws 2009, Chapter 69, Section 6) is repealed and a new Section 24-14B-6 NMSA 1978 is enacted to read:

"24-14B-6. [NEW MATERIAL] USE AND DISCLOSURE OF ELECTRONIC HEALTH CARE INFORMATION AND ELECTRONIC HEALTH RECORDS.--

A. A provider, health information organization, health information exchange or group health purchaser shall not use or disclose health care information in an individual's electronic health record to another person without the consent of the individual, except as allowed by state or federal law.

B. With respect to electronic health records under its care, custody and control, a health information organization operating a health information exchange shall:

(1) authenticate and audit access to such records; and

(2) maintain an audit log of persons obtaining access to such records, which audit log shall contain at a minimum:

(a) the identity of the person obtaining access to such records;

(b) the identity of the individual whose records were accessed;

(d) the date and time that each record was accessed.

C. A health information organization operating a health information exchange shall make the audit log required in Subsection B of this section available to the individual whose electronic health record has been disclosed or to such individual's authorized representative; provided that the audit log shall only contain information related to the electronic health record of such individual. The audit log shall be made available annually to the requester for a fee not to exceed twenty-five cents ($.25) per page as established by the department of health.

D. A health information organization operating a health information exchange shall provide a mechanism for an individual or the individual's authorized representative to request the health information organization in writing to deny access to the entirety of the individual's current or past electronic health records under any circumstances, including an emergency. A health information organization or a health information exchange shall comply with the written request to deny access within thirty days of its receipt.

E. A person requesting an individual's electronic health record from a health information organization or a health information exchange shall warrant that the request is for the treatment of the individual, is allowed pursuant to written authorization from the individual or is otherwise allowed by state or federal law. The person disclosing such record may rely upon the warranty of the person making the request.

F. Notwithstanding any other provision of law, an individual's electronic health record may be disclosed:

(1) except as provided by Subsection D of this section, to a provider that has a need for an individual's health care information to treat a condition that poses an immediate threat to the life of any individual and that requires immediate medical attention; and

(2) except as provided in the Electronic Health Records Act, to a health information organization or a health information exchange for the development and operation of the health information exchange or a statewide interoperable integrated health information exchange."

SECTION 7. Section 24-14B-7 NMSA 1978 (being Laws 2009, Chapter 69, Section 7) is repealed and a new Section 24-14B-7 NMSA 1978 is enacted to read:

"24-14B-7. [NEW MATERIAL] LIMITATION OF LIABILITY--PENALTIES.--

A. A health information organization or a health information exchange shall not be liable for any harm caused by denying access to an individual's electronic health record as requested by the individual or the individual's authorized representative pursuant to Subsection D of Section 24-14B-6 NMSA 1978.

B. A provider that participates in a health information exchange in accordance with the provisions of the Electronic Health Records Act shall not be liable for damages arising from the transfer of an interoperable qualified electronic health record to or from a health information organization or a health information exchange.

C. A provider shall not be liable for damages arising from the disclosure of health care information by:

(1) a health information organization or a health information exchange to which the provider has transferred an interoperable qualified electronic health record; or

(2) another provider participating in a health information exchange.

D. Nothing in this section shall limit or expand confidentiality rights afforded to a patient by other state or federal law.

E. Whoever intentionally discloses or makes use of health care information in violation of the Electronic Health Records Act is guilty of a petty misdemeanor and, upon conviction, shall be sentenced pursuant to the provisions of Subsection B of Section 31-19-1 NMSA 1978."

SECTION 8. A new section of the Electronic Health Records Act is enacted to read:

"[NEW MATERIAL] DUTY OF HEALTH INFORMATION ORGANIZATION OR HEALTH INFORMATION EXCHANGE--DATA SECURITY.--A health information organization or a health information exchange that collects, transmits, disseminates, accesses or reports health care information pursuant to the Electronic Health Records Act shall comply with all applicable state and federal law, including secure electronic data submission requirements."

SECTION 9. Section 24-14B-8 NMSA 1978 (being Laws 2009, Chapter 69, Section 8) is amended to read:

"24-14B-8. OUT-OF-STATE DISCLOSURES.--A disclosure otherwise permissible under the Electronic [Medical] Health Records Act may be made to providers, health care group purchasers, health [care institutions] information organizations or health information exchanges [or record locator services] located or operating outside of the state."

SECTION 10. A new section of the Electronic Health Records Act is enacted to read:

"[NEW MATERIAL] STATEWIDE INTEROPERABLE INTEGRATED HEALTH INFORMATION EXCHANGE PLAN--REPORTING.--

A. No later than June 30, 2018, the secretary of health shall develop a plan for implementing a statewide interoperable integrated health information exchange in accordance with federal guidelines for shared data sets and interoperability.

