New Mexico healthcare breach data

Notification deadline

In the most expedient time possible, but not later than 45 calendar days following discovery of the security breach, subject to the delayed-notification provisions of Section 9 (law-enforcement delay + delay reasonably necessary to determine the scope of the breach and restore the integrity, security, and confidentiality of the data system).

State regulator notice

Not required of covered entities

If a person is required to issue notification to more than 1,000 New Mexico residents as a result of a single security breach, the person must notify the New Mexico Office of the Attorney General AND major consumer reporting agencies (as defined in 15 U.S.C. § 1681a(p)) in the most expedient time possible, and no later than 45 calendar days. Notice to the AG must include the number of New Mexico residents that received individual notice and a copy of the individual notice.

That exclusion turns on covered-entity status. A practice that conducts no HIPAA standard transaction — and, where the exclusion names covered entities only, a business associate — is not outside the section, and the requirement below applies to it as written. Stated trigger: More than 1,000 New Mexico residents affected by a single security breach.