HEALTHCARE PRIVACY & SAFETY PROTECTIONS

HB0279

HOUSE BILL 279

57th legislature - STATE OF NEW MEXICO - second session, 2026

INTRODUCED BY

Christine Chandler
and
Linda M. Trujillo

AN ACT

RELATING TO HEALTH CARE PRIVACY; STRENGTHENING PRIVACY
PROTECTIONS FOR ELECTRONIC MEDICAL RECORDS BY LIMITING
DISCLOSURE OF CERTAIN HEALTH CARE INFORMATION; RESTRICTING
LOCATION TRACKING AT REPRODUCTIVE HEALTH CARE PROVIDER AND
GENDER-AFFIRMING HEALTH CARE PROVIDER FACILITIES; AMENDING
LICENSING REQUIREMENTS FOR CERTAIN HOSPITALS; STRENGTHENING
PRIVACY PROTECTIONS FOR PROVIDERS WHO PRESCRIBE DRUGS FOR
REPRODUCTIVE HEALTH CARE; PROVIDING FOR REPRODUCTIVE HEALTH
CARE PROVIDERS AND GENDER-AFFIRMING HEALTH CARE PROVIDERS TO
PARTICIPATE IN THE CONFIDENTIAL SUBSTITUTE ADDRESS ACT;
PROVIDING CIVIL PENALTIES.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF NEW MEXICO:

SECTION 1.

Section 24-14B-2 NMSA 1978 (being Laws 2009,
Chapter 69, Section 2) is amended to read:

"24-14B-2. PURPOSE.--The purpose of the Electronic
Medical Records Act is to provide for the use, disclosure,

privacy
and protection of electronic medical records."

SECTION 2.
Section 24-14B-3 NMSA 1978 (being Laws 2009,
Chapter 69, Section 3) is amended to read:

"24-14B-3. DEFINITIONS.--As used in the Electronic
Medical Records Act:

A. "demographic information" means information that
identifies the individual who is the subject of the health care
information, including the individual's name, date of birth and
address and other information
necessary to identify
the
individual, that may be used to identify the individual or that
associates the individual with the individual's electronic
medical record;

B. "disclose" means to release, transfer, provide,
give access to or otherwise divulge in any other manner
information outside the entity holding the information;

C. "electronic" means relating to technology having
electrical, digital, magnetic, wireless, optical,
electromagnetic or similar capabilities;

D. "electronic health care service provider" means
a person that:

(1) maintains health care information, or
provides software or hardware designed to maintain health care
information, and makes the health care information available to
a patient, provider, health care institution, health
information exchange or health care group purchaser at the
request of an individual or a provider, health care
institution, health information exchange or health care group
purchaser for the purpose of:

(a) allowing a patient to manage the
patient's own health care information; or

(b) aiding a provider in the diagnosis
or treatment of a patient; or

(2) provides software or hardware to an
individual that allows:

(a) the individual to manage the
individual's own health care information; or

(b) for the diagnosis, treatment or
management of a medical condition of the individual;

[
D.
]
E.
"electronic medical record" means [
an
electronic record of an individual patient's health care
information that may contain demographic information
]
a medical
record that is maintained, displayed or provided
electronically;

F. "electronic medical record system" means a

system used to process, store and maintain the medical records
of individuals, including individuals' health care information
;

[
E.
]
G.
"electronic signature" means an electronic
sound, symbol or process attached to or logically associated
with a record and executed or adopted by an individual with the
intent to sign the record;

H. "gender-affirming health care" means
psychological, behavioral, surgical, pharmaceutical or medical
health care, services, procedures or supplies provided to an
individual in support of the individual's gender identity;

[
F.
]
I.
"health care" means care, services or
supplies related to the health of an individual and includes:

(1) preventive, diagnostic, therapeutic,
rehabilitative, maintenance or palliative care and counseling;

(2) services,
tests
, assessments or procedures
that are concerned with the physical or mental condition or
functional status of an individual or that affect the structure
or function of the body of an individual; and

(3) the sale or dispensing of a drug, a
device, a piece of equipment or other item in accordance with a
prescription;

[
G.
]
J.
"health care group purchaser" means a
person who is licensed, certified or otherwise authorized or
permitted by the New Mexico Insurance Code to pay for or
purchase health care on behalf of an identified individual or
group of individuals, regardless of whether the cost of
coverage or services is paid for by the purchaser or the
persons receiving coverage or services,
and includes a
contractor or an employee of a health care group purchaser
;

[
H.
]
K.
"health care information" means any
information, whether oral or recorded in any form or medium,
related to the past, present or future physical or mental
health or condition of an individual; the provision of health
care to an individual; or the past, present or future payment
for the provision of health care to an individual,
and includes
health care claims and other administrative data from a
provider, a health care institution, a health care group
purchaser or an electronic health care service provider
;

[
I.
]
L.
"health care institution" means an
institution, facility or agency licensed, certified or
otherwise authorized or permitted by law to provide health care
in the ordinary course of business
and includes a contractor or
an employee of a health care institution;

