In this subtitle the following words have the meanings indicated. “Common ownership” means ownership of a health care entity: By two or more health care providers; By two or more health care providers employed by a mutual employer for a wage, salary, fee, or payment to perform work for the employer; By health care organizations operating as an organized health care arrangement, as defined in 45 C.F.R. § 160.103; By a health care entity or health care entities that possess an ownership or equity interest of 5% or more in another health care entity; or By affiliated providers operating under the same trade name. “Directory information” means information concerning the presence and general health condition of a patient who has been admitted to a health care facility or who is currently receiving emergency health care in a health care facility. “Disclose” or “disclosure” means the transmission or communication of information in a medical record, including an acknowledgment that a medical record on a particular patient or recipient exists. “Emergency” means a situation when, in the professional opinion of the health care provider, a clear and significant risk of death or imminent serious injury or harm to a patient or recipient exists. “General health condition” means the health status of a patient described in terms of “critical”, “poor”, “fair”, “good”, “excellent”, or terms denoting similar conditions. “Health care” means any care, treatment, or procedure by a health care provider: To diagnose, evaluate, rehabilitate, manage, treat, or maintain the physical or mental condition of a patient or recipient; or That affects the structure or any function of the human body. “Health care provider” means: A person who is licensed, certified, or otherwise authorized under the Health Occupations Article or § 13–516 of the Education Article to provide health care in the ordinary course of business or practice of a profession or in an approved education or training program; or A facility where health care is provided to patients or recipients, including a facility as defined in § 10–101(g) of this article, a hospital as defined in § 19–301 of this article, a related institution as defined in § 19–301 of this article, a health maintenance organization as defined in § 19–701(g) of this article, an outpatient clinic, a medical laboratory, a comprehensive crisis response center, a crisis stabilization center, and a crisis treatment center established under § 7.5–207 of this article. “Health care provider” includes the agents, employees, officers, and directors of a facility and the agents and employees of a health care provider. “Health information exchange” means: An individual or entity that determines, controls, or has the discretion to administer any requirement, policy, or agreement that allows, enables, or requires the use of any technology or services for access, exchange, or use of electronic protected health care information: Among more than two unaffiliated individuals or entities that are enabled to exchange electronic protected health information with each other; and That is for a treatment, payment, or health care operations purpose, as those terms are defined in 45 C.F.R. § 164.501, regardless of whether the individuals or entities are subject to the requirements of 45 C.F.R. parts 160 and 164; or A health information technology developer of certified health information technology that develops or offers health information technology, as that term is defined in 42 U.S.C. 300jj(5), and has one or more Health Information Technology Modules certified under a program for the voluntary certification of health information technology that is kept or recognized by the National Coordinator in accordance with 42 U.S.C. 300jj–11(c)(5). “Health information exchange” does not include: An entity composed of health care providers under common ownership if the organizational and technical processes the entity provides or governs are for health care treatment, payment, or health care operations purposes, as those terms are defined in 45 C.F.R. § 164.501; A carrier, as defined in § 15–1301 of the Insurance Article if the organizational and technical processes the carrier provides or governs are for health care treatment, payment, or health care operations purposes, as those terms are defined in 45 C.F.R. § 164.501; An administrator, as defined in § 8–301 of the Insurance Article, if the organizational and technical processes the administrator provides or governs are for health care treatment, payment, or health care operations purposes, as those terms are defined in 45 C.F.R. § 164.501; A health care provider, as defined in subsection (h) of this section, if the organizational and technical processes the health care provider provides or governs are for health care treatment, payment, or health care operations purposes, as those terms are defined in 45 C.F.R. § 164.501; A carrier’s business associate, as defined in 45 C.F.R. § 160.103, if the organizational and technical processes provided or governed by the business associate are transactions, as defined in 45 C.F.R. § 160.103; or A carrier exchanging information as required by 45 C.F.R. § 156.221. “Legally protected health care” means all sensitive health services, medications, and supplies related to: The provision of abortion care; and Reproductive health and other sensitive health services as determined by the Secretary based on the recommendations of the Protected Health Care Commission established under § 4–310 of this subtitle. “Medical record” means any oral, written, or other transmission in any form or medium of information that: Is entered in the record of a patient or recipient; Identifies or can readily be associated with the identity of a patient or recipient; and Relates to the health care of the patient or recipient. “Medical record” includes any: Documentation of disclosures of a medical record to any person who is not an employee, agent, or consultant of the health care provider; File or record maintained under § 12–403(c)(13) of the Health Occupations Article by a pharmacy of a prescription order for drugs, medicines, or devices that identifies or may be readily associated with the identity of a patient; Documentation of an examination of a patient regardless of who: Requested the examination; or Is making payment for the examination; and File or record received from another health care provider that: Relates to the health care of a patient or recipient received from that health care provider; and