New Mexico Patient Advocacy: Client Records Privacy Laws Compliance Checklist

Medical Record Confidentiality Requirements

You must implement confidentiality safeguards that meet HIPAA standards and New Mexico Administrative Code 8.370 requirements. Maintain minimum necessary use, provide a Notice of Privacy Practices, and restrict disclosures unless they are permitted for treatment, payment, and health care operations or are supported by valid Patient Authorization Requirements.

• Adopt written policies stating that records are confidential and released only as allowed by New Mexico statutes (including 14-6-2 and, where applicable, 43-1-19 NMSA 1978) and HIPAA; require written consent for other disclosures. ([law.cornell.edu](https://www.law.cornell.edu/regulations/new-mexico/N-M-Admin-Code-SS-8.370.12.30))
• Prohibit removal of original hospital records except under court order with protections against loss, tampering, or unauthorized access. ([law.cornell.edu](https://www.law.cornell.edu/regulations/new-mexico/N-M-Admin-Code-SS-8.370.12.30))
• Apply special confidentiality for HIV-related information; disclosures require explicit authorization or fall within limited statutory exceptions with required disclosure statements. ([law.justia.com](https://law.justia.com/codes/new-mexico/2024/chapter-24/article-2b/section-24-2b-6/?utm_source=openai))
• For substance use disorder records, follow 42 CFR Part 2 in addition to HIPAA when applicable.
• Maintain access controls, audit logs, and workforce training consistent with Confidentiality Safeguards under HIPAA and New Mexico Administrative Code 8.370. ([law.cornell.edu](https://www.law.cornell.edu/regulations/new-mexico/N-M-Admin-Code-SS-8.370.12.30))

Medical Record Retention Periods

Document a Medical Records Retention Act Compliance plan that accounts for record type, facility type, and payer rules. Use the longest applicable requirement when federal and state rules differ.

• Hospitals: retain the medical record for 10 years after the patient’s last discharge; laboratory test records at least 1 year if a copy is in the chart (otherwise 4 years). ([law.justia.com](https://law.justia.com/codes/new-mexico/chapter-14/article-6/section-14-6-2/))
• Radiology Record Retention: retain X-ray films 4 years if a radiologist’s report is in the record; retain mammography images and reports for not less than 5 years, or 10 years if no additional mammograms are performed at that facility, or longer if state law requires. ([law.justia.com](https://law.justia.com/codes/new-mexico/chapter-14/article-6/section-14-6-2/))
• Physicians: retain records you own for at least 10 years after last treatment; retain minor patients’ records until the patient turns 21. Keep a destruction log. ([law.cornell.edu](https://www.law.cornell.edu/regulations/new-mexico/N-M-Admin-Code-SS-16.10.17.10))
• Medicaid: providers must keep medical and business records at least 6 years from the payment date. ([law.cornell.edu](https://www.law.cornell.edu/regulations/new-mexico/N-M-Admin-Code-SS-8.302.1.17?utm_source=openai))
• Hospitals must maintain a medical record service, master patient index, and timely completion standards (e.g., discharged records completed within 30 days). ([law.cornell.edu](https://www.law.cornell.edu/regulations/new-mexico/N-M-Admin-Code-SS-8.370.12.30))

Methods for Record Destruction

Establish Record Destruction Protocols that render information unreadable, indecipherable, and unable to be reconstructed, and that preserve confidentiality throughout the process.

• Paper records: destroy by shredding, burning/incineration (where permitted), or other permanent destruction methods in the ordinary course of business; never destroy records on an ad‑hoc, patient-specific basis. Keep a destruction log. ([law.justia.com](https://law.justia.com/codes/new-mexico/chapter-14/article-6/section-14-6-2/))
• Electronic media: purge or otherwise permanently delete ePHI from hard drives, servers, and removable media using industry-accepted methods; document device disposition. ([law.cornell.edu](https://www.law.cornell.edu/regulations/new-mexico/N-M-Admin-Code-SS-16.10.17.10))
• Apply holds to suspend destruction when litigation, audit, or investigation is reasonably anticipated.

Patient Access to Medical Records

Define Patient Access Response Timeframes and workflows that meet HIPAA and New Mexico Administrative Code 8.370 expectations.

• Respond to individual access requests within 30 calendar days; one 30‑day extension is allowed with written notice stating the reason and a completion date. Provide the copy in the requested form/format if readily producible. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/how-timely-must-a-covered-entity-be/index.html?utm_source=openai))
• When a patient is discharged or transferred, provide the receiving provider a copy or abstract of the record within 24 hours of a signed request. ([law.cornell.edu](https://www.law.cornell.edu/regulations/new-mexico/N-M-Admin-Code-SS-8.370.22.34?utm_source=openai))
• Limit access to psychiatric records per clinician judgment and written hospital policy, while still honoring general rights of access where applicable. ([srca.nm.gov](https://www.srca.nm.gov/parts/title08/08.370.0012.html?utm_source=openai))

Fees for Copying Medical Records

Apply fee rules that harmonize state caps with HIPAA’s cost-based limits, using the most protective standard for patients.

