New Mexico Walk-In Clinic Privacy Laws Guide: Patient Rights, HIPAA, and Medical Records Access

Patient Rights Overview

In New Mexico, you have clear rights over your health information at walk-in clinics. You can inspect and obtain a copy of your medical records and direct that copies be sent to another provider. Clinics cannot refuse to release your records because you owe a balance, and they must process valid requests with minimal disruption to your care. ([nmmb.state.nm.us](https://www.nmmb.state.nm.us/wp-content/uploads/2024/05/nmac-16.10.17-2021-08-24.pdf))

Psychiatric and mental health information is generally accessible to you, but psychotherapy notes are treated differently: they must be kept separate and are not subject to patient access or amendment. Releasing psychotherapy notes to another provider requires your express authorization. ([nmmb.state.nm.us](https://www.nmmb.state.nm.us/wp-content/uploads/2024/05/nmac-16.10.17-2021-08-24.pdf))

Under the HIPAA Privacy Rule, you also have the right to receive records in a readable format, to request amendments, and to receive a notice of privacy practices explaining how your protected health information (PHI) is used and disclosed. These rights apply to covered walk-in clinics and their business associates. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html?pubDate=20250430&utm_source=openai))

• Access and copies of your medical record (with limited exceptions).
• No withholding of records for unpaid bills.
• Right to request electronic copies when available.
• Right to authorize disclosures to third parties and to name personal representatives.

HIPAA Privacy Compliance

Walk-in clinics that conduct electronic transactions are HIPAA “covered entities.” They may use and disclose PHI without authorization for treatment, payment, and health care operations, while applying the “minimum necessary” standard to most non-treatment disclosures. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.502?utm_source=openai))

For your Right of Access, a clinic must act on your request within 30 calendar days; one 30-day extension is allowed with a written explanation and new due date. These timeframes apply even when a business associate stores the data. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/how-timely-must-a-covered-entity-be/index.html?utm_source=openai))

If you direct a clinic to send your records to a third party, HIPAA still governs form, format, timing, and fees—but note that a federal court limited the “third-party directive” to certain electronic records; clinics should follow current HHS guidance when fulfilling such requests. ([hhs.gov](https://www.hhs.gov/hipaa/court-order-right-of-access/index.html?utm_source=openai))

Medical Records Access Procedures

Step-by-step Medical Records Release Protocol

• Submit a written request that identifies the records, preferred format (electronic or paper), and delivery method (pickup, mail, secure email, portal).
• Clinics verify your identity and authority (for example, if you are a parent, agent under a power of attorney, or other personal representative).
• The clinic must respond within 30 days; if more time is needed, it must send you a written notice explaining the reason and provide the records within the one allowed 30‑day extension. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/how-timely-must-a-covered-entity-be/index.html?utm_source=openai))
• Inspection versus copies: you can inspect records at the clinic without paying copy fees; fees are limited to reasonable, cost-based amounts only when the clinic produces copies for you. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/can-an-individual-be-charged-a-fee-if-the-individual/index.html?utm_source=openai))
• If a request is denied under a permitted HIPAA ground, you must receive a timely written denial that explains the basis and, when applicable, how to request a review by another licensed professional. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/under-what-circumstances-may-a-covered-entity/index.html?utm_source=openai))

Medical Records Retention and Destruction

For records owned by a physician, New Mexico requires retention for at least 10 years after the date of last treatment; for minors, records must be kept until the patient turns 21. Practices must maintain a written policy that states how long records are kept, how to obtain or transfer them, and how they are destroyed. ([nmmb.state.nm.us](https://www.nmmb.state.nm.us/wp-content/uploads/2024/05/nmac-16.10.17-2021-08-24.pdf))

Destruction must preserve confidentiality (for example, shredding or permanent digital deletion), and a log of destroyed charts (with patient name and destruction date) must be kept. ([nmmb.state.nm.us](https://www.nmmb.state.nm.us/wp-content/uploads/2024/05/nmac-16.10.17-2021-08-24.pdf))

Authorized Representatives Rights

Under HIPAA, your “personal representative” has the same access rights you have, subject to limited exceptions (for example, where access would likely cause substantial harm). New Mexico’s Uniform Health‑Care Decisions Act likewise provides that an agent or surrogate authorized to make health-care decisions generally has the same rights as the patient to request, receive, examine, copy, and consent to the disclosure of medical information. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.502?utm_source=openai))

For behavioral health, New Mexico’s Mental Health and Developmental Disabilities Code recognizes a court‑appointed treatment guardian as a patient’s personal representative for HIPAA purposes and permits limiting disclosures when a clinician documents that disclosure would not be in the client’s best interests. ([law.justia.com](https://law.justia.com/codes/new-mexico/2023/chapter-43/article-1/section-43-1-19/?utm_source=openai))