M. "health care service plan" means a plan that
arranges for the provision of health care to subscribers or

enrollees, or for the payment or reimbursement of any part of
the cost for that health care, in return for a prepaid or
periodic charge paid by or on behalf of the subscribers or
enrollees and includes a contractor or an employee of the
health care service plan
;

[
J.
]
N.
"health information exchange" means an

arrangement among persons participating in a defined secure
electronic network service, such as a regional health
information organization, that allows the sharing of health
care information about individual patients among different
health care institutions or unaffiliated providers,
and
includes a contractor or an employee of a health information
exchange
. The use of an electronic medical record system by a
health care provider, by or within a health care institution or
by an organized health care arrangement as defined by the
federal Health Insurance Portability and Accountability Act of
1996 does not constitute a health information exchange
;

[
K.
]
O.
"information" means data, including text,
images, sounds and codes and computer programs, software and
databases;

P. "medical record" means any record of an
individual patient's health care information that may contain
demographic information;

Q. "protected health care activity" means:

(1) seeking, receiving or providing
reproductive health care or gender-affirming health care; or

(2) assisting an individual who is seeking,
receiving or providing reproductive health care or gender-affirming health care, including by providing information,
transportation, lodging or material support;

[
L.
]
R.
"provider" means an individual who is
licensed, certified or otherwise authorized or permitted by law
to provide health care in the ordinary course of business or
practice of a profession;

[
M.
]
S.
"record" means information that is
inscribed on a tangible medium or that is stored in an
electronic or other medium and is retrievable in perceivable
form;

[
N.
]
T.
"record locator service" means
an
information service that contains demographic information and
the location of health care information of a specified
individual across different health care institutions or
unaffiliated providers that participate in the service
and
includes a contractor or an employee of a record locator
service
. The use of an electronic medical record system by a
health care provider or by an organized health care arrangement
as defined by the federal Health Insurance Portability and
Accountability Act of 1996 does not constitute a record locator
service
; [
and
]

U. "reproductive health care" means psychological,
behavioral, surgical, pharmaceutical or medical care, services
or supplies that relate to the human reproductive system.

"Reproductive health care" includes services related to:

(1) abortion;

(2) pregnancy prevention;

(3) managing the loss of a pregnancy;

(4) prenatal, perinatal and postpartum health;

(5) managing perimenopause and menopause;

(6) managing fertility and infertility;

(7) treating cancers of the reproductive
system; and

(8) preventing sexually transmitted
infections; and

[
O.
]
V.
"treatment" means the provision,
coordination or management of health care and related services
by one or more providers, including the coordination or
management of health care by a provider with a third party;
consultation between providers relating to an individual; or
the referral of an individual for health care from one provider
to another."

SECTION 3.
Section 24-14B-6 NMSA 1978 (being Laws 2009,
Chapter 69, Section 6, as amended) is amended to read:

"24-14B-6. USE AND DISCLOSURE OF ELECTRONIC HEALTH CARE
INFORMATION.--

A. A provider,
a
health care institution,
a
health
information exchange, [
or
]
a
health care group purchaser
or an
electronic health care service provider
shall not use or
disclose health care information in an individual's electronic
medical record to another person without the consent of the
individual except as allowed by state or federal law.

B. A provider,
a
health care institution, [
or
]
a

health care group purchaser
or an electronic health care
service provider
may disclose demographic information and
information about the location of an individual's electronic
medical records to a record locator service in accordance with
state or federal law. A provider or health care institution
participating in a health information exchange using a record
locator service shall not have access to demographic
information, information about the location of the individual's
electronic medical records or information in an individual's
electronic medical record except in connection with the
treatment of the individual or as permitted by the consent of
the individual or as otherwise permitted by state or federal
law.

C. A health information exchange or an electronic
medical record system operating in the state that
electronically stores or maintains electronic medical records,
health-insurance-related claims, payments or other
administrative data on behalf of an electronic health care
service provider, a provider or a health care service plan
shall, on or before July 1, 2028, develop capabilities,
policies and procedures that allow for and ensure that the
health information exchange or electronic medical record
system:

(1) allows segregation of an individual's
health care information related to reproductive health care and
gender-affirming health care from the rest of the individual's
health care information;

(2) allows for an individual to provide
written authorization to allow or disallow access to the
individual's segregated records related to reproductive health
care and gender-affirming health care; and

(3) limits access privileges of a user of
electronic medical records systems that contain medical records
related to reproductive health care and gender-affirming health
care to only those persons or entities for whom the individual
has provided written authorization for access.

[
C.
]
D.
A record locator service shall maintain an
audit log of persons obtaining access to information in the
record locator service, which audit log shall contain, at a
minimum, information on:

(1) the identity of the person obtaining
access to the information;

(2) the identity of the individual whose
information was obtained;

(3) the location from which the information
was obtained;

(4) the specific information obtained; and

(5) the date that the information was
obtained.

[
D.
]
E.
The audit log shall be made available by a
health information exchange on the request of an individual
whose health care information is the subject of the audit log;
provided, however, that the audit log made available to the
individual shall include only information related to that
individual. The audit log shall be made available to the
requesting individual annually for a fee not to exceed twenty-five cents ($.25) per page as established by the [
department
of
] health
care authority
.

