New Mexico Podiatry Clinic Privacy Laws: Compliance Checklist

You manage sensitive foot and ankle health information every day. This compliance checklist distills what a New Mexico podiatry clinic needs to do to protect patient privacy, align with HIPAA, and meet state-specific obligations. Use it to verify your controls, close gaps, and document a defensible program.

HIPAA Compliance Requirements

Confirm your clinic’s HIPAA foundation before layering on state-specific details. Start by defining what counts as Protected Health Information (PHI) and Electronic Protected Health Information (ePHI), then map every workflow that creates, receives, maintains, or transmits it.

• Identify your legal entity and covered functions; maintain an up-to-date HIPAA scope inventory (systems, vendors, locations, data flows).
• Apply the minimum necessary standard to all uses and disclosures for treatment, payment, and healthcare operations.
• Provide and document delivery of a current Notice of Privacy Practices (NPP) at intake and upon material revisions.
• Execute Business Associate Agreements with all vendors that handle PHI/ePHI on your behalf; monitor their security posture.
• Honor patient rights: access, amendments, accounting of disclosures, confidential communications, and request for restrictions.
• Follow the Breach Notification Rule: investigate incidents, risk-assess impermissible disclosures, notify affected individuals and authorities as required, and maintain a breach log.
• Retain HIPAA-related documentation (policies, risk analyses, training, incident reports, and BAAs) for at least six years from creation or last effective date.

Designation of Compliance Officers

Formally assign accountability. Even in small practices, separating privacy and security functions clarifies decisions and accelerates remediation.

• Appoint a Privacy Officer to oversee permissible uses/disclosures, patient rights, NPP content, and complaint response.
• Appoint a Security Officer to own risk analysis, risk management, technical controls, and incident response for ePHI.
• Publish written charters describing authority, reporting lines, and decision rights; brief leadership at least quarterly.
• Create a cross-functional privacy and security committee (clinical, front desk, billing, IT, compliance) to track metrics and drive improvements.

Implementation of Safeguards

Build layered defenses across people, process, and technology. Document each safeguard, its owner, and review cadence.

Administrative Safeguards

• Conduct an enterprise-wide risk analysis covering all ePHI systems; implement a risk management plan with prioritized mitigations.
• Adopt policies for access management, sanctions, device usage, texting/telehealth, photography/video, and third-party oversight.
• Implement Contingency Planning: routine encrypted backups, disaster recovery procedures, emergency-mode operations, and downtime workflows for scheduling, documentation, and e-prescribing.
• Test and document contingency plans at least annually; record lessons learned and corrective actions.
• Review information system activity (audit logs, access reports, authentication failures) and investigate anomalies.

Technical Safeguards

• Access controls: unique user IDs, role-based permissions, multi-factor authentication, automatic logoff, and least-privilege defaults.
• Encryption: protect ePHI at rest on servers, laptops, and mobile devices; enforce TLS for data in transit, portals, and secure messaging.
• Audit controls: enable immutable logging on EHR, e-prescribe, imaging, and billing systems; retain logs per policy.
• Integrity controls and secure configuration baselines; apply patches promptly and use endpoint protection with EDR.
• Data loss prevention for email and file sharing; restrict removable media and apply device/Media controls for imaging and orthotics scanners.

Physical Safeguards

• Facility access plan with keyed or badged entry, visitor sign-in, and screen privacy in front-desk and treatment areas.
• Workstation security: anchor devices, auto-lock screens, and separate public Wi‑Fi from clinical networks.
• Secure storage for paper charts, prescription pads, and podiatry imaging; apply chain-of-custody procedures for media transport.
• Documented disposal process for paper and electronic media (cross-cut shredding, certified drive destruction).

Development of Privacy Policies

Your policies should reflect how your clinic actually operates. Keep them concise, actionable, and version-controlled.

• Notice of Privacy Practices tailored to podiatry services, including photography of conditions, orthotics data, and care coordination.
• Use and disclosure rules for treatment, payment, operations, marketing, fundraising opt-outs, and required public health reporting.
• Authorization templates for non-routine disclosures; identity verification steps before releasing records.
• Minimum necessary procedures for front desk, billing, and referral workflows; standard scripts to prevent oversharing at reception.
• Business Associate management: vetting, BAAs, onboarding checklists, and periodic security attestations.
• Telehealth, texting, and patient portal usage guidelines, including acceptable platforms and emergency limitations.
• Policy review schedule (at least annually) and change management with documented staff acknowledgment.

