7.1.20 NMAC

TITLE 7 HEALTH

CHAPTER 1 HEALTH GENERAL PROVISIONS

PART 20 ACCESS TO HEALTH INFORMATION SYSTEM DATA AND REPORTS

7.1.20.1 ISSUING AGENCY: New Mexico Health Policy Commission.

[8/30/1997; 7.1.20.1 NMAC - Rn, 7 NMAC 1.20.1, 03/31/2008]

7.1.20.2 SCOPE: This rule applies to all persons who request data or reports based on data maintained as part of the health information system.

[8/30/1997; 7.1.20.2 NMAC - Rn, 7 NMAC 1.20.2, 03/31/2008]

7.1.20.3 STATUTORY AUTHORITY: This rule is promulgated pursuant to Sections 24-14A-3D(5) and 24-14A-6A of the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978.

[8/30/1997; 7.1.20.3 NMAC - Rn, 7 NMAC 1.20.3, 03/31/2008]

7.1.20.4 DURATION: Permanent.

[8/30/1997; 7.1.20.4 NMAC - Rn, 7 NMAC 1.20.4, 03/31/2008]

7.1.20.5 EFFECTIVE DATE: August 30, 1997, unless a later date is cited at the end of a section.

[8/30/1997; 7.1.20.5 NMAC - Rn & A, 7 NMAC 1.20.5, 03/31/2008]

7.1.20.6 OBJECTIVE: The purpose of this rule is to establish the requirements for access to data or reports based on data maintained as part of the health information system.

[8/30/1997; 7.1.20.6 NMAC - Rn, 7 NMAC 1.20.6, 03/31/2008]

7.1.20.7 DEFINITIONS: In addition to the definitions in the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978, the following definitions apply for purposes of this rule.

A. Access level means a set of information or data maintained as part of the health information system which may be released to requestors pursuant to this rule, including:

(1) aggregate analysis;

(2) consumer health information report;

(3) research database;

(4) analytical database;

(5) linking database.

B. Aggregate analysis means information in report form that contains data combined in a manner which precludes specific identification of a single patient or health care provider.

C. Analytical database means a set of annual permanent data based on individual patient hospital discharge abstract data or any other database collected under the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978, that excludes all identifiers of individual patients and health care professionals.

D. Annual permanent database means one calendar year of permanent hospital inpatient discharge data or any other database collected under the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978, that is deemed complete by commission staff.

E. Consumer health information report means a report that provides the public with information on which to base health care purchasing decisions, published by the commission pursuant to Sections 24-14A-3D(11) and 24-14A-3.1D(2) of the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978, and 7 NMAC 1.22 [now 7.1.22 NMAC].

F. Data provider means a data source that has provided data to the health information system on a regular basis.

G. Data source has the meaning given in Section 24-14A-2 of the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978, and includes those categories of persons or entities that possess health information, including any public or private sector licensed hospital, health care practitioner, primary care clinic, ambulatory surgery center, ambulatory urgent care center, ambulatory dialysis unit, home health agency, long-term care facility, pharmacy, third-party payer and any public entity that has health information.

H. Director means the director of the commission.

I. Federal agency means any agency, department, bureau, board, commission, institution or other organization of the United States government.

J. Governing agreement means either a joint powers agreement or a contract signed by the director with approval of the commission.

K. Health care means any care, treatment, service or procedure to maintain, diagnose or otherwise affect an individual’s physical or mental condition.

L. Health care professional means any individual licensed, certified or otherwise authorized or permitted by law to provide health care in the practice of a profession.

M. Health care provider means any individual, corporation, partnership, organization, facility, institution or other entity licensed, certified or otherwise authorized or permitted by law to provide health care in the ordinary course of business or practice of a profession.

N. HEDISÒ data elements means the rate, numerator, denominator, size of the eligible population and data collection methodology for non-tabular measures that are reported as percentages and are contained in the health plan employer data and information set published by the national committee for quality assurance (NCQA). NCQA registered trademark.

O. Health information system or HIS means the health information system established by the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978.

P. HIS advisory committee means the committee the commission establishes pursuant to Section 24-14A-3.1 of the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978.

Q. Hospital inpatient discharge data (HIDD) clinical file means the subset of reported hospital inpatient discharge data containing demographic, medical, inpatient stay and payer information.

R. Hospital inpatient discharge data (HIDD) confidential file means the subset of reported hospital inpatient discharge data containing identifiers of individual patients and health care professionals.

