Health record rights in New Mexico: what state law adds
In New Mexico, as of October 3, 2026, we found no law on health data held outside HIPAA; copy rights go no further than HIPAA; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices need not cover medical or health insurance information; and no rule we look for on AI in care is in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Chapter 57 NMSA, compiled through 2026 laws, has no consumer privacy or consumer health data law. 2026 SB 53 and HB 214 died in the legislature. The New Mexico Department of Justice site refused access.
How we searched (October 3, 2026): the official code search for health data, consumer health, sensitive data, data broker, artificial intelligence. Agency pages checked: nmdoj.gov, nmlegis.gov.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
No. A law is in force, but it adds nothing to HIPAA's terms.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Deadline is 30 days, equal to HIPAA. No free copy case found. Fee caps are per page and do not count. Nothing goes beyond the HIPAA and information blocking floor.
Deadline in the law: 30 days (not shorter than HIPAA's 30).
Fee rule: 8.370.6.10 NMAC (social security disability requests): "No health care provider shall charge more than: A. $2.00 per page for the first 10 one-sided pages"; then not more than twenty cents per page.
Fee rule: 16.10.17.8 NMAC (physicians): "A reasonable charge is not more than $30 for the first 15 pages, and $0.25 per page thereafter".
Goes beyond the federal floor: no.
Access to medical records by applicants for disability benefits. NMSA 1978, § 14-6-3
In force · effective · read October 3, 2026 · source(nmonesource.com, reached from nmlegis.gov)
Within thirty days of receiving a request from a patient or former patient who is applying for benefits based on social security disability or who is appealing a denial of such benefits
Who it binds, in our words: Health care providers; requests from patients applying for or appealing social security disability benefits.
Access to medical records by disability applicants: production of records. 8.370.6.9 NMAC
In force · effective · read October 3, 2026 · source(srca.nm.gov)
shall be produced within 30 calendar days of receipt of the written request, regardless of prior receipt of the fee for the records
Who it binds, in our words: Health care providers receiving requests from persons applying for or appealing social security disability benefits.
Access to medical records by disability applicants: fees. 8.370.6.10 NMAC
In force · effective · read October 3, 2026 · source(srca.nm.gov)
No health care provider shall charge more than: A. $2.00 per page for the first 10 one-sided pages
Who it binds, in our words: Health care providers receiving requests from persons applying for or appealing social security disability benefits.
Medical Board rule: release of medical records. 16.10.17.8 NMAC
In force · effective · read October 3, 2026 · source(srca.nm.gov)
A reasonable charge is not more than $30 for the first 15 pages, and $0.25 per page thereafter
Who it binds, in our words: Physicians who have physical possession or ownership of medical records.
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Statute allows exchange for treatment, payment and operations without consent and requires a record locator exclusion mechanism. SYNCRONYS publishes a full opt-out. TPO exchange must comply with 42 U.S.C. 290dd-2 where it applies, so substance use records keep the federal consent rule.
Set by state law.
Designated exchange: SYNCRONYS.
Some sensitive records need your consent even where routine records do not.
Electronic Medical Records Act: use and disclosure of electronic health care information (record locator exclusion). NMSA 1978, § 24-14B-6(E)
In force · effective · read October 3, 2026 · source(nmonesource.com, reached from nmlegis.gov)
A record locator service shall provide a mechanism under which individuals may exclude their demographic information and information about the location of their electronic medical records from the record locator service
Who it binds, in our words: Record locator services and health information exchanges.
Electronic Medical Records Act: disclosure for treatment, payment and operations. NMSA 1978, § 24-14B-6(G)(3)
In force · effective · read October 3, 2026 · source(nmonesource.com, reached from nmlegis.gov)
to a provider, health care institution or health care group purchaser for treatment, payment or health care operation activities
Who it binds, in our words: Information in an individual's electronic medical record; applies notwithstanding any other provision of law.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Laws 2023, ch. 167 limits release of information about a protected health care activity by public bodies to out-of-state investigations and limits requests to third parties for such information with listed intents.
Reproductive and Gender-Affirming Health Care Protection Act: public body; prohibited release of information related to a protected health care activity. NMSA 1978, § 24-35-3
In force · effective · read October 3, 2026 · source(nmonesource.com, reached from nmlegis.gov)
A public body or an individual or entity acting on behalf of or within the scope of the authority of a public body shall not release information or use resources available to it in furtherance of a foreign investigation or proceeding that seeks to impose civil or criminal liability
Who it binds, in our words: Public bodies and those acting on their behalf; does not apply with the subject's affirmative written consent.
Reproductive and Gender-Affirming Health Care Protection Act: electronically transmitted information. NMSA 1978, § 24-35-6
In force · effective · read October 3, 2026 · source(nmonesource.com, reached from nmlegis.gov)
"Third party" does not mean a covered entity or business associate as defined by the federal Health Insurance Portability and Accountability Act of 1996 and related regulations.
Who it binds, in our words: Third parties that transmit information related to a protected health care activity in electronic format, other than HIPAA covered entities and business associates.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Section 43-1-19 requires client authorization for disclosure of identifying confidential information, with eight listed exceptions. Last amended by Laws 2024, ch. 31.
