What a provider can and can't say in New Mexico
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 61-6-15(D)(5), (38) disciplinary grounds; no review exception |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | 61-6-15(D)(5), (38) disciplinary grounds; no review exception |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 61-6-15(D)(5), (38) disciplinary grounds; no review exception |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 61-6-15(D)(5), (38) disciplinary grounds; no review exception |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 61-6-15(D)(5), (38) disciplinary grounds; no review exception |
- Consumer privacy and health data law: New Mexico has no comprehensive consumer privacy law in force as of October 22, 2026. Status of proposals: 2025-2026 bills failed. Bills are not law. [NM-004]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Regulator notice: attorney general if more than 1,000 residents affected; HIPAA-subject persons excluded. [NM-002]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules.† [NM-001]
- Patient confidentiality duties: Board rules reach intentional or even negligent disclosures (61-6-15(D)(5), (38)).† [NM-001]
- Lawsuits by individuals: No private right of action was located in the statutes reviewed; other claims, such as privacy torts, may still exist. [U-98]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located. [NM-002, U-98]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (16.10.13.8-.9 NMAC (devices = medicine; no MA injections) plus NMMB policy). [NM-005]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists.† [NM-001, U-97]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [NM-001] N.M. Stat. Ann. 61-6-15(D)(5), (9), (38) (https://law.justia.com/codes/new-mexico/chapter-61/article-6/section-61-6-15/)
- [NM-002] N.M. Stat. Ann. 57-12C-2, -6, -8, -10 (https://www.nmlegis.gov/Sessions/17%20Regular/final/HB0015.pdf)
- [NM-004] nmlegis.gov bill records (https://www.nmlegis.gov/Sessions/26%20Regular/bills/senate/SB0053.HTML)
- [NM-005] 16.10.13.8-.9 NMAC (https://www.srca.nm.gov/parts/title16/16.010.0013.html)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| New Mexico (NM) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | NMSA 61-6-15(D)(5), (38) (divulging professional confidence/secret); no general patient-confidentiality statute located | Yes - applies to licensed providers regardless of HIPAA status | None enacted (2025 HB 410/HB 430; 2026 SB 53, HB 214 not enacted) | 57-12C: medical info NOT covered (biometric is); 45 days; risk-of-harm exception; AG if >1,000; Act does not apply to persons subject to HIPAA | 61-6-15(D)(5), (38) disciplinary grounds; no review exception | HIPAA if covered; otherwise licensee confidentiality ground; common-law appropriation (not verified) | None located (verify) | None statutory located; common-law torts (not researched) | NM Medical Board, Board of Dental Health Care, Board of Nursing, AG | Breach: greater of $25,000 or $10/failed notice up to $150,000 (knowing/reckless); license discipline | E4 | Medium (secondary code source) | 2026-10-22 |
| New Mexico (NM) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | NMSA 61-6-15(D)(5), (38) (divulging professional confidence/secret); no general patient-confidentiality statute located | Yes - applies to licensed providers regardless of HIPAA status | None enacted (2025 HB 410/HB 430; 2026 SB 53, HB 214 not enacted) | 57-12C: medical info NOT covered (biometric is); 45 days; risk-of-harm exception; AG if >1,000; Act does not apply to persons subject to HIPAA | 61-6-15(D)(5), (38) disciplinary grounds; no review exception | HIPAA if covered; otherwise licensee confidentiality ground; common-law appropriation (not verified) | None located (verify) | None statutory located; common-law torts (not researched) | NM Medical Board, Board of Dental Health Care, Board of Nursing, AG | Breach: greater of $25,000 or $10/failed notice up to $150,000 (knowing/reckless); license discipline | E4 | Medium (secondary code source) | 2026-10-22 |
| New Mexico (NM) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | NMSA 61-6-15(D)(5), (38) (divulging professional confidence/secret); no general patient-confidentiality statute located | Yes - applies to licensed providers regardless of HIPAA status | None enacted (2025 HB 410/HB 430; 2026 SB 53, HB 214 not enacted) | 57-12C: medical info NOT covered (biometric is); 45 days; risk-of-harm exception; AG if >1,000; Act does not apply to persons subject to HIPAA | 61-6-15(D)(5), (38) disciplinary grounds; no review exception | HIPAA if covered; otherwise licensee confidentiality ground; common-law appropriation (not verified) | None located (verify) | None statutory located; common-law torts (not researched) | NM Medical Board, Board of Dental Health Care, Board of Nursing, AG | Breach: greater of $25,000 or $10/failed notice up to $150,000 (knowing/reckless); license discipline | E4 | Medium (secondary code source) | 2026-10-22 |