Long‑Term Care Ombudsman Access: If you or a loved one resides in a long‑term care facility, the Ombudsman Program has full and immediate access to readily available medical and related records to investigate and resolve complaints, separate from standard clinic authorization rules. ([law.justia.com](https://law.justia.com/codes/new-mexico/chapter-28/article-17/section-28-17-13/?utm_source=openai))

Fees for Medical Records Copies

HIPAA caps patient-access fees to a reasonable, cost-based amount that covers only labor for copying, supplies, and postage. Per‑page fees for electronic records are not considered reasonable; clinics should calculate actual or average labor for e‑copies. You cannot be charged for merely inspecting your records, and clinics may not deny access because of unpaid bills. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/how-can-covered-entities-calculate-the-limited-fee/index.html?utm_source=openai))

For physician-owned records in New Mexico, the Medical Board permits a “reasonable cost‑based charge” not to exceed $30 for the first 15 pages and $0.25 per page thereafter; actual reproduction costs may be charged for formats other than paper (for example, x‑rays). Clinics should apply the lower of state allowances and HIPAA’s cost‑based limits when fulfilling patient Right of Access requests. ([nmmb.state.nm.us](https://www.nmmb.state.nm.us/wp-content/uploads/2024/05/nmac-16.10.17-2021-08-24.pdf))

Special case—social security disability applicants: New Mexico rules require production within 30 days regardless of whether the fee has been received; a regulatory schedule authorizes reasonable copy fees for these requests. ([srca.nm.gov](https://www.srca.nm.gov/parts/title08/08.370.0006.html?utm_source=openai))

Confidentiality and Mental Health Disclosure

HIPAA treats most mental health information like other PHI for access purposes, but psychotherapy notes are excluded: you do not have a right to access or amend them, and releasing them to another provider requires your explicit authorization. ([nmmb.state.nm.us](https://www.nmmb.state.nm.us/wp-content/uploads/2024/05/nmac-16.10.17-2021-08-24.pdf))

Clinicians may limit or deny access in narrow situations (for example, when disclosure would likely cause substantial harm), and New Mexico behavioral‑health rules allow disclosure without consent only in specific circumstances such as imminent risk of serious harm or certain mandated reports. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/under-what-circumstances-may-a-covered-entity/index.html?utm_source=openai))

Conclusion

For New Mexico walk‑in clinics, the practical bottom line is this: you control access to your records; clinics must meet HIPAA’s 30‑day clock, follow a clear Medical Records Release Protocol, retain and destroy records per state rules, honor valid Patient Authorizations and personal representatives, and charge only reasonable, cost‑based fees—observing New Mexico’s physician fee caps when applicable. These safeguards collectively protect Health Information Confidentiality while ensuring timely access to care information. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/how-timely-must-a-covered-entity-be/index.html?utm_source=openai))

FAQs.

What are the patient rights related to medical records in New Mexico?

You have the right to inspect and obtain copies of your records, to request amendments, and to receive a privacy notice explaining how your PHI is used. Clinics cannot withhold records because of unpaid bills, and psychotherapy notes are excluded from patient access. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html?pubDate=20250430&utm_source=openai))

How does HIPAA apply to walk-in clinics in New Mexico?

HIPAA applies to covered clinics and their business associates. Clinics may use and disclose PHI for treatment, payment, and operations without authorization, must apply the minimum necessary rule to most non‑treatment disclosures, and must honor your Right of Access within 30 days (with one permitted 30‑day extension). ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.502?utm_source=openai))

What are the timeframes for providers to respond to medical records requests?

Under HIPAA, clinics must act within 30 calendar days of receiving your request; a single 30‑day extension is allowed with a written reason and new due date. For social security disability applicants, New Mexico regulations also require production within 30 days. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/how-timely-must-a-covered-entity-be/index.html?utm_source=openai))

Can authorized representatives access a patient's medical records?

Yes. A personal representative (for example, a health‑care agent under a power of attorney) generally has the same access rights as the patient. For behavioral health, a court‑appointed treatment guardian may act as the patient’s representative; however, access may be restricted if a clinician documents that disclosure is not in the client’s best interests. ([openjurist.org](https://openjurist.org/state-code/nm/24/24-7A-8?utm_source=openai))

What fees can clinics charge for copies of medical records?

Fees must be reasonable and cost‑based under HIPAA, covering only labor for copying, supplies, and postage. Per‑page fees for electronic records are not considered reasonable. For physician‑owned records in New Mexico, the Medical Board caps charges at up to $30 for the first 15 pages and $0.25 per page thereafter, with actual costs for non‑paper formats. You cannot be charged to inspect your records, and access cannot be denied for unpaid bills. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/how-can-covered-entities-calculate-the-limited-fee/index.html?utm_source=openai))