[
E.
]
F.
A record locator service shall provide a
mechanism under which individuals may exclude their demographic
information and information about the location of their
electronic medical records from the record locator service. A
person operating a record locator service or a health
information exchange that receives an individual's request to
exclude all of the individual's information from the record
locator service is responsible for removing that information
from the record locator service within thirty days. An
individual's request for exclusion of information shall be in
writing and shall include a waiver of liability for any harm
caused by the exclusion of the individual's information.

[
F.
]
G.
When information in an individual's
electronic medical record is requested using a record locator
service or a health information exchange:

(1) the requesting provider or health care
institution shall warrant that the request is for the treatment
of the individual, is permitted by the individual's written
authorization or is otherwise permitted by state or federal
law; and

(2) the person disclosing the information may
rely upon the warranty of the person making the request that
the request is for the treatment of the individual, is
permitted with the consent of the individual or is otherwise
permitted by state or federal law.

H. Notwithstanding any other provision of law, a
provider, a health care service plan, a health care group
purchaser, a health information exchange or an electronic
health care service provider shall:

(1) not release an individual's health care
information in response to a request, including a foreign
subpoena, summons or other civil, criminal or regulatory
inquiry or investigation request, if the provider, health care
service plan, health care group purchaser, health information
exchange or electronic health care service provider knows or
has reason to believe that the request is based on another
state's law that interferes with a protected health care
activity or with a person's rights under the Reproductive and
Gender-Affirming Health Care Freedom Act or the Reproductive
and Gender-Affirming Health Care Protection Act;

(2) notify an individual whose health care
information is the subject of a request described in Paragraph
(1) of this subsection of the existence of the request within
thirty days of receipt of the request; and

(3) notify each provider that rendered
reproductive health care or gender-affirming health care as
documented in the health care information sought in a request
described in Paragraph (1) of this subsection of the existence
of the request within thirty days of receipt of the request.

I. A provider, a health care service plan, a health
care group purchaser, a health information exchange or an
electronic health care service provider shall not be subject to
any civil, criminal or administrative liability or professional
disciplinary action for refusing to disclose health care
information in accordance with Subsection H of this section.

[
G.
]
J.
Notwithstanding any other provision of law,
information in an individual's electronic medical record may be
disclosed:

(1) to a provider that has a need for
information about the individual to treat a condition that
poses an immediate threat to the life of any individual and
that requires immediate medical attention;

(2) except as provided in the Electronic
Medical Records Act, to a record locator service or a health
information exchange for the development and operation of the
record locator service and the health information exchange; and

(3) to a provider, health care institution or
health care group purchaser for treatment, payment or health
care operation activities, in compliance with the federal
Health Insurance Portability and Accountability Act of 1996 and
the regulations promulgated pursuant to that act, and if
applicable, in compliance with 42 U.S.C. Section 290dd-2 and
the regulations promulgated pursuant to that section.

[
H.
]
K.
For the purposes of this section, "health
care operation activities" includes administrative, financial,
legal and quality improvement activities of a covered entity
that are necessary to conduct business and to support the core
functions of treatment and payment and are limited to the
activities listed in the definition of "health care operations"
at 45 C.F.R. 164.501."

SECTION 4.
Section 24-14B-7 NMSA 1978 (being Laws 2009,
Chapter 69, Section 7) is amended to read:

"24-14B-7. LIABILITY.--If an individual requests to
exclude all of the individual's information from the record
locator service pursuant to Subsection [
E
]
F
of Section [
6 of
the Electronic Medical Records Act
]
24-14B-6 NMSA 1978
, the
record locator service, health information exchange, health
care institution or provider shall not be liable for any harm
to the individual caused by the exclusion of the individual's
information."

SECTION 5.
A new section of the Electronic Medical
Records Act, Section 24-14B-11 NMSA 1978, is enacted to read:

"24-14B-11. [
NEW MATERIAL
] ENFORCEMENT.--

A. A health information exchange or an electronic
medical record system determined to be in violation of the
Electronic Medical Records Act shall be:

(1) subject to injunctive relief to cease or
correct the violation;

(2) liable for a civil penalty of not more
than two thousand five hundred dollars ($2,500) for each
negligent violation; or

(3) liable for a civil penalty of not more
than ten thousand dollars ($10,000) for each intentional
violation.

B. The attorney general or a district attorney may

institute a civil action in district court if the attorney
general or district attorney has reasonable cause to believe

that a violation of the Electronic Medical Records Act has
occurred or to prevent a violation of that act."

SECTION 6.
A new section of the Electronic Medical
Records Act, Section 24-14B-12 NMSA 1978, is enacted to read:

"24-14B-12. [
NEW MATERIAL
] VIOLATIONS--REMEDIES.--In
addition to any other remedies available by law, an individual
who claims to have suffered a loss or a deprivation of a right
under the Electronic Medical Records Act may maintain an action
to establish liability and to recover damages and equitable or
injunctive relief in a New Mexico district court."

SECTION 7.
Section 24-35-1 NMSA 1978 (being Laws 2023,

Chapter 167, Section 1) is amended to read:

"24-35-1. SHORT TITLE.--[
Sections 1 through 8 of this

act
]
Chapter 24, Article 35 NMSA 1978
may be cited as the

"Reproductive and Gender-Affirming Health Care Protection

Act"."