S. Identifier means any information that reveals the identity of, or could reasonably be used to reveal the identity of, a single patient, data provider or health care provider, but does not include a number assigned to a single patient for the purpose of conducting longitudinal or linking studies.

T. Linked file means the data that results from the co-joining of the linking database with another database.

U. Linking database means the available set of permanent hospital inpatient discharge data based upon individual patient hospital discharge abstract data or any other database collected under the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978, that may contain specific patient or health care provider demographic and clinical information. The linking database also includes identifiers used solely in accordance with 7.1.20.13 NMAC for the purpose of linking to other existing health data.

V. Patient means a person for whom health information is contained in the health information system.

W. Permanent hospital inpatient discharge data means hospital inpatient discharge data contained in a data set created by the commission after the submitting data provider has either (1) reviewed and approved a commission statistical report based on the data provider’s patient discharges, or (2) been provided a 30 day period to review the commission’s statistical report.

X. Proprietary information means confidential technical information, administrative information, and/or business methods that are the property of the data provider and are perceived to confer a competitive position in the health care market by not being openly known by competitors.

Y. Requestor means a person who makes a request for access to health information system data or reports pursuant to this rule.

Z. Research database means a set of annual permanent data based on individual patient hospital discharge abstract data or any other database collected under the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978, that excludes all identifiers of individual patients, health care providers, and third-party payers of health care.

AA. Research organization means an organization that conducts health-related research and that is recognized by the commission as a source for information that is useful for consumer health care decision making or for development of public policy related to health.

BB. Routine report means a report that contains information of use to the general public that is issued by the commission on its own initiative and not in response to a specific, individualized request.

CC. State agency means any agency, department, bureau, board, commission, institution or other organization of a state government, including state educational institutions and political subdivisions. “State agency” does not include any health care facility operated by a state agency.

[8/30/1997; 7.1.20.7 NMAC - Rn & A, 7 NMAC 1.20.7, 03/31/2008]

7.1.20.8 GENERAL PROVISIONS ON ACCESS TO HIS DATA:

A. Access requirements: Data and reports based on access levels in the HIS may be obtained only in accordance with the requirements of the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978, and this rule.

B. Evaluation of requests: In addition to other requirements stated in this rule, all requests for HIS data and reports, other than routine reports, shall be evaluated by the commission and commission staff and shall satisfy the following criteria for approval:

(1) the specific intended use of the data shall comport with the purposes of the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978, as stated in Section 24-14A-3A and rules promulgated pursuant to the act, including use of data to assist in:

(a) the performance of health planning and policy making functions for the benefit of the public;

(b) informed health care decision making by consumers;

(2) the request shall be consistent with the responsibilities of the commission in accomplishing the priorities of the HIS.

C. Request procedures: All requests for data shall be made pursuant to the requirements of 7.1.20.14 NMAC.

D. Fees: Fees for access to data and reports shall be paid pursuant to the requirements of 7.1.20.15 NMAC.

E. Restrictions on specificity: Information at a level of specificity that might compromise patient confidentiality or data provider proprietary information, as determined by commission staff, shall not be released.

F. Restrictions on access to sensitive data: The commission shall have the authority to deny access to information in the research, clinical or linking database where use of the information, as determined by the commission, could result in violation of a patient’s privacy, such as data on certain diagnosis codes or code ranges.

G. Compliance with other laws: The commission shall ensure that any access to data that is subject to restrictions on use pursuant to state, federal or tribal law or regulation, or any other legal agreement, complies with those restrictions.

H. Disclaimer: The commission shall include a disclaimer in all HIS data and reports released pursuant to this rule stating that the accuracy of the original data is the responsibility of the submitting data provider and that the commission assumes no responsibility for any use made of or conclusions drawn from the data.

I. Agency contractors:

(1) A state or federal agency that receives HIS data or reports under an agreement with the commission pursuant to Sections 11, 12 or 13 of 7.1.20 NMAC shall be solely responsible for fulfillment of the agreement, including responsibility for the actions of any subcontractor engaged to perform services that require access to HIS data or reports.

(2) No state or federal agency shall subcontract any portion of services to be performed under an agreement with the commission without prior written approval of the commission.

(3) A state or federal agency subcontractor that is provided access to HIS data or reports shall be subject to the full provisions of the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978, and this rule, including Sections 18, 19 and 20 of 7.1.20 NMAC.

