What applies to a hospital in New Mexico

Applies to: HIPAA covered entities and business associates that use tracking technologies on websites or mobile apps

HHS guidance for HIPAA covered entities: tracking technologies on patient portals and apps may not send PHI to vendors without a business associate agreement or patient authorization.

Applies to: Covered entities under Section 1557 that use patient care decision support tools

OCR guidance on 45 CFR 92.210 for Section 1557 covered entities, such as practices and hospitals; it changes no coverage, payment or licensure decision reaching physicians.

Applies to: Covered entities under Section 1557 of the Affordable Care Act: health programs and activities receiving HHS federal financial assistance, HHS-administered programs and ACA Exchanges

Binds Section 1557 covered entities, such as practices and hospitals receiving HHS funds, on decision support tools; it changes no coverage, payment or licensure decision reaching physicians.

Applies to: HIPAA covered entities and the vendors that handle PHI for them

HHS guidance for HIPAA covered entities: a vendor's AI chatbot handling PHI on a patient portal is a business associate, so the practice or hospital needs a business associate agreement first.

Applies to: HIPAA covered entities and business associates

Proposed rule binding HIPAA covered entities and business associates: asset inventory, network map, ePHI encryption and multifactor authentication, with ePHI in AI training data protected.

Applies to: Anyone who makes an AI chatbot publicly available to consumers

Would bind anyone who makes an AI chatbot publicly available to consumers, which reaches a practice's or hospital's patient-facing chatbot.

Applies to: Physicians, physician assistants and other New Mexico Medical Board licensees who use AI in any clinical capacity

Medical Board policy for licensees who use AI clinically: inform patients and remain responsible for AI-influenced care; it does not address practices or hospitals as entities.

Applies to: Health insurers subject to the Prior Authorization Act, NMSA 1978 Chapter 59A, Article 22B

Binds health insurers only: an auto-adjudicated prior authorization request pended or denied on medical necessity needs a health care professional's final review.

Applies to: Medicare Advantage organizations

Binds Medicare Advantage plans only: medical necessity decisions rest on the enrollee's own circumstances, and a qualified professional reviews adverse decisions before issue.

Applies to: Medicare Advantage organizations and Medicare-Medicaid Plans

Applies to Medicare Advantage organizations and Medicare-Medicaid Plans only: AI alone may not deny an admission, downgrade to observation or end post-acute care, and decisions rest on the patient's own circumstances.

Applies to: Physicians and other practitioners billing the Medicare physician fee schedule

Fee schedule codes G0552 to G0554 let clinicians bill for FDA-cleared digital mental health treatment devices; a payment option, not a duty.

Applies to: Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities and qualified health plan issuers on the federally facilitated Exchanges

Binds MA, Medicaid, CHIP and Exchange payers only: prior authorization deadlines, specific denial reasons and a prior authorization API; no AI rule, listed for prior authorization.

Applies to: Hospitals paid under the Medicare inpatient prospective payment system

Inpatient new technology add-on payments for approved AI tools; a payment change for hospitals, not a duty.

Applies to: Hospital outpatient departments paid under the Medicare outpatient prospective payment system

Proposed outpatient payment for 36 designated software analysis services in hospital outpatient departments; a payment change, not a duty.

Applies to: Physicians and other practitioners paid under the Medicare physician fee schedule

Proposed fee schedule pricing for 10 software analysis codes, paid to whoever bills the fee schedule; a payment change, not a duty.

Applies to: Medicare Advantage organizations; CMS and ONC for a report to Congress

Would bind Medicare Advantage plans only: electronic prior authorization and annual reports on requests approved or denied with AI or other decision technology.

Applies to: HHS (rulemaking); entities that process identifiable health information outside HIPAA's protections for protected health information, including data brokers; HIPAA covered entities for the AI-related minimum necessary rules

Would direct HHS to write rules on how the minimum necessary standard applies to PHI used for AI; covered entities would be bound only through those future rules, so it affects them.