SECTION 8.
Section 24-35-6 NMSA 1978 (being Laws 2023,
Chapter 167, Section 6) is amended to read:

"24-35-6. HEIGHTENED PROTECTION FOR ELECTRONICALLY
TRANSMITTED INFORMATION RELATED TO A PROTECTED HEALTH CARE
ACTIVITY.--

A. For purposes of this section, "third party"
means an individual or entity who transmits information related
to a protected health care activity, in the normal course of
business, in an electronic format. "Third party" does not mean
a covered entity or business associate as defined by the
federal Health Insurance Portability and Accountability Act of
1996 and related regulations.

B. It shall be a violation of the Reproductive and
Gender-Affirming Health Care Protection Act to request from a
third party, or for a third party to transmit, information
related to an individual's or entity's protected health care
activity with the intent to:

(1) identify or track an individual engaged in
a protected health care activity;

[
(1)
]
(2)
harass, humiliate or intimidate that
individual or entity;

[
(2)
]
(3)
incite another to harass, humiliate
or intimidate that individual or entity;

[
(3)
]
(4)
cause that individual to reasonably
fear for that individual's own or family members' safety;

[
(4)
]
(5)
cause that individual to suffer
unwanted physical contact or injury;

[
(5)
]
(6)
cause that individual to suffer
substantial emotional distress; or

[
(6)
]
(7)
deter, prevent, sanction or penalize
an individual or entity for engaging in a protected health care
activity.

C. This section shall not apply to a lawsuit or
judgment entered in another state that is based on conduct for
which a cause of action exists under the laws of New Mexico."

SECTION 9.
A new section of the Reproductive and
Gender-Affirming Health Care Protection Act is enacted to read:

"[
NEW MATERIAL
] HEALTH AND LOCATION DATA PRIVACY.--

A. Except as provided in this section, it is
unlawful to geofence a health care facility or the offices and
treatment rooms or other facilities of a private licensed
provider of reproductive health care or gender-affirming health
care to:

(1) identify or track a person engaged in a
protected health care activity;

(2) collect, use, disclose, sell, share or
retain personal data from a person engaged in a protected
health care activity; or

(3) send notifications or advertisements to a
person related to the person's personal data or the person's
reproductive health care or gender-affirming health care.

B. It is unlawful to sell personal data to or share
personal data with a third party if the personal data is used
by the third party to identify or track a person engaged in a
protected health care activity or send notifications or
advertisements to a person related to the person's personal
data or the person's reproductive health care or gender-affirming health care.

C. A statement signed under penalty of perjury made
by a person authorized to enter into an agreement on behalf of
a third party that receives personal data that affirms that
personal data received will not be used for a purpose
prohibited by Subsection B of this section shall be prima facie
evidence that the personal data was not sold or shared in
violation of Subsection B of this section.

D. Nothing in this section shall be construed to
prohibit a person that owns, operates, manages or otherwise
provides services to an in-person health care facility from
geofencing the facility's own location, including offices and
treatment rooms of a private licensed health care provider:

(1) to provide necessary health care services,
including the use of location-based alarm devices to monitor
newborns and memory-impaired individuals; or

(2) for the purpose of providing security
services to protect patients, staff or property.

E. Nothing in this section shall exempt a person
from complying with a lawfully executed search warrant or a
lawful subpoena issued pursuant to New Mexico law.

F. Nothing in this section abrogates or limits the
requirements of the Electronic Communications Privacy Act or
rights and remedies otherwise available by law.

G. Nothing in this section shall apply to
geofencing activities conducted solely for research purposes by
an investigator within an institution that holds an assurance
with the United States department of health and human services
pursuant to Part 46 of Title 45 of the Code of Federal
Regulations and who obtains informed consent in the method and
manner required by those regulations.

H. As used in this section:

(1) "collect" means to rent, gather, obtain,
receive or access by any means a person's personal data,
including receiving a person's personal data directly from the
person, actively or passively, or by observing the person's
behavior;

(2) "geofence" means any technology that
enables spatial or location detection to establish a virtual
boundary around, and detect an individual's presence within, a
precise geolocation;

(3) "personal data" means information,
including derived data, that is linked or reasonably linkable,
alone or in combination with other information, to an
identified or identifiable natural person, and includes:

(a) biometric or genetic data;

(b) data revealing citizenship, ethnic
origin, immigration status or national origin;

(c) financial data, including a credit
card number, a debit card number, a financial account number or
information that describes or reveals the bank account balances
or income level of a natural person;

(d) a government-issued identifier, such
as a social security number, passport number or driver's
license number, that is not required by law to be displayed in
public;

(e) data describing or revealing the
past, present or future mental or physical health or condition
or status of a natural person;

(f) data revealing gender, gender
identity, sex or sexual orientation;

(g) religious affiliation;

(h) union membership; or

(i) precise geolocation;

(4) "precise geolocation" means a geographic
area that is equal to or less than the area of a circle with a
radius of two thousand feet as derived from a device that is
used or intended to be used to locate a person; and

(5) "share" means to provide, rent, release,
disclose, disseminate, make available, transfer or otherwise
communicate, whether orally, in writing or by electronic or
other means, a person's personal data, regardless of whether
monetary or other consideration is provided for the data."