(4) In no event shall a data provider engaged as a subcontractor to a state or federal agency obtain access to data in the research, analytical or linking database.

J. Public data: The restrictions that apply to the release of data provider specific information do not apply when the data provider is a government agency and the data provided to the HIS otherwise would be considered public data in accordance with the Public Records Act, Section 14-3-1 et seq. NMSA 1978, and the Open Meetings Act, Section 10-15-1 et seq. NMSA 1978.

[12/16/1994; Rn, 7 NMAC 1.1.9.1 & 7 NMAC 1.1.9.2, 8/30/1997; A, 8/30/1997; 7.1.20.8 NMAC - Rn, 7 NMAC 1.20.8, 03/31/2008]

7.1.20.9 ACCESS TO AGGREGATE ANALYSIS: Pursuant to the requirements of 7.1.20.8 NMAC, as determined by commission staff, any person may obtain access to aggregate analysis in the form of routine reports or non-routine reports pursuant to the procedures in 7.1.20.14 NMAC.

[8/30/1997; 7.1.20.9 NMAC - Rn, 7 NMAC 1.20.9, 03/31/2008]

7.1.20.10 ACCESS TO CONSUMER HEALTH INFORMATION REPORT DATA:

A. Release of reports: The commission shall release consumer health information reports to the public on a periodic schedule as determined by the commission in accordance with 7 NMAC 1.22 [now 7.1.22 NMAC].

B. Prohibition on access to HEDIS data elements: No person may obtain access to the HEDISÒ data elements underlying a consumer health information report except for government agencies in accordance with the requirements in 7.1.20.12 NMAC NCQA registered trademark.

[8/30/1997; 7.1.20.10 NMAC - Rn, 7 NMAC 1.20.10, 03/31/2008]

7.1.20.11 ACCESS TO RESEARCH DATABASE:

A. Research organizations and government agencies: Pursuant to the requirements of 7.1.20.8 NMAC, a research organization, New Mexico state agencies, state agencies of other states, and federal agencies may obtain access to data in or reports based on the subset or portion of the research database that is relevant to the organization’s or agency’s stated purpose upon approval of the request by the director. The director may require an organization or agency to agree to specific confidentiality and use requirements prior to release of the data or reports. Federal agencies may obtain this information only if the agency agrees to fully protect its confidentiality as provided by federal law. No other person shall have access to data in or nonaggregate analytical reports based on the research database.

B. Protection of identity: Any data or report that is provided from the research database shall be configured in a manner that precludes actual or potential identification of individual patients, health care providers and third-party payers of health care.

[8/30/1997; 7.1.20.11 NMAC - Rn, 7 NMAC 1.20.11, 03/31/2008]

7.1.20.12 ACCESS TO ANALYTICAL DATABASE:

A. Government agencies: Pursuant to the requirements of 7.1.20.8 NMAC, New Mexico state agencies, state agencies of other states, and federal agencies may obtain access to data in or reports based on the subset or portion of the analytical database that is relevant to the agency’s stated purpose upon approval of the request by the director after review by the data access advisory board pursuant to 7.1.20.16 NMAC. The director may require an agency to agree to specific confidentiality and use requirements prior to release of the data or reports. Federal agencies may obtain this information only if the agency agrees to fully protect its confidentiality as provided by federal law. No other person shall have access to data in or nonaggregate analytical reports based on the analytical database.

B. Protection of identity: Any data or report that the commission provides from the analytical database shall be configured in a manner that precludes actual or potential identification of individual patients and health care professionals.

[8/30/1997; 7.1.20.12 NMAC - Rn, 7 NMAC 1.20.12, 03/31/2008]

7.1.20.13 ACCESS TO LINKING DATABASE:

A. Persons authorized to link: New Mexico state agencies, state agencies of other states, and federal agencies may be authorized to link their databases with the subset or portion of the linking database that is relevant to the agency’s stated purpose if the commission approves the request after review by the data access advisory board pursuant to 7.1.20.16 NMAC. No other person shall have access to the linking database.

B. Ownership of data: When the linking database is used to create a linked file, the linked file shall be jointly owned by the contributing parties for the purposes stated in the governing agreement required by Subsection C of 7.1.20.13 NMAC. Prior to permitting access to the linking database, all parties, including the commission as administrator of the HIS, must approve both the use of their contributed data and the use of data in the resulting linked file that could not have been derived without their contributed data.