Identifies or can readily be associated with the identity of the patient or recipient. “Mental health services” means health care rendered to a recipient primarily in connection with the diagnosis, evaluation, treatment, case management, or rehabilitation of any mental disorder. For acute general hospital services, mental health services are considered to be the primarily rendered service only if service is provided pursuant to Title 10, Subtitle 6 of this article or Title 3 of the Criminal Procedure Article. “Patient” means a person who receives health care and on whom a medical record is maintained. “Person in interest” means: An adult on whom a health care provider maintains a medical record; A person authorized to consent to health care for an adult consistent with the authority granted; A duly appointed personal representative of a deceased person; A minor, if the medical record concerns treatment to which the minor has the right to consent and has consented under Title 20, Subtitle 1 of this article; or A parent, guardian, custodian, or a representative of the minor designated by a court, in the discretion of the attending physician who provided the treatment to the minor, as provided in § 20–102 or § 20–104 of this article; If item (4) of this subsection does not apply to a minor: A parent of the minor, except if the parent’s authority to consent to health care for the minor has been specifically limited by a court order or a valid separation agreement entered into by the parents of the minor; or A person authorized to consent to health care for the minor consistent with the authority granted; or An attorney appointed in writing by a person listed in item (1), (2), (3), (4), or (5) of this subsection. “Primary provider of mental health services” means the designated mental health services provider who: Has primary responsibility for the development of the mental health treatment plan for the recipient; and Is actively involved in providing that treatment. “Protected health information” means all individually identifiable health information held or transmitted by a covered entity or its business associate protected under the U.S. Department of Health and Human Services Privacy Rule. “Recipient” means a person who has applied for, for whom an application has been submitted, or who has received mental health services. “Sensitive health services” includes: Reproductive health services other than abortion care; and Gender–affirming care. “State–designated health information exchange” means the health information exchange designated by the Maryland Health Care Commission and the Health Services Cost Review Commission under § 19–143 of this article.

A health care provider shall: Keep the medical record of a patient or recipient confidential; and Disclose the medical record only: As provided by this subtitle; or As otherwise provided by law. The provisions of this subtitle do not apply to information: Not kept in the medical record of a patient or recipient that is related to the administration of a health care facility, including: Risk management; Quality assurance; and Any activities of a medical or dental review committee that are confidential under the provisions of § 1–401 and Title 4, Subtitle 5 of the Health Occupations Article and any activities of a pharmacy review committee; Governed by the federal confidentiality of alcohol and drug abuse patient records regulations, 42 C.F.R. Part 2 and the provisions of § 8–601(c) of this article; or Governed by the developmental disability confidentiality provisions in §§ 7–1008 through 7–1011 of this article. Unless the patient has restricted or prohibited the disclosure of directory information, a health care provider may disclose directory information about a patient to an individual who has asked for the patient by name. A health care provider shall: Inform a patient of the health care information that the health care provider may include in a directory and the persons to whom the health care provider may disclose the information; and As soon as practicable, provide the patient with the opportunity to restrict or prohibit disclosure of directory information. If providing an opportunity under paragraph (2)(ii) of this subsection to restrict or prohibit the disclosure of directory information is not practicable because of the patient’s incapacity or need for emergency care or treatment, a health care provider may disclose the patient’s directory information if the disclosure is: Consistent with a prior expressed preference of the patient that is known to the health care provider; and Determined to be, based on the health care provider’s professional judgment, in the patient’s best interest. A person to whom a medical record is disclosed may not redisclose the medical record to any other person unless: The redisclosure is: Authorized by the person in interest; Otherwise permitted by this subtitle; Permitted under § 1–202(b) or (c) of the Human Services Article; or Directory information; or The person to whom the medical record was disclosed is a guardian ad litem who received the medical record in accordance with § 4–306(b)(12) of this subtitle; A reasonable effort to secure a qualified protective order has been made in accordance with 42 C.F.R. § 164.512(e)(1)(v); and The guardian ad litem determines that it is necessary to redisclose the medical record to carry out the guardian ad litem’s official function to protect the best interests of a minor or a disabled or elderly individual in a criminal or juvenile delinquency court proceeding. Except as provided in paragraph (2) of this subsection, a person may not disclose by sale, rental, or barter any medical record. This subsection shall not prohibit the transfers of medical records relating to the transfer of ownership of a health care practice or facility if the transfer is in accord with the ethical guidelines of the applicable health care profession or professions. The provisions of this subtitle may not be construed to constitute an exception to the reporting requirements of Title 5, Subtitle 7 and Title 14, Subtitle 3 of the Family Law Article.

Payors that accept claims originating in this State from medical care electronic claims clearinghouses shall accept claims only from medical care electronic claims clearinghouses that are: Accredited by the Electronic Healthcare Network Accreditation Commission; or Certified by the Maryland Health Care Commission. The Maryland Health Care Commission shall adopt regulations to carry out this section.