SECTION 10.
Section 24A-1-7 NMSA 1978 (being Laws 2003,
Chapter 426, Section 1, as amended) is amended to read:

"24A-1-7. LEGISLATIVE FINDINGS--DEFINITIONS--LICENSING
REQUIREMENTS FOR CERTAIN HOSPITALS.--

A. The legislature finds that:

(1) acute care general hospitals throughout
New Mexico operate emergency departments and provide vital
emergency medical services to patients requiring immediate
medical care; and

(2) federal and state laws require hospitals
that operate an emergency department to provide certain
emergency services and care to any person, regardless of that
person's ability to pay. Accordingly, these hospitals
encounter significant financial losses when treating uninsured
or underinsured patients.

B. As used in this section:

(1) "emergency medical condition" means:

(a) a medical or behavioral health
condition manifesting itself by acute symptoms of sufficient
severity, including severe pain, such that a prudent layperson
who possesses an average knowledge of health and medicine could
reasonably expect that the absence of immediate medical
attention may result in: 1) placing the health of the
individual at risk; 2) impairment to bodily functions; or 3)
dysfunction of any bodily organ or part;

(b) with respect to a pregnant person
who is experiencing contractions, inadequate time to effectuate
a safe transfer to another facility before delivery, or that
transferring the patient may pose a threat to the health or
safety of the patient, and includes: active labor; an ectopic
pregnancy; a complication resulting from pregnancy; pregnancy
loss; attempted termination of pregnancy; risk to future
fertility; previable, preterm or premature rupture of
membranes; risk of infection; cervical insufficiency; and
emergent hypertensive disorders when the absence of immediate
medical attention could reasonably be expected to result in
placing the health of the patient in serious jeopardy, serious
impairment to bodily functions or serious dysfunction of any
bodily organ or part; and

(c) any other condition a health care
practitioner acting within the practitioner's lawful scope of
practice determines, in the practitioner's reasonable medical
judgment, to be an emergency medical condition;

[
(1)
]
(2)
"limited service hospital" means a
hospital that limits admissions according to medical or
surgical specialty, type of disease or medical condition, or a
hospital that limits its inpatient hospital services to
surgical services or invasive diagnostic and treatment
procedures; provided, however, that a "limited service
hospital" does not include:

(a) a hospital licensed by the authority
as a special hospital;

(b) an eleemosynary hospital that does
not bill patients for services provided; or

(c) a hospital that has been granted a
license prior to January 1, 2003; [
and

(2)
]
(3)
"low-income patient" means a patient
whose family or household income does not exceed two hundred
percent of the federal poverty level;
and

(4) "stabilize" means to provide medical
treatment that may be necessary to ensure, within reasonable
medical probability, that no material deterioration of the
patient's condition, serious impairment of bodily functions or
dysfunction of any bodily organ or part or a threat to the
patient's life is likely to result from or occur during the
transfer or discharge of the patient
.

C. The authority shall issue a license to an acute-care or general hospital or a limited services hospital that
agrees to:

(1) continuously maintain and operate an
emergency department that provides emergency medical services,

including:

(a) appropriate medical screenings and
examinations, within the capability of the facility, to
determine whether a patient is experiencing an emergency
medical condition;

(b) the medical treatment necessary to
stabilize the emergency medical condition that is within the
capability of the staff and facilities available at the
hospital;

(c) the transfer of a patient to another
medical facility in accordance with the hospital's written
policies and procedures for transferring a patient to an
appropriate facility when the patient's medical status
indicates the need for emergency care that the facility cannot
provide;

(d) the provision of an abortion or
sterilization procedures when a patient has an emergency
medical condition and an abortion or sterilization procedures
are necessary to stabilize the patient and the provision of
which is within the capability of the staff and facilities
available at the facility; and

(e) other services
as determined by the
authority;

(2) participate in the medicaid, medicare and
county indigent care programs;

(3) require a physician owner to disclose a
financial interest in the hospital before referring a patient
to the hospital;

(4) comply with the same quality standards
applied to other hospitals;

(5) provide emergency services and general
health care to nonpaying patients and low-income reimbursed
patients in the same proportion as the patients are treated in
acute-care general hospitals in the local community, as
determined by the authority in consultation with a statewide
hospital organization, the government of the county in which
the facilities are located and the affected hospitals; provided
that:

(a) a hospital may appeal the
determination of the authority as a final agency decision as
provided in Section 39-3-1.1 NMSA 1978; and

(b) the annual cost of the care required
to be provided pursuant to this paragraph shall not exceed an
amount equal to five percent of the hospital's annual revenue;
and

(6) require a health care provider to disclose
a financial interest before referring a patient to the
hospital."