C. Governing agreements:

(1) General requirements: All linking to the linking database shall be conducted pursuant to a governing agreement, the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978, and this rule. The commission shall enter into a governing agreement with any New Mexico state agency, agency of another state or federal agency that is permitted to link its database with the linking database. This agreement shall contain specific confidentiality and use requirements. A federal agency may be authorized to link to the linking database only if the agency agrees to fully protect the confidentiality of the data as provided by federal law.

(2) Medicaid information: A governing agreement entered into pursuant to this section shall protect of the confidentiality of any medicaid recipient identifier information that is used. The human services department shall approve any governing agreement that authorizes linking to medicaid data in the linking database to ensure that the federal requirements for use of medicaid data are satisfied. The requestor shall bear the responsibility of obtaining this approval in writing from the human services department.

D. Prohibition on dual possession: In no event shall a requestor be in possession of both the HIDD confidential file and the HIDD clinical file at the same time.

E. Prohibition on patient identifiers: Linked files derived from the linking database shall not contain any patient identifiers.

F. Return of data: The requestor shall return the HIDD confidential file and the HIDD clinical file to the commission upon completion of the linking process and shall not retain any copies of either of these files.

[8/30/1997; 7.1.20.13 NMAC - Rn, 7 NMAC 1.20.13, 03/31/2008]

7.1.20.14 PROCEDURES FOR REQUESTS OF DATA:

A. Requests for routine reports: Requests for copies of routine reports produced by the commission for public use shall be made either verbally or in writing. Fees for these reports shall be paid in accordance with Subsection A of 7.1.20.15 NMAC.

B. Requests for previously-prepared, non-routine reports: Requests for copies of previously-prepared, non-routine reports shall be made in writing. These reports shall be made available pursuant to the requirements of this rule. Fees for these reports shall be paid in accordance with Subsection B of 7.1.20.15 NMAC.

C. Individualized requests: Requests for not previously-prepared, non-routine reports or for data contained in the research, analytical or linking database shall be made in writing by specifying the following information on a request form provided by the commission:

(1) date of request;

(2) name, address and organizational affiliation;

(3) specific data or analysis requested;

(4) specific intended use of the data, including proposed analytical or research methodology, together with an acknowledgment that the data will not be used in violation of Subsection B of 7.1.20.19 NMAC;

(5) desired date by which the information is needed, allowing a minimum of two weeks to process the request;

(6) for requests for data, the names and positions of individuals who will have access to the data if the request is granted;

(7) for requests for data, the requestor’s specific plans for protecting the confidentiality and use of the data in accordance with the requirements of the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978, and this rule; and

(8) any additional information the commission may request.

D. Review of requests for data: Commission staff shall conduct a preliminary review of requests made for HIS data or reports and may require the requestor to submit supplemental information to achieve a final project request. As required by this rule, commission staff shall make the determination on whether to grant the request or refer the request to the data access advisory board as appropriate. Requestors shall be notified of whether the request meets the criteria for approval within a reasonable period of time from the initial date of the request. The commission shall make reasonable efforts to review requests expeditiously within available resources.

E. Fee estimate: If a request for data or reports made pursuant to Subsection C of 7.1.20.14 NMAC is approved, commission staff shall prepare a preliminary estimate of the fee required for preparing the data or report, in accordance with 7.1.20.15 NMAC. This estimate, which shall not serve as a guarantee of final charges, shall be included with the notification of approval or disapproval provided pursuant to Subsection D of 7.1.20.14 NMAC. If the requestor agrees to pay the fee, commission staff shall proceed with preparing the data or report.

F. Provision of data: Commission staff shall prepare data or reports for approved requests within a reasonable period of time given the nature of the request, making reasonable efforts to prepare the information expeditiously within available resources. Linkage to the linking database shall be conducted within a reasonable period of time from the date the governing agreement is signed by all the parties.

[8/30/1997; 7.1.20.14 NMAC - Rn, 7 NMAC 1.20.14, 03/31/2008]

7.1.20.15 FEES FOR DATA AND REPORTS:

A. Fees for routine reports:

(1) Generally: The fees for copies of available routine reports produced for public use shall be as follows:

(a) single copies of any consumer health information reports or HIS annual reports shall be provided free of charge upon request; and

(b) all other reports shall be provided for $10.00 per report.

(2) Data providers: Data providers shall receive one free copy of the commission’s routine reports upon request.