The Maryland Health Care Commission shall adopt regulations for the privacy and security of protected health information obtained or released through a health information exchange. The regulations adopted under subsection (a) of this section shall: Govern the access, use, maintenance, disclosure, and redisclosure of protected health information as required by State or federal law, including the federal Health Insurance Portability and Accountability Act, the federal Health Information Technology for Economic and Clinical Health Act, the federal 21st Century Cures Act, and Title 21, Subtitle 2A of this article; Include protections for the secondary use of protected health information obtained or released through a health information exchange; Require the State–designated health information exchange to develop and maintain a consent management application, subject to State and federal law, that: Allows a person in interest to opt out of having electronic health information shared or disclosed by a health information exchange; Informs the person in interest of the electronic health information that may be shared or disclosed notwithstanding the choice to opt out; Requires that the State–designated health information exchange provide a health information exchange with the opt–out status of a person in interest, on receipt of an electronic request from the health information exchange for the opt–out status of the person in interest; Requires a health information exchange to obtain the opt–out status of a person in interest from the State–designated health information exchange before sharing or disclosing the electronic health information of the person in interest; and Except as provided in paragraph (2) of this subsection, prohibits a health information exchange from sharing or disclosing the electronic health information of a person in interest if the person in interest has opted out of having electronic health information shared or disclosed by a health information exchange; and Provide appropriate penalties for noncompliance with the regulations, including fines that do not exceed $10,000 per day and that are determined based on: The extent of actual or potential public harm caused by the violation; The cost of investigating the violation; and Whether the person committed previous violations. The regulations adopted under subsection (a) of this section may not prohibit: The Department, the Maryland Health Care Commission, or the Health Services Cost Review Commission from using electronic health information, subject to federal and State law, for health regulatory and public health functions; The sharing or disclosing of information that is required to be exchanged under Title 21, Subtitle 2A of this article; or The sharing or disclosing of information that is required to be exchanged under federal law, including for the purposes of payment, as defined in 45 C.F.R. § 164.501. This section does not prohibit the Commission from adopting regulations that are more stringent than federal law in accordance with 45 C.F.R. § 160.203. Data obtained or released through a health information exchange: May not be sold for financial remuneration until the regulations required under subsections (a) and (b) of this section are adopted; and May be sold for financial remuneration only in accordance with the regulations adopted under subsections (a) and (b) of this section. The Maryland Health Care Commission shall consult with health care providers, payors, State health agencies, consumer advocates, and employers before adopting regulations under subsections (a) and (b) of this section.

In this section the following words have the meanings indicated. “Electronic health care transactions” means health care transactions that have been approved by a nationally recognized health care standards development organization to support health care informatics, information exchange, systems integration, and other health care applications. “Electronic health network” means an entity: Involved in the exchange of electronic health care transactions between a payor, health care provider, vendor, and any other entity; and Certified by the Maryland Health Care Commission. “Nursing home” has the meaning stated in § 19–1401 of this article. “Standard request” means a request for clinical information from a health information exchange that conforms to the major standards version specified by the Office of the National Coordinator for Health Information Technology. This section applies to: Except for the State–designated health information exchange, a health information exchange operating in the State; and A payor that: Holds a valid certificate of authority issued by the Maryland Insurance Commissioner; and Acts as, operates, or owns a health information exchange. An entity to which this section applies shall connect to the State–designated health information exchange in a manner consistent with applicable federal and State privacy laws. When a standard request for clinical information is received through the State–designated health information exchange, an entity to which this section applies shall: Respond to the request to the extent authorized under federal and State privacy laws; and Transmit the response to the State–designated health information exchange in the manner specified in the regulations adopted under subsection (g) of this section. A consent from a patient to release clinical information to a provider obtained by an entity to which this section applies shall apply to information transmitted through the State–designated health information exchange or by other means. On request of the Department, a nursing home shall submit electronically clinical information to the State–designated health information exchange to facilitate the objectives stated in paragraph (3) of this subsection. In accordance with State and federal law and to facilitate the objectives stated in paragraph (3) of this subsection, the State–designated health information exchange may provide the information submitted under paragraph (1) of this subsection to: A health care provider; An authorized health information exchange user; A health information exchange authorized by the Maryland Health Care Commission; A federal official; and A State official. If approved by the Maryland Health Care Commission, the information submitted under paragraph (1) of this subsection may be combined with other data maintained by the State–designated health information exchange to facilitate: A State health improvement program; Mitigation of a public health emergency; Improvement of patient safety; and The participation of the State in the Center for Medicare and Medicaid Innovation’s States Advancing All–Payer Health Equity Approaches and Development (AHEAD) Model and any successor models. The information submitted by a nursing home under paragraph (1) of this subsection may be used only to facilitate the objectives stated in subparagraph (i) of this paragraph and may not be used for any other purpose, including licensing and certification. The State–designated health information exchange shall: Participate in the advisory committee established under § 13–4306(a)(1) of this article; and Maintain a data set for the Maryland Commission on Health