• State caps: may charge up to $2.00 per page for the first 10 one-sided pages and up to $0.20 per page thereafter. ([law.cornell.edu](https://www.law.cornell.edu/regulations/new-mexico/N-M-Admin-Code-SS-8.370.6.10))
• HIPAA limits: for a patient’s own ePHI maintained electronically, per‑page fees are not permitted; calculate a reasonable, cost‑based fee (actual or average labor + supplies + postage) or use an optional flat fee up to $6.50 for standard electronic requests. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/how-can-covered-entities-calculate-the-limited-fee/index.html?utm_source=openai))
• Workers’ compensation or insurer requests may follow different program rules; apply HIPAA when the individual exercises the right of access.

Policies on Patient Rights and Confidentiality

Publish policies on patient rights that align with New Mexico Administrative Code 8.370 and your facility license.

• State in writing that patients (or authorized representatives) may access their medical records; note that access to psychiatric records may be limited by treating professionals when your policy specifies such requirements. ([srca.nm.gov](https://www.srca.nm.gov/parts/title08/08.370.0012.html?utm_source=openai))
• Include the right to confidentiality of medical care and patient/client records, grievance procedures, and how to request record transfers. ([law.cornell.edu](https://www.law.cornell.edu/regulations/new-mexico/N-M-Admin-Code-SS-8.370.22.34?utm_source=openai))
• Reference New Mexico Administrative Code 8.370 throughout patient‑facing materials to reinforce rights and responsibilities.

Medical Record Service Administration Responsibilities

Designate qualified leadership and maintain robust processes so your medical record service consistently meets New Mexico Administrative Code 8.370 standards.

• Assign a registered medical records administrator or accredited records technician, or retain such a consultant for organization, training, and quarterly evaluations with written reports. ([law.cornell.edu](https://www.law.cornell.edu/regulations/new-mexico/N-M-Admin-Code-SS-8.370.12.30))
• Maintain a master patient index; ensure prompt retrieval; keep coding and indices current; complete discharged records within 30 days. ([law.cornell.edu](https://www.law.cornell.edu/regulations/new-mexico/N-M-Admin-Code-SS-8.370.12.30))
• Maintain preservation policies specifying 10‑year retention (and longer for minors), plus specific laboratory and radiology retention rules; control release and protect originals. ([law.cornell.edu](https://www.law.cornell.edu/regulations/new-mexico/N-M-Admin-Code-SS-8.370.12.30))
• Track all disclosures requiring Patient Authorization Requirements, manage BAAs, and audit compliance with Confidentiality Safeguards and Record Destruction Protocols.

Conclusion

To stay compliant in New Mexico, ground your program in HIPAA and New Mexico Administrative Code 8.370, apply clear retention rules (including Radiology Record Retention), use secure destruction, meet Patient Access Response Timeframes, and charge only permitted fees. Embed these checkpoints in daily operations and audit them regularly to sustain compliance.

FAQs

What are the retention requirements for patient records in New Mexico?

Hospitals must retain records for 10 years after the last discharge; labs at least 1 year if a copy is in the chart (otherwise 4 years); X‑ray films for 4 years with the radiologist’s report kept per the general record period. Physicians must retain records for at least 10 years after last treatment, and for minors until age 21. Mammography images and reports must be kept at least 5 years, or 10 years if no subsequent mammograms occur at that facility, or longer if state law requires; Medicaid providers must retain records 6 years from the payment date. ([law.justia.com](https://law.justia.com/codes/new-mexico/chapter-14/article-6/section-14-6-2/))

How must medical records be destroyed to maintain privacy?

Destroy paper records by shredding, incinerating (where permitted), or other permanent methods, in the ordinary course of business and not on an ad‑hoc basis; maintain a destruction log. For electronic media, purge or otherwise permanently delete ePHI from hard drives, servers, and removable media using accepted methods, and document the process. ([law.justia.com](https://law.justia.com/codes/new-mexico/chapter-14/article-6/section-14-6-2/))

What fees can be charged for copying medical records?

Under New Mexico Administrative Code 8.370, providers may charge up to $2.00 per page for the first 10 one‑sided pages and $0.20 per page thereafter. Under HIPAA, when patients request electronic copies of their own ePHI maintained electronically, per‑page fees are not permitted; you must use a reasonable, cost‑based fee or an optional flat fee up to $6.50 for standard electronic requests. ([law.cornell.edu](https://www.law.cornell.edu/regulations/new-mexico/N-M-Admin-Code-SS-8.370.6.10))

What patient rights must hospitals inform clients about regarding record access?

Hospitals must inform patients that they have a right to access their medical records, that records are confidential, and that psychiatric record access may be limited by clinician judgment under written policy. Upon a signed request related to discharge or transfer, a copy or abstract of the record must be made available to the receiving facility within 24 hours. ([srca.nm.gov](https://www.srca.nm.gov/parts/title08/08.370.0012.html?utm_source=openai))