B. Previously-prepared reports: The fee for copies of available previously-prepared, non-routine reports provided to persons other than the original requestor for whom the report was prepared shall be $20.00 per report.

C. Fees for data and non-routine reports: The fee for preparing data and non-routine reports that have not been previously prepared shall be charged at the hourly rate of the analyst(s) preparing the data or report, as follows:

(1) data providers shall be charged a rate of $50.00 per analyst hour;

(2) state agencies shall be charged a rate of $75.00 per analyst hour; and

(3) all others shall be charged a rate of $100.00 per analyst hour.

D. Electronic media reports: Fees for reports made available on computer tape or other electronic media may include charges for the cost of the magnetic tape, diskette or other electronic media, in addition to the fees required by this section.

E. Waiver or reduction of fees:

(1) Standard for waiver or reduction: The director may reduce or waive the fee for data and non-routine reports that have not been previously prepared when the director determines that the requestor’s proposed use of the information would be of value to the commission in fulfilling its statutory mandates to a degree equal to or greater than the fee reduction or waiver.

(2) Payment upon failure to perform: When a fee waiver or reduction has been granted and the research for which the fee was waived or reduced is not completed, or the product for which the fee was waived or reduced is not delivered to the commission, the full fee shall be assessed in accordance with Subsection C of 7.1.20.15 NMAC.

F. Statement of fees: The commission shall prepare a statement of the fee for requests made pursuant to Subsection C of 7.1.20.14 NMAC and provide it to the requestor with the data or report. The fee must be paid no later than 30 days after receipt of the data or report.

[12/16/1994; Rn, 7 NMAC 1.1.12, 8/30/1997; A, 8/30/1997; 7.1.20.15 NMAC - Rn & A, 7 NMAC 1.20.15, 03/31/2008]

7.1.20.16 DATA ACCESS ADVISORY BOARD:

A. Purpose: A data access advisory board shall review requests for access to data in or reports based on the analytical database or linking database as required by this rule and shall make recommendations to the director or the commission on whether to grant the requests.

B. Membership: The commission shall appoint five members of its HIS advisory committee to the data access advisory board for two year renewable terms. To the extent feasible, the membership shall include representatives of hospitals, voluntary data providers and consumer interests, as well as individuals with experience in epidemiology, law, research and privacy, data management or other relevant fields. A commission staff member shall be the nonvoting chair of the board.

C. Meetings: The data access advisory board shall meet as frequently as reasonably necessary to review requests for access to HIS data as required by this rule, or when requested by the data access advisory board chair. A quorum shall consist of the majority of the appointed members of the board.

D. Requests for access to analytical database: In determining whether to recommend to the director approval of a request for data in or reports based on the analytical database, the data access advisory board shall evaluate whether the following criteria are satisfied:

(1) the information supplied on the request form shall adequately support the request;

(2) the qualifications of the requestor shall be sufficiently established, including that the requestor shall be reputable and have no prior violations for use of data; and

(3) the intended use of the requested information shall:

(a) satisfy the requirements of 7.1.20.8 NMAC, including that the use of the data shall be consistent with the stated purposes of the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978;

(b) be credible and relevant to the requestor’s stated purposes; and

E. Requests for access to the linking database: In determining whether to recommend to the commission approval of a request for access to the linking database, the data access advisory board shall evaluate whether the following criteria are satisfied:

(1) all the criteria listed in Subsection D of 7.1.20.16 NMAC shall be met;

(2) the requestor’s purpose shall be impractical without access to the linking database;

(3) the requestor shall demonstrate sufficient capability to perform the linking process, including financial and personnel resources; and

(4) the requestor’s intended use of the information shall:

(a) contain reasonable safeguards, as determined by the board, to protect the information from redisclosure; and

(b) contain reasonable safeguards, as determined by the board, to protect against the identification of any patient in any report produced by the requestor based on the data.

F. Review of recommendation: The data access advisory board shall report to the director or the chair of the commission, as required by this rule, the board’s recommendation on approval, denial or modification of a request for access to data in or reports based on the analytical database or linking database. Where authorized by the rule, the director or the commission shall determine whether to grant the request.

[8/30/1997; 7.1.20.16 NMAC - Rn, 7 NMAC 1.20.16, 03/31/2008]

7.1.20.17 APPEAL OF DENIAL OF REQUESTS FOR DATA:

A. Appeal of commission staff determinations: Requestors who are denied access to HIS data or reports by commission staff, where commission staff is authorized to make the determination, may appeal the denial to the director. The director shall review the denial and make a decision on the request. Requestors may appeal the director’s denial of a request to the commission. The commission shall make a final determination on the request.