Equity and provide data from the data set consistent with the parameters defined by the advisory committee. If approved by the Maryland Commission on Health Equity, the State–designated health information exchange may use the data set maintained under paragraph (1) of this subsection to improve health outcomes for patients. An electronic health network shall provide electronic health care transactions to the State–designated health information exchange for the following public health and clinical purposes: A State health improvement program; Mitigation of a public health emergency; Improvement of patient safety; and The participation of the State in the Center for Medicare and Medicaid Innovation’s States Advancing All–Payer Health Equity Approaches and Development (AHEAD) Model and any successor models. An electronic health network may not charge a fee to a health care provider, health care payor, or to the State–designated health information exchange for providing the information as required under paragraph (1) of this subsection. The State–designated health information exchange shall develop and implement policies and procedures to implement paragraph (1) of this subsection that are consistent with regulations adopted by the Maryland Health Care Commission. The Maryland Health Care Commission: Shall adopt regulations for implementing the connectivity to the State–designated health information exchange required under this section; and Shall seek, through any regulations adopted under item (1) of this subsection, to promote technology standards and formats that conform to those specified by the Office of the National Coordinator for Health Information Technology. The Maryland Health Care Commission shall adopt regulations that: Specify the scope of clinical information to be exchanged or sent under this section; and Provide for a uniform, gradual implementation of the exchange of clinical information under this section. Any regulations adopted under paragraph (1) of this subsection shall limit the scope of the clinical information to purposes that: Improve treatment, including improved access to clinical records by treating clinicians; Promote uses of the State–designated health information exchange important to public health; or The protection of the electronic health information of a person in interest who has opted out of having electronic health information shared or disclosed by a health information exchange. Regulations adopted under paragraph (1) of this subsection: Shall limit redisclosure of financial information, including billed or paid amounts available in electronic claims transactions; May not restrict the State’s use of financial information, including billed or paid amounts available in electronic claims transactions, for public health purposes related to the participation of the State in the Center for Medicare and Medicaid Innovation’s States Advancing All–Payer Health Equity Approaches and Development (AHEAD) Model and any successor models; Shall restrict data of patients who have opted out of records sharing through the State–designated health information exchange or a health information exchange authorized by the Maryland Health Care Commission; Shall restrict data from health care providers that possess sensitive health care information; and Shall restrict data of patients who have obtained legally protected health care. This section does not: Require an entity to which this section applies to collect clinical information or obtain any authorizations, not otherwise required by federal or State law, relating to information to be sent or received through the State–designated health information exchange; Prohibit an entity to which this section applies from directly receiving or sending information to providers or subscribers outside of the State–designated health information exchange; or Prohibit an entity to which this section applies from connecting and interoperating with the State–designated health information exchange in a manner and scope beyond that required under this section.

The existence of a health information exchange does not, in itself, create a new cause of action against a health information exchange or a health care provider.

Subject to subsection (d)(3)(ii) of this section, this section applies to disclosures of health information to recipients located in the State and outside the State. Subject to subsection (d)(3)(ii) of this section, beginning December 1, 2023, a health information exchange or electronic health network may not disclose Mifepristone data or the diagnosis, procedure, medication, or related codes for abortion care and other sensitive health services as determined by the Secretary under subsection (d) of this section to a treating provider, a business entity, another health information exchange, or another electronic health network unless the disclosure is: For the adjudication of claims; or To a specific treating provider at the written request of and with the consent of: A patient, for services for which the patient can provide consent under State law; or A parent or guardian of a patient, for services for which the parent or guardian can provide consent under State law. Beginning June 1, 2024, a person who knowingly violates this section is guilty of a misdemeanor and on conviction is subject to a fine not to exceed $10,000 per day. In determining the fine to be imposed under paragraph (1) of this subsection, the following factors shall be considered: The extent of actual or potential public harm caused by the violation; The cost of investigating the violation; and Whether the person previously violated this section. The Secretary shall determine for abortion care and sensitive health services the procedure, diagnosis, medication, and other related codes that are subject to the restrictions on disclosure established under subsection (b) of this section due to a substantial risk to patients or health care providers that would result from disclosure. A determination made under paragraph (1) of this subsection shall: Follow applicable guidelines of the American College of Obstetricians and Gynecologists, the World Health Organization, and the Society of Family Planning; and For sensitive health services, be based on the recommendations of the Protected Health Care Commission established under § 4–310 of this subtitle. The Secretary shall adopt regulations to restrict the disclosure of abortion care and other sensitive health services information by diagnosis, procedure, medication, or related codes under subsection (b) of this section. Except as provided in subparagraph (iii) of this paragraph, the Secretary may adopt restrictions on the disclosure of abortion care or other sensitive health services under subparagraph (i) of this paragraph that are applicable only to disclosures by health information exchanges or electronic health networks to out–of–state treating providers, out–of–state business entities, other health information exchanges, or other electronic health networks. Any regulations adopted by the Secretary to implement restrictions on the disclosure of Mifepristone data under subsection (b) of this section shall apply to disclosures of data to recipients located in the State and outside the State.

