Section 7. Definitions

A. “Allowed amount” means the negotiated amount eligible for payment for a health care service or item rendered by a provider. B. “Billed amount” means the amount billed by a provider requesting payment for health care services or items rendered. C. “Claim” means a financial accounting of or a request for payment for health care items or services rendered by a provider. D. “Data” means the data required by this rule to be submitted to this database, including data on the following health factors: mortality and natality, including accidental causes of death; morbidity; health behavior; disability; health system costs, availability, utilization and revenues; environmental factors; health personnel; demographic factors; social, cultural and economic conditions affecting health, including language preference; family status; medical and practice outcomes as measured by nationally accepted standards and quality of care; and participation in clinical research trials. E. “Data provider” means a person that possesses health information, including any public or private sector licensed health care practitioner, primary care clinic, ambulatory surgery center, ambulatory urgent care center, ambulatory dialysis unit, home health agency, long-term care facility, hospital, pharmacy, third-party payer and any public entity that has health information. F. “Database” means the statewide all-payer health care claims database established in this rule. G. “Department” means the department of health. H practitioner, primary care clinic, ambulatory surgery center, ambulatory urgent care center, ambulatory dialysis unit, home health agency, long-term care facility, hospital, pharmacy, third-party payer and any public entity that has health information. F. “Database” means the statewide all-payer health care claims database established in this rule. G. “Department” means the department of health. H. “Direct patient identifier” means a data variable that identifies an individual, including: names; telephone numbers; fax numbers; social security number; medical record numbers; health plan beneficiary numbers; account numbers; certificate or license numbers; vehicle identifiers and serial numbers, including license plate numbers; device identifiers and serial numbers; web universal resource locators; internet protocol address numbers; biometric identifiers, including finger and voice prints; elements of dates more granular than a year; un-aggregated ages over 89; geographic subdivisions smaller than the state, except the first three digits of ZIP, full face photographic images and any comparable images; and any other unique identifying number, characteristic, or code, except as permitted by 45 C.F.R 164.514 (c). I. “ERISA plan" means an employee welfare benefit plan to the extent that the plan provides medical care to employees or their dependents under the Employee Retirement Income Security Act of 1974 directly 7.1.31 NMAC 2 or through insurance, reimbursement or other means. J mparable images; and any other unique identifying number, characteristic, or code, except as permitted by 45 C.F.R 164.514 (c). I. “ERISA plan" means an employee welfare benefit plan to the extent that the plan provides medical care to employees or their dependents under the Employee Retirement Income Security Act of 1974 directly 7.1.31 NMAC 2 or through insurance, reimbursement or other means. J. “Health information” or “health data” means any data relating to health care; health status, including environmental, social and economic factors; a health system or provider; health costs, financing, and including data that would customarily be collected in the ordinary course of business for the data provider; annual audited financial statements customarily prepared by a data provider; information on major capital expenditures; data established by regulation to be collected to carry out the requirements of the Health Information System Act; data required to be collected by other state or federal laws; and annual surveys or collection of data may be used as an alternative to collection of health data from some health service providers to the extent it can be shown that the information collected will meet validity and quality standards. K. “Health information system” or “HIS” means the health information system established by the Health Information System Act, Sections 24-14A-1 to 24-14A-10, NMSA 1978. L. “Health insurance carrier” means any entity that offers the following: (1) group health and dental coverage governed by the provisions of the Health Care Purchasing Act; (2) individual health and dental insurance policies, health benefits plans and certificates of insurance governed by the provisions of Chapter 59A, Article 22 NMSA 1978; (3) health and dental multiple-employer welfare arrangements governed by the provisions of Section 59A-15-20 NMSA 1978; (4) group and blanket health and dental insurance policies, health benefits plans and certificates of insurance governed by the provisions of Chapter 59A, Article 23 alth benefits plans and certificates of insurance governed by the provisions of Chapter 59A, Article 22 NMSA 1978; (3) health and dental multiple-employer welfare arrangements governed by the provisions of Section 59A-15-20 NMSA 1978; (4) group and blanket health and dental insurance policies, health benefits plans and certificates of insurance governed by the provisions of Chapter 59A, Article 23 NMSA 1978; (5) individual and group health and dental health maintenance organization contracts governed by the provisions of the Health Maintenance Organization Law Chapter 59A, Article 46 NMSA 1978; and (6) individual and group health and dental nonprofit health benefits plans governed by the provisions of the Nonprofit Health Care Plan Law Chapter 59A, Article 47 NMSA 1978. M. “Indirect patient identifier” means a data variable that may identify an individual when combined with other information. N. “Proprietary financial information” means information that derives independent economic value, actual or potential, from not being generally known to and not being readily ascertainable by proper means by other persons who can obtain economic value from its disclosure or use; and is the subject of efforts that are reasonable under the circumstances to maintain its secrecy. O. “Secretary” means the secretary of the