B. Appeal of commission determinations: The commission’s decision on whether to grant a request for access to HIS data or reports is a final determination.

[8/30/1997; 7.1.20.17 NMAC - Rn, 7 NMAC 1.20.17, 03/31/2008]

7.1.20.18 OBLIGATIONS UPON RECEIPT OF DATA:

A. Specific requirements: Requestors and any individuals who are permitted access to HIS data or reports through approval of a request made pursuant to Subsection C of 7.1.20.14 NMAC shall:

(1) limit use of the information to the purposes stated on the request form;

(2) give full credit to the commission in any published or unpublished reports using HIS information;

(3) include a disclaimer in any published or unpublished reports using HIS information which states that the accuracy of the original data is the responsibility of the submitting data provider and that the commission assumes no responsibility for any use made of or conclusions drawn from the data; and

(4) provide the commission with a copy of any reports and linked files resulting from access to the linking database.

B. Prior approval: The director shall review and approve in advance of distribution any report or analysis produced using data from the analytical database or the linking database to any person beyond those specified in the request made pursuant to Subsection C of 7.1.20.14 NMAC. Reports or analysis of this nature shall not be released if disapproved by the director.

[8/30/1997; 7.1.20.18 NMAC - Rn, 7 NMAC 1.20.18, 03/31/2008]

7.1.20.19 CONFIDENTIALITY REQUIREMENTS FOR USE OF DATA:

A. Confidentiality pledge: Requestors and any individuals who are permitted access to data in the research database, analytical database or linking database shall sign and abide by a pledge of confidentiality in the use of the data, on a form provided by the commission.

B. Prohibition on use: Data or information obtained in accordance with this rule shall not under any circumstance be used for the purpose of identifying, locating or contacting individual patients or their families.

C. Scope of confidentiality: All data provided to the HIS under the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978, shall be subject to the confidentiality requirements of the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978. This includes any linked files provided to the commission pursuant to Paragraph of 4 of Subsection A of 7.1.20.18 NMAC.

[8/30/1997; 7.1.20.19 NMAC - Rn, 7 NMAC 1.20.19, 03/31/2008]

7.1.20.20 REDISCLOSURE OF DATA: Requestors and any individuals who are permitted access to data in or non-routine reports based on the research database, analytical database or linking database shall not:

A. provide the data or portion of it to any persons other than those identified in the request form; or

B. resell any portion of the data, aggregate data, analysis, linked file or other information gained as a result of obtaining access to the data.

[8/30/1997; 7.1.20.20 NMAC - Rn, 7 NMAC 1.20.20, 03/31/2008]

7.1.20.21 REPORTS AVAILABLE THROUGH THE STATE LIBRARY DEPOSITORY SYSTEM: Paper copies of all public use routine reports produced by the commission shall be available to the public through the state library depository system.

[12/16/1994; Rn, 7 NMAC 1.1.11, 8/30/1997; A, 8/30/1997; 7.1.20.21 NMAC - Rn, 7 NMAC 1.20.21, 03/31/2008]

7.1.20.22 PENALTIES FOR RULE VIOLATION:

A. Commission sanctions: A requestor who violates the requirements of this rule may be subject to any or all of the following sanctions, as determined by the commission:

(1) temporary or permanent denial of access to HIS data or reports;

(2) termination of current access; and

(3) mandated immediate return, without duplication, of HIS data or reports provided by the commission.

B. Other penalties: A requestor who violates the requirements of this rule or the Health Information System Act, Section 24-14A-1 et seq. NMSA 1978, may be subject to sanctions provided in applicable state, federal or tribal laws or regulations, including but not limited to injunctive relief and civil penalties of up to $1,000 per violation.

[8/30/1997; 7.1.20.22 NMAC - Rn, 7 NMAC 1.20.22, 03/31/2008]

HISTORY OF 7.1.20 NMAC:

Pre-NMAC History: none.

History of Repealed Material: [RESERVED]

Other History:

7 NMAC 1.20, Access to Health Information System Data Reports (filed 08/14/1997), was renumbered, reformatted, amended and replaced by 7.1.20 NMAC, Access to Health Information System Data Reports, effective 03/31/2008.