In this section the following words have the meanings indicated. “Business associate” has the meaning stated in 45 C.F.R. § 160.103. “Electronic health care transactions” has the meaning stated in § 4–302.3 of this subtitle. “Electronic health network” has the meaning stated in § 4–302.3 of this subtitle. “Nursing home” has the meaning stated in § 19–1401 of this article. If a nursing home contracts with or uses an electronic health network or electronic medical record vendor, the nursing home may direct the electronic health network or electronic medical record vendor to release patient medical records or electronic health care transactions held by the electronic health network or electronic medical record vendor to a business associate of the nursing home. An electronic health network or electronic medical record vendor releasing patient medical records or electronic health care transactions under paragraph (1) of this subsection: Shall release the patient medical records or electronic health care transactions in an electronic format that conforms to the specifications of the Office of the National Coordinator for Health Information Technology or another form required by the State–designated health information exchange; Shall make the patient medical records or electronic health care transactions available on a regular basis and release the information in a timely manner to support patient care and monitoring; and May not restrict, limit, or charge a fee for the release of the patient medical records or electronic health care transactions.

A health care provider shall disclose a medical record on the authorization of a person in interest in accordance with this section. Except as otherwise provided in subsections (c) and (d) of this section, an authorization shall: Be in writing, dated, and signed by the person in interest; State the name of the health care provider; Identify to whom the information is to be disclosed; State the period of time that the authorization is valid, which may not exceed 1 year, except: In cases of criminal justice referrals, in which case the authorization shall be valid until 30 days following final disposition; or In cases where the patient on whom the medical record is kept is a resident of a nursing home, in which case the authorization shall be valid until revoked, or for any time period specified in the authorization; and Apply only to a medical record developed by the health care provider unless in writing: The authorization specifies disclosure of a medical record that the health care provider has received from another provider; and The other provider has not prohibited redisclosure. A health care provider shall disclose a medical record on receipt of a preauthorized form that is part of an application for insurance. A health care provider shall disclose a medical record on receipt of an authorization for the release of relevant medical information that is included with the claim application form filed with the Workers’ Compensation Commission in accordance with § 9–709(a), § 9–710(b), or § 9–711(a) of the Labor and Employment Article. Except in cases of criminal justice referrals, a person in interest may revoke an authorization in writing. A revocation of an authorization becomes effective on the date of receipt by the health care provider. A disclosure made before the effective date of a revocation is not affected by the revocation. A copy of the following shall be entered in the medical record of a patient or recipient: A written authorization; Any action taken in response to an authorization; and Any revocation of an authorization.

Except as otherwise provided in this subtitle, a health care provider shall comply within a reasonable time after a person in interest requests in writing: To receive a copy of a medical record; or To see and copy the medical record. If a medical record relates to a psychiatric or psychological problem and the attending health care provider, with any available and feasible input from a primary provider of mental health services, believes disclosure of any portion of the medical record to be injurious to the health of a patient or recipient, the health care provider may refuse to disclose that portion of the medical record to the patient, recipient, or person in interest but, on written request, shall: Make a summary of the undisclosed portion of the medical record available to the patient, recipient, or person in interest; Insert a copy of the summary in the medical record of the patient or recipient; Permit examination and copying of the medical record by another health care provider who is authorized to treat the patient or recipient for the same condition as the health care provider denying the request; and Inform the patient or recipient of the patient’s or recipient’s right to select another health care provider under this subsection. A health care provider shall establish procedures for a person in interest to request an addition to or correction of a medical record. A person in interest may not have any information deleted from a medical record. Within a reasonable time after a person in interest requests a change in a medical record, the health care provider shall: Make the requested change; or Provide written notice of a refusal to make the change to the person in interest. A notice of refusal shall contain: Each reason for the refusal; and The procedures, if any, that the health care provider has established for review of the refusal. If the final determination of the health care provider is a refusal to change the medical record, the provider: Shall permit a person in interest to insert in the medical record a concise statement of the reason that the person in interest disagrees with the record; and May insert in the medical record a statement of the reasons for the refusal. A health care provider shall give a notice of a change in a medical record or a copy of a statement of disagreement: To any individual the person in interest has designated to receive the notice or statement; and To whom the health care provider has disclosed an inaccurate, an incomplete, or a disputed medical record within the previous 6 months. If a health care provider discloses a medical record after an addition, correction, or statement of disagreement has been