Mental Health and Developmental Disabilities Code: disclosure of information. NMSA 1978, § 43-1-19
In force · effective · read October 3, 2026 · source(nmonesource.com, reached from nmlegis.gov)
no person shall, without the authorization of the client, disclose or transmit any confidential information from which a person well acquainted with the client might recognize the client as the described person
Who it binds, in our words: Confidential information about clients under the Mental Health and Developmental Disabilities Code, with listed exceptions in Subsection B.
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Section 24-2B-6 limits disclosure of HIV test identity and results to listed persons. Section 24-2B-7 bars redisclosure and 24-2B-9 sets a petty misdemeanor penalty.
Human Immunodeficiency Virus Test Act: confidentiality. NMSA 1978, § 24-2B-6
In force · effective · read October 3, 2026 · source(nmonesource.com, reached from nmlegis.gov)
No person or the person's agents or employees who require or administer the test shall disclose the identity of any person upon whom a test is performed or the result of such a test in a manner that permits identification of the subject of the test
Who it binds, in our words: Persons who require or administer an HIV test, and their agents and employees; listed exceptions follow.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Section 24-21-3 requires informed written consent to collect, retain, transmit or use genetic information, with listed exceptions. Section 24-21-5 requires destruction on request.
Genetic Information Privacy Act: genetic analysis prohibited without informed consent. NMSA 1978, § 24-21-3(B)
In force · effective · read October 3, 2026 · source(nmonesource.com, reached from nmlegis.gov)
genetic analysis of an individual or collection, retention, transmission or use of genetic information without the informed and written consent of the individual or the individual's authorized representative is prohibited
Who it binds, in our words: Any person, except the uses listed in Subsection C.
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Two narrow rights to sue: genetic information and protected health care activity information. The Data Breach Notification Act is enforced by the attorney general only (57-12C-11). No general medical records right to sue found.
Damages a court may award: 24-35-8: compensatory or punitive damages, or $10,000 per violation, whichever is greater, plus attorney fees. 24-21-6: actual damages and up to $5,000 more for willful or grossly negligent violations, plus attorney fees.
Genetic Information Privacy Act: penalties. NMSA 1978, § 24-21-6(B)
In force · effective · read October 3, 2026 · source(nmonesource.com, reached from nmlegis.gov)
An individual whose rights under the provisions of the Genetic Information Privacy Act have been violated may bring a civil action for damages or other relief
Who it binds, in our words: Violations of the Genetic Information Privacy Act.
Reproductive and Gender-Affirming Health Care Protection Act: private right of action. NMSA 1978, § 24-35-8(A)
In force · effective · read October 3, 2026 · source(nmonesource.com, reached from nmlegis.gov)
An individual or entity claiming to be aggrieved by a violation of the Reproductive and Gender-Affirming Health Care Protection Act may file an action in district court for appropriate relief
Who it binds, in our words: Claims against a public body or third party that intentionally, knowingly, willingly or recklessly released information related to a protected health care activity.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Personal identifying information lists five elements. Neither medical nor health insurance information is listed. Text unchanged since Laws 2017, ch. 36. HIPAA-covered persons are exempt from the act entirely.
Deadline to tell people: 45 calendar days after discovery.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
In force · effective · read October 3, 2026 · source(nmonesource.com, reached from nmlegis.gov)
(d) account number, credit card number or debit card number in combination with any required security code, access code or password that would permit access to a person's financial account; or (e) biometric data
Who it binds, in our words: Elements (a) to (e): social security number, driver's license number, government ID number, financial account data, biometric data.
Data Breach Notification Act: notification of security breach. NMSA 1978, § 57-12C-6(A)
In force · effective · read October 3, 2026 · source(nmonesource.com, reached from nmlegis.gov)
shall provide notification to each New Mexico resident whose personal identifying information is reasonably believed to have been subject to a security breach.
Who it binds, in our words: A person that owns or licenses personal identifying information of a New Mexico resident.
Data Breach Notification Act: notification to attorney general. NMSA 1978, § 57-12C-10
In force · effective · read October 3, 2026 · source(nmonesource.com, reached from nmlegis.gov)
shall notify the office of the attorney general and major consumer reporting agencies
Who it binds, in our words: Breaches requiring notice to more than one thousand New Mexico residents.
Data Breach Notification Act: exemptions. NMSA 1978, § 57-12C-8
In force · effective · read October 3, 2026 · source(nmonesource.com, reached from nmlegis.gov)
The provisions of the Data Breach Notification Act shall not apply to a person subject to the federal Gramm-Leach-Bliley Act or the federal Health Insurance Portability and Accountability Act of 1996
Who it binds, in our words: Persons subject to HIPAA or Gramm-Leach-Bliley.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No. A law is in force, but it has none of the three rules.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Only AI text found in chapters 24, 24A, 59A and 61 is a 2025 duty for the nursing board to set AI rules. No such rule found in 16.12.2 NMAC. 2026 HB 141 died. NMSA 59A-22B-5(E) automation review not counted.
You must be told when AI is used in your care: not found.
A licensed clinician decides, not AI alone: not found.
You can reach a human, or have a human review the decision: not found.
Nursing Practice Act: board of nursing powers and duties. NMSA 1978, § 61-3-10(Y)
In force · effective · read October 3, 2026 · source(nmonesource.com, reached from nmlegis.gov)
shall promulgate rules establishing standards for the use of artificial intelligence in nursing
Who it binds, in our words: Board of nursing rulemaking duty; sets no requirement owed to the patient.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
13.4%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
91.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
81.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
11.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$58,722 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
4.3%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
5.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
32.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
13.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