B. No later than September 1, 2018, the secretary of health shall make a written report and, upon request, an oral report, regarding the details of the plan and provide the report to the governor, the legislative health and human services committee and the legislative finance committee. The report shall include recommendations for:

(1) achieving maximum cooperation among providers in supplying data to the statewide interoperable integrated health information exchange and accessing the system when providing health care. These recommendations shall include a recommendation as to the most effective incentives or penalties to ensure participation;

(2) information technology system and system operator capabilities;

(3) funding for the full establishment, integration and operation of the statewide interoperable integrated health information exchange;

(4) provisions for sustainability and oversight to ensure the ongoing viability of the statewide interoperable integrated health information exchange;

(5) removing financial and telecommunications access barriers to ensure that providers that are single- or small-group proprietors or that are located in rural and frontier areas are able to participate fully;

(6) increasing statewide interoperable integrated health information exchange efficiency and quality of outcomes;

(7) improving providers' ability to avoid adverse events; and

(8) timely access to information from all of a patient's providers.

C. At a minimum, the secretary of health shall invite representatives from the following entities to participate in the development of the plan for a statewide interoperable integrated health information exchange:

(1) the human services department;

(2) the office of superintendent of insurance;

(3) the interagency benefits advisory committee;

(4) the corrections department;

(5) an entity with expertise in health information exchanges;

(6) the New Mexico association of radiologists;

(7) the New Mexico medical society;

(8) laboratories whose principal places of business are located in the state;

(9) health insurers operating in the state;

(10) the New Mexico primary care association;

(11) the behavioral health providers association of New Mexico;

(12) the New Mexico hospital association;

(13) the New Mexico pharmacists association; and

(14) the New Mexico dental association.

D. No later than September 1, 2018, the secretary of health shall designate one or more health information organizations or health information exchanges to implement a statewide interoperable integrated health information exchange."

SECTION 11. A new section of the Electronic Health Records Act is enacted to read:

"[NEW MATERIAL] LEVERAGING FEDERAL MATCHING FUNDS-- REPORTING.--

A. Beginning in 2017 and no later than each September 1, the secretary of human services shall make an annual written report to the legislative finance committee and the legislative health and human services committee on the status of:

(1) efforts to apply for all available federal matching funds to promote, establish, develop, administer and sustain a statewide interoperable integrated health information exchange; and

(2) efforts to obtain allowable bona fide donations to the state to be used for the state's portion of the matched funds.

B. The secretary of human services shall make the annual written report required by Subsection A of this section for as long as federal matching funds are available for such purpose. A copy of each annual report shall be transmitted to the legislative council service library."

SECTION 12. Section 24-14B-9 NMSA 1978 (being Laws 2009, Chapter 69, Section 9) is amended to read:

"24-14B-9. EXCLUSION OF CERTAIN INSURERS.--Nothing in the Electronic [Medical] Health Records Act shall be construed to apply to a person operating as a property and casualty insurer, workers' compensation insurer, life insurer, long-term care insurer or disability income insurer."

SECTION 13. Section 24-14B-10 NMSA 1978 (being Laws 2009, Chapter 69, Section 10) is amended to read:

"24-14B-10. STATE AGENCY--ELECTRONIC [MEDICAL] HEALTH RECORDS.--If a state agency requires the use of electronic [medical] health records for any type of health care or health coverage program, the agency shall allow a provider, health care group purchaser, [health care institution] health information exchange [provider, record locator service] or any other person to use any public, proprietary or open source hardware or software; provided that the hardware or software complies with federal interoperability-certified laws or rules."

SECTION 14. A new section of the Health Care Purchasing Act is enacted to read:

"[NEW MATERIAL] PARTICIPATION IN STATEWIDE INTEROPERABLE INTEGRATED HEALTH INFORMATION EXCHANGE.--The publicly funded health care agencies, political subdivisions and other persons providing health care benefits through the consolidated purchasing single process shall require each entity providing group health coverage, including any form of self-insurance offered, issued or renewed under the Health Care Purchasing Act on or after January 1, 2019, to participate in a statewide interoperable integrated health information exchange as determined by the secretary of health pursuant to the Electronic Health Records Act."

SECTION 15. A new section of the Medicaid Provider Act is enacted to read:

"[NEW MATERIAL] PARTICIPATION IN STATEWIDE INTEROPERABLE INTEGRATED HEALTH INFORMATION EXCHANGE.--For medicaid-related services to be rendered on or after January 1, 2019, the department shall require each managed care organization operating under contract with the department to participate in a statewide interoperable integrated health information exchange as determined by the secretary of health pursuant to the Electronic Health Records Act."

SECTION 16. A new section of Chapter 59A, Article 2 NMSA 1978 is enacted to read:

"[NEW MATERIAL] PARTICIPATION IN STATEWIDE INTEROPERABLE INTEGRATED HEALTH INFORMATION EXCHANGE.--The superintendent shall promulgate rules to be effective no later than January 1, 2019 to require each group health plan, health insurer, health maintenance organization and nonprofit health care plan to participate in a statewide interoperable integrated health information exchange as determined by the secretary of health pursuant to the Electronic Health Records Act."

- 19 -