made, the provider shall include with the medical record a copy of each addition, correction, or statement of disagreement. In this subsection, “medical record” includes a copy of a medical bill that has been requested by an individual. The provisions of this subsection do not apply to x–rays. A health care provider may require a person in interest or any other authorized person who requests a copy of a medical record to pay for the cost of copying: For State facilities regulated by the Maryland Department of Health, as provided in § 4–206 of the General Provisions Article; or For all other health care providers, a reasonable cost–based fee for providing the information requested. Except as provided in subparagraph (iii) of this paragraph, for a copy of a medical record requested by a person in interest or any other authorized person under paragraph (2)(ii) of this subsection, a health care provider may charge a fee for copying and mailing not exceeding 76 cents for each page of the medical record. In addition to the fee charged under subparagraph (i) of this paragraph, a hospital or a health care provider may charge: Subject to the fee limitations that apply to persons in interest under 45 C.F.R. 164.524 and any guidance on those limitations issued by the U.S. Department of Health and Human Services, a preparation fee not to exceed $22.88 for medical record retrieval and preparation; and The actual cost for postage and handling of the medical record. Subject to the fee limitations that apply to persons in interest under 45 C.F.R. 164.524 and any guidance on those limitations issued by the U.S. Department of Health and Human Services, a hospital or a health care provider that uses or maintains the requested medical records in an electronic format may charge for an electronic copy of a medical record in an electronic format requested by a person in interest or any other authorized person: A preparation fee not to exceed $22.88 for electronic format medical records retrieval and preparation; A per–page fee of 75% of the per–page fee charged by a health care provider under subparagraph (i) of this paragraph that may not exceed $80; and The actual cost for postage and handling of the electronic format medical records. Except as provided in subparagraph (ii) of this paragraph, the fees charged under paragraph (3) of this subsection may be adjusted annually for inflation in accordance with the Consumer Price Index. The preparation fee charged for medical record retrieval and preparation under paragraph (3)(ii)1 of this subsection and for retrieval and preparation of a medical record in an electronic format under paragraph (3)(iii)1 of this subsection may not be adjusted annually for inflation in accordance with the Consumer Price Index. A health care provider or a representative of the health care provider may not charge a fee for providing copies of a medical record: Requested by: The patient; The patient’s personal representative; An employee or other representative of a nonprofit legal services entity or other volunteer or nonprofit program representing the patient; or An attorney representing the patient; and That will be used for the purpose of filing a claim regarding or appealing a denial of Social Security disability income or Social Security benefits under Title II or Title XVI of the Social Security Act. Except as provided in subparagraph (ii) of this paragraph, a health care provider may charge a fee, as authorized under paragraphs (3) and (4) of this subsection, for the retrieval, copying, preparation, mailing, and actual cost of postage and handling of a medical record disclosed under § 4–306 of this subtitle. If a government unit or agency or court–appointed guardian ad litem in a criminal or juvenile delinquency court proceeding makes a request for the disclosure of a medical record under § 4–306 of this subtitle, a health care provider may not charge the government unit or agency or court–appointed guardian ad litem a fee for the retrieval, copying, preparation, mailing, and actual cost of postage and handling of the medical record. Notwithstanding any other provision of law, a health care provider may not charge a person in interest, except for an attorney appointed in writing by a person in interest, who requests a copy of a medical record of an individual enrolled in the Maryland Medical Assistance Program a fee that exceeds $20, adjusted annually for inflation in accordance with the Consumer Price Index, for each 100 pages or portion of 100 pages copied. Notwithstanding any other provision of law, any person or entity who is not subject to the provisions of this subsection and who obtains a medical record from a health care provider or the provider’s agent may not charge a fee for any subsequent copies of that medical record that exceeds the fee authorized under paragraph (3)(i) of this subsection. Except for an emergency request from a unit of State or local government concerning a child protective services case or adult protective services case, a health care provider may withhold copying until the fee for copying is paid.

This section may not be construed to impose an obligation on a health care provider to disclose a medical record. A health care provider may disclose a medical record without the authorization of a person in interest: To the provider’s authorized employees, agents, medical staff, medical students, or consultants for the sole purpose of offering, providing, evaluating, or seeking payment for health care to patients or recipients by the provider; To the provider’s legal counsel regarding only the information in the medical record that relates to the subject matter of the representation; or To any provider’s insurer or legal counsel, or the authorized employees or agents of a provider’s insurer or legal counsel, for the sole purpose of handling a potential or actual claim against any provider if the medical record is maintained on the claimant and relates to the subject matter of the claim; If the person given access to the medical record signs an acknowledgment of the duty under this Act not to redisclose any patient identifying information, to a person for: Educational or research purposes, subject to the applicable requirements of an institutional review board; Evaluation and