| New Mexico (NM) | Medical med spa | Depends; cash-only med spas often not covered | NMSA 61-6-15(D)(5), (38) (divulging professional confidence/secret); no general patient-confidentiality statute located | Yes - applies to licensed providers regardless of HIPAA status | None enacted (2025 HB 410/HB 430; 2026 SB 53, HB 214 not enacted) | 57-12C: medical info NOT covered (biometric is); 45 days; risk-of-harm exception; AG if >1,000; Act does not apply to persons subject to HIPAA | 61-6-15(D)(5), (38) disciplinary grounds; no review exception | HIPAA if covered; otherwise licensee confidentiality ground; common-law appropriation (not verified) | None located (verify) | None statutory located; common-law torts (not researched) | NM Medical Board, Board of Dental Health Care, Board of Nursing, AG | Breach: greater of $25,000 or $10/failed notice up to $150,000 (knowing/reckless); license discipline | E4 | Medium (secondary code source) | 2026-10-22 |
| New Mexico (NM) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | NMSA 61-6-15(D)(5), (38) (divulging professional confidence/secret); no general patient-confidentiality statute located | No | None enacted (2025 HB 410/HB 430; 2026 SB 53, HB 214 not enacted) | 57-12C: medical info NOT covered (biometric is); 45 days; risk-of-harm exception; AG if >1,000; Act does not apply to persons subject to HIPAA | 61-6-15(D)(5), (38) disciplinary grounds; no review exception | HIPAA if covered; otherwise licensee confidentiality ground; common-law appropriation (not verified) | None located (verify) | None statutory located; common-law torts (not researched) | NM Medical Board, Board of Dental Health Care, Board of Nursing, AG | Breach: greater of $25,000 or $10/failed notice up to $150,000 (knowing/reckless); license discipline | E4 | Medium (secondary code source) | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Trujillo v. Puro
New Mexico Court of Appeals · NM · 1984-05-08
- Provider type
- Physician
- Relevant facts
- Facts not read (opinion not reviewed in full)
- Legal issues
- Whether 61-6-15(D)(5) creates a privilege
- Holding, findings, allegations or settlement terms
- Per statutory annotation: D(5) creates no privilege; it describes ethical constraints only
- Consequences recorded
- n/a
- Procedural status
- Final (cert. denied 1984)
- Precedential?
- Yes (intermediate appellate)
- Why it is in this research
- Limits on using the board confidentiality ground as an evidentiary shield; ground still supports discipline
Related pages
Topics
Healthcare industry
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
NM-004. nmlegis.gov bill records
No comprehensive privacy or health-data privacy law enacted: 2025 HB 410 and HB 430 (Health Data Privacy Act) and 2026 SB 53 (postponed indefinitely) and HB 214 were NOT enacted. 2026 SB 40 (license-plate readers) was signed but is not relevant to practices.
Legislative history · Explicit (bill text) / status per secondary trackers · Medium · Do not describe these bills as law. Status from secondary trackers (U-47).
https://www.nmlegis.gov/Sessions/26%20Regular/bills/senate/SB0053.HTML
NM-002. N.M. Stat. Ann. 57-12C-2, -6, -8, -10
Data Breach Notification Act: personal identifying information = SSN, DL, government ID, financial account, biometric data (incl. facial characteristics used to authenticate); medical information NOT covered. Notice within 45 days unless no significant risk of identity theft or fraud; AG and CRAs if more than 1,000 residents; the Act does not apply to a person subject to HIPAA or GLBA.
Statute · Explicit · Medium-High · Verified against enacted 2017 HB 15 (V-042); later amendments to the codified text not checked (NMOneSource blocked). Section 8 reads as an entity-level exemption for HIPAA-subject persons.
https://www.nmlegis.gov/Sessions/17%20Regular/final/HB0015.pdf
NM-001. N.M. Stat. Ann. 61-6-15(D)(5), (9), (38)
Medical Board 'unprofessional or dishonorable conduct' includes 'willfully or negligently divulging a professional confidence' and 'divulging privileged information or a professional secret'; also false or misleading statements about skill or efficacy.
Statute · Explicit · Medium-High · Justia 2025 (secondary); official NMOneSource not fetched (U-47). Annotation: Trujillo v. Puro, 1984-NMCA-050 - D(5) creates no evidentiary privilege.
https://law.justia.com/codes/new-mexico/chapter-61/article-6/section-61-6-15/
NM-005. 16.10.13.8-.9 NMAC
Med spa: Medical Board rule 16.10.13 NMAC states that using medical therapeutic or cosmetic devices is the practice of medicine; medical assistants may use only non-incisive, non-ablative devices, when certified and with the supervising physician immediately available on the premises (16.10.13.8); injecting cosmetic or aesthetic substances is the practice of medicine and may not be delegated to medical assistants (16.10.13.9). A Medical Board medical spa policy (guidance) restates these limits.
Regulation · Explicit · High · Med spa pass, final phase part 2 (2026-10-22). Official SRCA text read 2026-10-22 (V-063).
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All