SECTION 11.
Section 26-1-16 NMSA 1978 (being Laws 1967,
Chapter 23, Section 16, as amended) is amended to read:

"26-1-16. DANGEROUS DRUGS--CONDITIONS FOR SALE--PRESCRIPTION REFILLING--LIMITATIONS.--

A. It is unlawful for a person to sell, dispose of
or possess any dangerous drugs, except:

(1) manufacturers, wholesalers or
distributors, their agents or employees licensed by the board
to ship dangerous drugs into the state; or

(2) distributors, wholesalers, hospitals,
nursing homes, clinics or pharmacies and other authorized
retailers of dangerous drugs in this state licensed by the
board, and appropriate records of dangerous drugs receipt and
disposition are kept. These records shall be open to
inspection by any enforcement officer of this state.

B. Practitioners licensed in this state may
prescribe, provide samples of and dispense any dangerous drug
to a patient where there is a valid practitioner-patient
relationship. A record of all such dispensing shall be kept
showing the date the drug was dispensed and bearing the name
and address of the patient to whom dispensed. It is the duty
of every licensed physician, dentist, veterinarian, pharmacist
or person holding a limited license issued under Subsection B
of Section 61-11-14 NMSA 1978, when dispensing any dangerous
drug, to mark on the dispensing container the name of the
patient, the date dispensed, the name and address of the person
dispensing the drug, the name and strength of the drug,
expiration date where applicable, adequate directions for use
and the prescription number when applicable. All official
compendium requirements for the preservation, packaging,
labeling and storage of dangerous drugs are applicable where
drugs are held for dispensing to the public, whether by a
pharmacy, clinic, hospital or practitioner.

C. Notwithstanding the requirements of Subsection B
of this section or any other law, a practitioner that has
prescribed a drug used for medication abortion, including
brand-name or generic mifepristone, may request that the drug
be dispensed in a dispensing container marked with the name and
address of the health care facility at which the practitioner
practices. If a practitioner makes such a request, the
dispensing container shall not be marked with the prescribing
practitioner's personal name or address.

[
C.
]
D.
Pharmacists are prohibited from selling or
dispensing a dangerous drug except on prescription or drug
order of a practitioner and except as such sale or possession
is authorized under Subsection A of this section. It is the
duty of all pharmacists to keep an accurate record of all
disposals, which record shall be open to inspection by an
enforcement officer of this state.

[
D.
]
E.
No enforcement officer having knowledge by
virtue of office of a prescription, order or record shall
divulge such knowledge except in connection with a prosecution
or proceeding in court or before a licensing or registration
board or officer, to which prosecution or proceeding the person
to whom such prescriptions, orders or records relate is a
party.

[
E.
]
F.
It is unlawful, except as otherwise
authorized under Subsection A of this section or the Controlled
Substances Act and except for the college of pharmacy of the
university of New Mexico or a public health laboratory, for a
person to possess any dangerous drug unless such substance has
been dispensed to the person either directly by a practitioner
or on a prescription.

[
F.
]
G.
All records required to be kept under the
provisions of the New Mexico Drug, Device and Cosmetic Act
shall be preserved for a period of three years; provided that
records requirements do not apply to the administration of a
drug to a patient upon whom the practitioner personally
attends; and provided that records of controlled substances
shall be kept in accordance with the provisions of the
Controlled Substances Act.

[
G.
]
H.
A prescription shall not be filled:

(1) as a refill if it is marked by the issuing
practitioner to indicate that the prescription is not to be
refilled;

(2) except in compliance with the provisions
of the Controlled Substances Act if the drug is a controlled
substance;

(3) unless the fill is made in accordance with
the provisions of this section; and

(4) when the practitioner does not indicate
fill instructions on the original prescription calling for a
dangerous drug, unless:

(a) the practitioner is contacted
orally, by telephone or other means of communication for
instruction; and

(b) if authorization to fill is given
the pharmacist, the following information will be immediately
transferred to the original prescription: 1) date; 2) name of
person authorizing the fill; 3) pharmacist's initials; and 4)
amount dispensed if different from the amount indicated on the
original prescription.

[
H.
]
I.
Nothing in this section shall prevent the
owner of livestock or the owner's consignee or their employees
to be in possession of drugs for their use in performing
routine, accepted livestock management practices in the care of
livestock belonging to the owner, and the drugs are labeled as
being restricted to animal use only; provided, that if such
drugs bear the legend: "CAUTION: federal law restricts this
drug to use by or on the order of a licensed veterinarian", the
drugs may be used or distributed only as provided in Subsection
A of Section 26-1-15 NMSA 1978.

[
I.
]
J.
When, on the original prescription calling
for a dangerous drug that is not a controlled substance, a
practitioner indicates a specific number of fills or a specific
period of time during which a prescription may be filled, a
drug may be filled the number of times or for the period of
time that the prescription indicates if the following
information is provided with the prescription:

(1) the date of fill;

(2) the initials of the pharmacist filling the
prescription; and

(3) the amount of drug dispensed, if it
differs from the amount called for on the original
prescription.

[
J.
]
K.
A pharmacist may dispense a quantity not to
exceed a ninety-day supply of a dangerous drug by combining
valid fills when:

(1) an indication on the prescription or label
does not specifically prohibit a combined fill; and

(2) the dangerous drug to be filled is not a
controlled substance.