management of health care delivery systems; or Accreditation of a facility by professional standard setting entities; Subject to the additional limitations for a medical record developed primarily in connection with the provision of mental health services in § 4–307 of this subtitle, to a government agency performing its lawful duties as authorized by an act of the Maryland General Assembly or the United States Congress; Subject to the additional limitations for a medical record developed primarily in connection with the provision of mental health services in § 4–307 of this subtitle, to another health care provider for the sole purpose of treating the patient or recipient on whom the medical record is kept; If a claim has been or may be filed by, or with the authorization of a patient or recipient on behalf of the patient or recipient, for covered insureds, covered beneficiaries, or enrolled recipients only, to third party payors and their agents, if the payors or agents have met the applicable provisions of §§ 15–10B–01 to 15–10B–18 of the Insurance Article, including nonprofit health service plans, health maintenance organizations, fiscal intermediaries and carriers, the Department and its agents, the United States Department of Health and Human Services and its agents, or any other person obligated by contract or law to pay for the health care rendered for the sole purposes of: Submitting a bill to the third party payor; Reasonable prospective, concurrent, or retrospective utilization review or predetermination of benefit coverage; Review, audit, and investigation of a specific claim for payment of benefits; or Coordinating benefit payments in accordance with the provisions of the Insurance Article under more than one sickness and accident, dental, or hospital and medical insurance policy; If a health care provider makes a professional determination that an immediate disclosure is necessary, to provide for the emergency health care needs of a patient or recipient; To immediate family members of the patient or any other individual with whom the patient is known to have a close personal relationship, provided that: The disclosure is limited to information that is directly relevant to the individual’s involvement in the patient’s health care; and If the patient is present or otherwise available before the disclosure and has the capacity to make health care decisions: The patient has been provided with an opportunity to object to the disclosure and the patient has not objected; or The health care provider reasonably infers from the circumstances that, based on the health care provider’s professional judgment, the patient does not object to the disclosure; or If the patient is not present or otherwise available before the disclosure is made, or providing the patient with an opportunity to object to the disclosure is not practicable because of the patient’s incapacity or need for emergency care or treatment, the health care provider determines, based on the health care provider’s professional judgment, that the disclosure is in the best interests of the patient; To an appropriate organ, tissue, or eye recovery agency under the restrictions of § 5–408 of this article for a patient whose organs and tissues may be donated for the purpose of evaluating the patient for possible organ and tissue donation; To the Department or an organ, tissue, or eye recovery agency designated by the Department for the purpose of conducting death record reviews under § 19–310 of this article; Subject to subsection (c) of this section, if the purpose of the medical record disclosure is for the coordination of services and record retention within the Montgomery County Department of Health and Human Services; or To a carrier, as defined in § 15–1301 of the Insurance Article, or an accountable care organization, as defined in § 3022 of the Patient Protection and Affordable Care Act, for the sole purposes of enhancing or coordinating patient care, provided that: A disclosure under this item is subject to the additional limitations in § 4–307 of this subtitle on disclosure of a medical record developed primarily in connection with the provision of mental health services; A medical record may be disclosed only in accordance with the federal Health Insurance Portability and Accountability Act of 1996, any regulations adopted under the Act, and any other applicable federal privacy laws, and disclosures under this item may not be made in violation of the prohibited uses or disclosures under the federal Health Insurance Portability and Accountability Act of 1996; A disclosure under this item may not be used for underwriting or utilization review purposes; A health care provider that discloses a medical record in accordance with this item shall provide a notice consistent with the requirements of 45 C.F.R. § 164.520 specifying the information to be shared, with whom it will be shared, and the specific types of uses and disclosures that the health care provider may make in accordance with this item; The notice required by item (iv) of this item shall include an opportunity for the individual to opt out of the sharing of the individual’s medical record with a carrier or an accountable care organization for the purposes identified in this item; If a health care provider discloses medical information or medical data to a carrier or accountable care organization through an infrastructure that provides organizational and technical capabilities for the exchange of protected health information among entities not under common ownership, the health care providers are subject to the requirements of §§ 4–302.2 and 4–302.3 of this subtitle; and If the disclosure is of abortion care or other sensitive health services information as determined by the Secretary under § 4–302.5(d) of this subtitle, the disclosure is subject to the requirements under § 4–302.5 of this subtitle. The disclosure of medical records under subsection (b)(10) of this section to a person that is not employed by or under contract with the Montgomery County Department of Health and Human Services shall be conducted in accordance with this subtitle. Under provisions of State law regarding confidentiality, the Montgomery County Department of Health and Human Services shall be considered to be one agency.