New Mexico department of health. P. “Unique identifier” means an obfuscated identifier assigned to an individual represented in the database to establish a basis for following the individual longitudinally throughout different payers and encounters in the data without revealing the individual’s identity. [7.1.31.7 NMAC - N, 04/20/2021] 7.1.31.8 STATEWIDE ALL-PAYER CLAIMS DATABASE–DUTIES-CONTRACT WITH DATA VENDOR: A. Duties of the department: (1) The department shall establish a statewide all-payer claims database to support transparent public reporting of health care information idual longitudinally throughout different payers and encounters in the data without revealing the individual’s identity. [7.1.31.7 NMAC - N, 04/20/2021] 7.1.31.8 STATEWIDE ALL-PAYER CLAIMS DATABASE–DUTIES-CONTRACT WITH DATA VENDOR: A. Duties of the department: (1) The department shall establish a statewide all-payer claims database to support transparent public reporting of health care information. The database must improve transparency to: assist patients, providers, and hospitals to make informed choices about care; enable providers, hospitals, and communities to improve by benchmarking their performance against that of others by focusing on best practices, enable purchasers to identify value, build expectations into their purchasing strategy, and reward improvements over time; and promote competition based on quality and cost. The database must systematically collect all medical claims for covered medical services, pharmacy claims, dental claims, member eligibility and enrollment data, and provider data with necessary identifiers from private and public payers, with data from all settings of care that permit the systematic analysis of health care delivery. (2) The department shall convene subcommittees to the HIS advisory committee with the approval of the secretary, including: (a) a subcommittee on data policy development; (b) a subcommittee to establish a data release process consistent with the requirements of this rule and to provide advice regarding formal data release requests. The advisory subcommittees must include in-state representation from key providers, hospitals, public health and health maintenance organizations, large and small private purchasers, consumer organizations, and the two largest carriers supplying claims data to the database; and 7.1.31 NMAC 3 (c) other subcommittees as needed. B. Duties of the department in contract with data vendor: (1) The department will conduct, or may engage a data vendor to perform, data collection, processing, aggregation, extracts, and analytics tenance organizations, large and small private purchasers, consumer organizations, and the two largest carriers supplying claims data to the database; and 7.1.31 NMAC 3 (c) other subcommittees as needed. B. Duties of the department in contract with data vendor: (1) The department will conduct, or may engage a data vendor to perform, data collection, processing, aggregation, extracts, and analytics. The department or data vendor must: (a) establish a secure data submission process with data providers; (b) review data submitters’ files per standards established by the department; (c) assess each record’s alignment with established format, frequency, and consistency criteria; (d) maintain responsibility for quality assurance, including, but not limited to: (i) the completeness, accuracy and validity of data provider’s data; (ii) accuracy of dates of service spans; (iii) maintaining consistency of record layout and counts; and (iv) identifying duplicate records; (e) assign unique identifiers, as defined in this rule, to individuals represented in the database; (f) ensure that direct patient identifiers, indirect patient identifiers, and proprietary information are released only in compliance with federal and state privacy laws and the terms of applicable confidentiality requirements; (g) demonstrate internal controls and affiliations with separate organizations as appropriate to ensure safe data collection, security of the data with state of the art encryption methods, actuarial support, and data review for quality assurance; (h) store data in a manner compliant with the federal Health Insurance Portability and Accountability Act and regulations, with access to the data strictly controlled and limited to staff with appropriate training, clearance, and background checks; and (i) maintain state of the art security standards for transferring data to approved data requestors support, and data review for quality assurance; (h) store data in a manner compliant with the federal Health Insurance Portability and Accountability Act and regulations, with access to the data strictly controlled and limited to staff with appropriate training, clearance, and background checks; and (i) maintain state of the art security standards for transferring data to approved data requestors. (2) The data vendor must submit detailed descriptions to the department’s chief information security officer to ensure robust security methods are in place. (3) The department is responsible for internal governance, management, funding, and operations of the database. The department shall work with the data vendor to: (a) collect claims data from data providers as provided in this rule; (b) design data collection mechanisms with consideration for the time and cost incurred by data providers and others in submission and collection and the benefits that measurement would achieve, ensuring the data submitted meet quality standards and are reviewed for quality assurance; (c) ensure protection of collected data and store and use of data in a manner that protects patient privacy and complies with this section. All patient-specific information must be secured with required standard encryption algorithms; (d) consistent with requirements of this rule, make information from the database available as a resource for public and private entities, including carriers, employers, providers, hospitals, and purchasers of health care; (e) report performance on cost and quality pursuant to this rule. (f) develop protocols and policies, including prerelease review by any entity identified by the department, to ensure the quality of data releases and reports; (g) the department may not charge providers or data providers fees other than fees directly related to requested reports.