[
K.
]
L.
When the practitioner indicates on the
original prescription calling for dangerous drugs that it may
be filled "prn", the pharmacist may fill it within the limits
of the dosage directions for a period of twelve months;
provided
that
the date of filling and the initials of the
pharmacist are recorded on the original prescription. At the
expiration of the twelve-month period, the practitioner must be
contacted for a new prescription; provided that this is not to
be construed to apply to those drugs regulated by the
Controlled Substances Act.

[
L.
]
M.
The board may adopt and promulgate
regulations to permit the use of computer systems for the
storage and retrieval of prescriptions, records for the purpose
of filling prescriptions, receipt records, drug distribution
records, drug withdrawals from stock, drug compounding records,
drug disposition records and drug disposal records.

[
M.
]
N.
As used in this section, "fill" means a
dispensing of a drug for the first time or as a refill."

SECTION 12.
Section 40-13B-2 NMSA 1978 (being Laws 2018,
Chapter 40, Section
2) is amended to read:

"40-13B-2. DEFINITIONS.--As used in the Confidential
Substitute Address Act:

A. "agency" means an agency of the state or of a
political subdivision of the state;

B. "applicant" means a person who submits an
application to participate in the confidential substitute
address program;

C. "application assistant" means a person who works
or volunteers for a domestic violence or sexual assault program
and who assists in preparing an application for the
confidential substitute address program;

D. "confidential substitute address" means an
address designated for a participant by the secretary of state
pursuant to the Confidential Substitute Address Act;

E. "delivery address" means the address where an
applicant or a participant receives mail, and it may be the
same as the person's residential address;

F. "domestic violence" means "domestic abuse", as
defined in the Family Violence Protection Act;

G. "participant" means a person certified to
participate in the confidential substitute address program
pursuant to the Confidential Substitute Address Act;

H. "protected health care provider" means a natural
person engaged in a protected health care activity as defined
in the Reproductive and Gender-Affirming Health Care Protection
Act through the person's provision of or aid in the provision
of reproductive health care or gender-affirming health care;

[
H.
]
I.
"public record" means "public records", as
defined in the Inspection of Public Records Act; and

[
I.
]
J.
"residential address" means the street
address where an applicant or participant resides or will
relocate."

SECTION 13.
Section 40-13B-3 NMSA 1978 (being Laws 2018,
Chapter 40, Section 3, as amended) is amended to read:

"40-13B-3. CONFIDENTIAL SUBSTITUTE ADDRESS PROGRAM--APPLICATION.--

A. The "confidential substitute address program" is
created in the office of the secretary of state to provide a
process by which a
natural person who is a
victim of domestic
violence
or a protected health care provider
may protect the
confidentiality of the [
victim's
]
natural person's
residential
and delivery addresses in public records.

B. [
An applicant
]
A protected health care provider,
or a victim of domestic violence who wishes to become a
participant
with the assistance of an application assistant,
shall submit an application to the secretary of state on a form
prescribed by the secretary of state. [
The
]
An
application
assistant's signature shall serve as recommendation that the
applicant participate in the confidential substitute address
program.
An application submitted by a protected health care
provider shall only require the provider's signature confirming
the provider's status as a protected health care provider.

C. An application shall be signed and dated by the
applicant and,
if applicable
, the application assistant and
shall include:

(1) the applicant's name;

(2) the applicant's statement that the
applicant fears for the safety of the applicant, the
applicant's child or another person in the applicant's
household because of a threat of immediate or future harm;

(3) the applicant's statement that the
disclosure of the applicant's residential or delivery address
would endanger the applicant, the applicant's child or another
person in the applicant's household;

(4)
if the applicant is a victim of domestic
violence
, the applicant's statement that the applicant has
confidentially relocated in the past ninety days or will
relocate within the state in the next ninety days;

(5) a designation of the secretary of state as
the applicant's agent for the purpose of receiving mail,
deliveries and service of process, notice or demand;

(6) the names and ages of those persons in the
applicant's household who will also be participants in the
program if the applicant is admitted into the program. Each
person in an applicant's household listed in the application
shall be considered a separate participant in the program;

(7) the applicant's residential and delivery
addresses, if different, the confidentiality of which the
applicant seeks to protect;

(8) the applicant's telephone number and email
address; and

(9) the applicant's statement under penalty of
perjury that the information contained in the application is
true."

SECTION 14.
Section 40-13B-4 NMSA 1978 (being Laws 2018,
Chapter 40, Section 4, as amended) is amended to read:

"40-13B-4. SECRETARY OF STATE--DUTIES--SERVICE ON
PARTICIPANT.--

A. The secretary of state shall:

(1) certify applicants whose applications
comply with the requirements of the Confidential Substitute
Address Act to participate in the confidential substitute
address program;

(2) upon certification with respect to each
participant:

(a) issue a confidential substitute
address identification card;

(b) designate a confidential substitute
address that shall be used in place of the participant's
residential or delivery address by state and local government
agencies;

(c) receive mail and deliveries sent to
a participant's confidential substitute address and forward the
mail and deliveries to the participant's delivery address at no
charge to the participant;

(d) accept service of process, notice or
demand that is required or permitted by law to be served on the
participant and immediately forward the process, notice or
demand to the participant's delivery address at no charge to
the participant; and

(e) maintain records of the following
that are received and forwarded by the secretary of state: 1)
a participant's certified and registered mail; and 2) any
process, notice or demand that is served on a participant; and

(3) [
administer the provisions of the Intimate
Partner Violence Survivor Suffrage Act to
] ensure that a
participant who is eligible to vote in this state is able to be
securely registered to vote and to automatically receive a
ballot for each election,
including through the secretary's
administration of the Intimate Partner Violence Survivor
Suffrage Act
.