Workforce Training Protocols

Make privacy and security routine. Training must be practical, role-based, and evidenced by completion records.

• Onboarding training before granting PHI/ePHI access; annual refreshers that reflect new risks and policy updates.
• Role-based modules for front desk identification checks, clinical photography etiquette, and secure referral processes.
• Security awareness: phishing simulations, password hygiene, secure texting, and safe handling of imaging/media.
• Tabletop exercises: breach response, lost device scenarios, EHR downtime, and Contingency Planning walk-throughs.
• Maintain attendance logs, quiz results, and acknowledgments; enforce a graduated sanctions policy for noncompliance.

Medical Record Retention Standards

Retention rules blend HIPAA documentation requirements with New Mexico state law for medical records. Build one schedule that satisfies both and is easy to follow.

• Medical records (adults): retain for at least ten years after the last date of service, unless a longer period is required by payer, contract, or litigation hold.
• Medical records (minors): retain until the patient turns 21 and for at least ten years after the last encounter, whichever is longer.
• Special records: preserve operative notes, imaging, orthotics/biomechanics data, and radiology for the full medical record period unless other rules extend it.
• HIPAA documentation (policies, risk analyses, incident reports, training records, and BAAs): retain for a minimum of six years from creation or last effective date.
• Designate a medical record custodian; document storage locations, retrieval procedures, and secure destruction workflows.

When in doubt, retain longer—especially if malpractice exposure, audits, or claim appeals are possible.

Patient Notification Procedures

Communicate clearly and on time. Your procedures should cover both security incidents and routine operational changes like relocations or closures.

Breach Notification Rule actions

• Immediately contain and investigate suspected incidents; complete a breach risk assessment.
• Notify affected individuals without unreasonable delay and no later than 60 days after discovery; include what happened, what information was involved, steps patients should take, and your remediation.
• Notify HHS and, if applicable, local media for large breaches; record all notifications in your breach log.
• Provide identity monitoring guidance when appropriate and document corrective actions to prevent recurrence.

Practice closure, relocation, or provider departure

• Provide written notice to active patients as early as possible (commonly at least 30 days in advance), with instructions for obtaining copies or transferring records.
• Identify the medical record custodian, mailing address, and contact window for record requests after closure.
• Post notices in the clinic, on your website/portal, and on voicemail; consider a local newspaper notice if patient addresses are outdated.
• Arrange coverage or urgent care referrals during the transition; provide limited-quantity prescription bridges when clinically appropriate.
• Maintain a log of all notices sent, undeliverable mail, and patient record releases; keep this log per your retention schedule.

Conclusion

By assigning accountable officers, implementing layered safeguards, maintaining clear policies, training your team, retaining records appropriately, and executing timely notifications, you build a resilient privacy program. Use this New Mexico Podiatry Clinic Privacy Laws: Compliance Checklist to verify controls today and to demonstrate diligence tomorrow.

FAQs.

What are the key HIPAA rules for podiatry clinics in New Mexico?

The core rules are the Privacy Rule (how you may use and disclose PHI), the Security Rule (how you protect ePHI with administrative, physical, and technical safeguards), and the Breach Notification Rule (how and when you notify patients and authorities after certain incidents). In New Mexico, you must also follow state requirements on medical record retention and patient notification during practice transitions, applying whichever rule—state or federal—offers patients greater protection.

How long must medical records be retained by podiatry physicians?

Maintain adult patient records for at least ten years after the last date of service. For minors, keep records until the patient turns 21 and for at least ten years after the last encounter, whichever is longer. Retain HIPAA program documentation (policies, training, risk analyses, and incident files) for a minimum of six years. If litigation, audits, or payer disputes are possible, extend retention until those matters are fully resolved.

What procedures must be followed to notify patients before practice closure?

Send written notice to active patients as early as possible—commonly at least 30 days in advance—explaining the closure date, how to obtain or transfer records, and how urgent needs will be handled. Name the medical record custodian and provide contact details for post-closure requests. Post notices in the clinic and on digital channels, update voicemail, and consider a newspaper notice for unreachable patients. Maintain a log of all notifications and record releases to demonstrate compliance.