Summary:

 Senate Bill 404 (SB404) strengthening privacy protections for patient records by requiring segregation of certain health care information and prohibiting disclosure of certain health care information and repealing certain Sections of the statutes.  

Legislation Overview:

 Senate Bill404 (SB404) Chapter 24, Article 14B NMSA 1978 is renamed the” Patient Records Privacy Act". 
The purpose of the Patient Records Privacy Act is to provide for the secure use, disclosure and protection of an individual's electronic patient records.
Several new definitions are now included in the Act to support its purpose. Some of them are "electronic patient record system" which means a   system used to process, store and maintain patient records of individuals, including an individual's health care information.
An expanded definition of “health care information” which will now include: “and includes the individual's patient records, health care claims and records of payments for health care or other administrative data from a provider, health care service plan or pharmaceutical company”, and “health care institution” expanded to read : “and includes a contractor or an employee of a health care institution”, and a new definition for: "health care service plan" which means a plan that arranges for the provision of health care services to subscribers or enrollees, or to pay for or to reimburse any part of the cost for those services, in return for a prepaid or periodic charge paid by or on behalf of the subscribers or enrollees and includes a contractor or an employee of the health care service plan”.
The definition of provider is now expanded to include one that practices in this state, including reproductive health care and gender-affirming health care, and has access health care information.
Reproductive health is now defined as: " psychological, behavioral, surgical, pharmaceutical or medical care, services or supplies that relate to the human reproductive system, including services related to: (1)  preventing a pregnancy; (2)  abortion; (3)  managing a pregnancy loss; (4)  prenatal, birth, perinatal and postpartum health; (5)  managing perimenopause and menopause; (6)  managing infertility; (7)  treating cancers of the reproductive system; or (8)  preventing or treating sexually transmitted infections or diseases.
New language requiring segregation of certain medical information  will now provide that: “ a health information exchange or electronic patient record system operating in the state that electronically stores or maintains medical information, electronic patient records, personal health records, health care claims, payments or other administrative data on behalf of a provider, health care service plan, pharmaceutical company, contractor or employer shall: (1)  segregate an individual's health care information related to reproductive health care, gender affirming health care, mental health care, alcohol or substance use treatment and any other similar health care or health care service as deemed appropriate for record segregation by the health care authority; (2)  limit user access privileges to an individual's segregated health care information to persons or entities to whom the individual has provided written authorization for access; (3)  provide a process for an individual to provide written authorization to disable access to the individual's segregated health care information by persons or entities in another state; and (4)  notify an individual whose segregated health care information is the subject of a civil, criminal or regulatory inquiry, investigation, subpoena or summons for the release of the individual's segregated health care information and notify each provider that rendered health care as documented in the individual's segregated health care information at least thirty days prior to complying with the civil, criminal or regulatory inquiry, investigation, subpoena or summons for release of the individual's segregated health care information.
A contractor or an employee of the provider or a health care service plan shall not release patient records containing an individual's health care information related to that individual seeking or obtaining an abortion in response to a subpoena or request if that subpoena or request is based on another state's laws that interfere with a person's rights under the Reproductive and Gender-Affirming Health Care Freedom Act or the Reproductive and Gender-Affirming Health Care Protection Act.
Liability protections are provided for vendors of information services. 
Certain exclusions are provided and expanded for those types of insurers to include: a property and casualty insurer, workers' compensation insurer, life insurer, long-term care insurer or disability income insurer, under the Patient Records Privacy Act. 
A new Section on enforcement of the Act is provided: to read:” A health information exchange or electronic patient record system determined to be in violation of the Patient Records Privacy Act shall be: (1)  subject to injunctive relief to cease or correct the violation; (2)  liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) for each negligent violation; or (3)  liable for a civil penalty of not more than seven thousand five hundred dollars ($7,500) for each intentional violation.  
An individual who claims to have suffered a deprivation of a right under the Patient Records Privacy Act may maintain an action to establish liability and recover damages and equitable or injunctive relief in any New Mexico district court.  
The attorney general or a district attorney may institute a civil action in district court if the attorney general or district attorney has reasonable cause to believe that a violation of the Patient Records Privacy Act has occurred or to prevent a violation of that act.”
Section 24-14-18 NMSA 1978 (being Laws 1977, Chapter 206, Section 2, as amended) is repealed and the effective date for this Act is July 1, 2025. 
The above repealed Section refers to 2024 New Mexico health, safety and reporting of induced abortions.