B. Service made pursuant to the provisions of this
section is perfected three days after it is accepted by the
secretary of state."

SECTION 15.
Section 40-13B-5 NMSA 1978 (being Laws 2018,
Chapter 40, Section 5, as amended) is amended to read:

"40-13B-5. AGENCIES--USE OF CONFIDENTIAL SUBSTITUTE
ADDRESS--PUBLIC RECORDS.--

A. A participant shall:

(1) contact each agency that requests or uses
an address; and

(2) provide the agency with a copy of the
participant's confidential substitute address identification
card.

B. Agencies that receive copies of confidential
substitute address identification cards submitted pursuant to
this section shall use the participant's confidential
substitute address for all purposes.

C. A school district shall use a participant's
confidential substitute address as the participant's address of
record and, if necessary, shall verify a student's enrollment
eligibility with the secretary of state.

D. A county clerk shall transfer all records
related to a participant's voter registration to the secretary
of state [
pursuant to the
]
and shall comply with all
provisions
of the Intimate Partner Violence Survivor Suffrage Act.

E. A participant's residential or delivery address,
telephone number and email address that are maintained by an
agency are not public records and shall not be disclosed
pursuant to the Inspection of Public Records Act while a person
is a participant."

SECTION 16.
Section 40-13B-7 NMSA 1978 (being Laws 2018,
Chapter 40, Section 7, as amended) is amended to read:

"40-13B-7. PARTICIPANT DECERTIFICATION.--

A. A participant shall be decertified from the
confidential substitute address program if:

(1) the participant submits a request to
withdraw from the confidential substitute address program to
the secretary of state;

(2) the participant fails to notify the
secretary of state of a legal name change or a change to the
participant's residential address, delivery address, telephone
number or email address;

(3) mail that is forwarded by the secretary of
state to the participant's delivery address is returned as
undeliverable; or

(4) the participant
is a survivor of domestic
violence and
does not comply with the provisions of the
Intimate Partner Violence Survivor Suffrage Act.

B. If the secretary of state determines that one or
more of the causes for decertification provided in Subsection A
of this section exist, the secretary of state shall send notice
of the participant's decertification to the participant's
delivery and residential addresses and shall attempt to notify
the participant by telephone and email. The participant shall
be given ten days from the date of decertification to appeal
the decertification.

C. A person who is decertified from the
confidential substitute address program shall not continue to
use the person's confidential substitute address.

D. For six months after a participant has been
decertified, the secretary of state shall forward mail and
deliveries to an address provided by the former participant.
Upon receipt of mail and deliveries pursuant to this
subsection, a former participant shall provide an updated
address to the sender."

SECTION 17.
Section 40-13B-8 NMSA 1978 (being Laws 2018,
Chapter 40, Section 8, as amended) is amended to read:

"40-13B-8. PARTICIPANT RECORDS--CONFIDENTIALITY--DISCLOSURE PROHIBITED.--

A. The secretary of state and an agency shall not
disclose the residential address, delivery address, telephone
number or email address of a participant unless the information
is required to be disclosed pursuant to a court order. A
person or agency that receives a participant's residential
address, delivery address, telephone number or email address
pursuant to a court order shall not in turn disclose that
information unless pursuant to a court order or unless the
person who was a participant has been decertified.

B. The secretary of state shall maintain the
confidentiality of all records relating to an applicant for or
participant in the confidential substitute address program
while the person is a participant and shall:

(1) store all tangible copies of program
records in locked equipment;

(2) store all electronic copies of program
records in a password-protected system;

(3) restrict access to all program records to
secretary of state staff members who are approved to access the
records as provided in this section; and

(4) release program records only on a court's
order.

C. The secretary of state shall establish a system
for restricting access to program records to approved staff
members. Before being approved and granted access to program
records, the staff member shall:

(1) submit to a criminal background check
performed by the department of public safety;

(2) not have a record of a sex offense, felony
or a misdemeanor violation related to domestic violence or
sexual assault on the results of the person's criminal
background check; and

(3) complete forty hours of training,
including a domestic violence training course provided by the
children, youth and families department and sexual assault
training provided by the department of health or the crime
victims reparation commission or its successor.

D. The secretary of state shall appoint a person to
be the administrator of the election component of the
confidential substitute address program
with respect to all
participants and
in accordance with the Intimate Partner
Violence Survivor Suffrage Act. The administrator shall meet
the requirements of Subsection C of this section, and
administration of the Intimate Partner Violence Survivor
Suffrage Act shall conform to the requirements of Subsections A
and B of this section and Subsection E of Section 40-13B-5 NMSA
1978."

- 41 -