In this section, “compulsory process” includes a subpoena, summons, warrant, or court order that appears on its face to have been issued on lawful authority. A health care provider shall disclose a medical record without the authorization of a person in interest: To a unit of State or local government, or to a member of a multidisciplinary team assisting the unit, for purposes of investigation or treatment in a case of suspected abuse or neglect of a child or an adult, subject to the following conditions: The health care provider shall disclose only the medical record of a person who is being assessed in an investigation or to whom services are being provided in accordance with Title 5, Subtitle 7 or Title 14, Subtitle 3 of the Family Law Article; The health care provider shall disclose only the information in the medical record that will, in the professional judgment of the provider, contribute to the: Assessment of risk; Development of a service plan; Implementation of a safety plan; or Investigation of the suspected case of abuse or neglect; and The medical record may be redisclosed as provided in §§ 1–201, 1–202, 1–204, and 1–205 of the Human Services Article; Subject to the additional limitations for a medical record developed primarily in connection with the provision of mental health services in § 4–307 of this subtitle, to health professional licensing and disciplinary boards, in accordance with a subpoena for medical records for the sole purpose of an investigation regarding: Licensure, certification, or discipline of a health professional; or The improper practice of a health profession; To a health care provider or the provider’s insurer or legal counsel, all information in a medical record relating to a patient or recipient’s health, health care, or treatment which forms the basis for the issues of a claim in a civil action initiated by the patient, recipient, or person in interest; Notwithstanding any privilege in law, as needed, to a medical review committee as defined in § 1–401 of the Health Occupations Article or a dental review committee as defined in § 4–501 of the Health Occupations Article; To another health care provider as provided in § 10–807 or § 19–308.2 of this article; Subject to the additional limitations for a medical record developed primarily in connection with the provision of mental health services in § 4–307 of this subtitle and except as otherwise provided in items (2), (7), and (8) of this subsection, in accordance with compulsory process, if the health care provider receives: A written assurance from the party or the attorney representing the party seeking the medical records that: In a Child in Need of Assistance proceeding pursuant to Title 3, Subtitle 8 of the Courts and Judicial Proceedings Article, a person in interest has not objected to the disclosure of the designated medical records and 15 days have elapsed since the notice was sent; In all other proceedings, a person in interest has not objected to the disclosure of the designated medical records within 30 days after the notice was sent; or The objections of a person in interest have been resolved and the request for disclosure is in accordance with the resolution; Proof that service of the subpoena, summons, warrant, or court order has been waived by the court for good cause; or A copy of an order entered by a court expressly authorizing disclosure of the designated medical records; For disclosures made under item (i)1A of this item, copies of the following items that were mailed by certified mail to the person in interest by the person requesting the disclosure at least 15 days before the records are to be disclosed: The subpoena, summons, warrant, or court order seeking the disclosure or production of the records; This section; and A notice in the following form or a substantially similar form: __________________                 In the Plaintiffs                          ______________________________ v.    For ______________________________ _____________________________________ Defendants Case No.:_____________________ NOTICE TO (Patient Name) IN COMPLIANCE WITH § 4–306 OF THE HEALTH – GENERAL ARTICLE, ANNOTATED CODE OF MARYLAND TAKE NOTE that medical records regarding (Patient Name), have been subpoenaed from the (Name and address of Health Care Provider) pursuant to the attached subpoena and § 4–306 of the Health – General Article, Annotated Code of Maryland. This subpoena _____ does _____ does not (mark one) seek production of mental health records. Please examine these papers carefully. IF YOU HAVE ANY OBJECTION TO THE PRODUCTION OF THESE DOCUMENTS, YOU MUST FILE A MOTION FOR A PROTECTIVE ORDER OR A MOTION TO QUASH THE SUBPOENA ISSUED FOR THESE DOCUMENTS UNDER MARYLAND RULES 2–403 AND 2–510 NO LATER THAN FIFTEEN (15) DAYS FROM THE DATE THIS NOTICE IS MAILED. For example, a protective order may be granted if the records are not relevant to the issues in this case, the request unduly invades your privacy, or causes you specific harm. Also attached to this form is a copy of the subpoena duces tecum issued for these records. If you believe you need further legal advice about this matter, you should consult your attorney. ______________________________ Attorney (Firm Name Attorney address Attorney phone number) Attorneys for (Name of Party Represented) Certificate of Service I hereby certify that a copy of the foregoing notice was mailed, first–class postage prepaid, this ___ day of _________, 20__ to ___________________________________ Patient ___________________________________ Each Counsel in Case ___________________________________ Attorney For disclosures made under item (i)1B of this item, copies of the following items that were mailed by certified mail and by mail sent first–class postage prepaid to the person in interest and, if applicable, by mail sent first–class postage prepaid to the court and parties in a criminal or juvenile delinquency case by the person requesting the disclosure at least 30 days before the records are to be disclosed: The subpoena, summons, warrant, or court order seeking the disclosure or production of the records; This section; and A notice in the following form or a substantially similar form: ___________________________________     In the Plaintiffs                          ______________________________ v.    For ______________________________ ___________________________________ Defendants Case No.:_____________________ NOTICE TO (Patient Name) IN COMPLIANCE WITH § 4–306 OF THE HEALTH – GENERAL ARTICLE, ANNOTATED CODE OF MARYLAND TAKE NOTE that medical records regarding (Patient Name), have been subpoenaed from the (Name and address of Health Care Provider) pursuant to the attached subpoena and § 4–306 of the Health – General Article, Annotated Code of Maryland. This subpoena ____ does ____ does not (mark one) seek production of mental health records. Please examine these papers carefully. IF YOU HAVE ANY OBJECTION TO THE PRODUCTION OF THESE DOCUMENTS, YOU MUST FILE A MOTION FOR A PROTECTIVE ORDER OR A MOTION TO QUASH THE SUBPOENA ISSUED FOR THESE DOCUMENTS UNDER MARYLAND RULES 2–403, 2–510, OR 4–266 NO LATER THAN THIRTY (30) DAYS FROM THE DATE THIS NOTICE IS MAILED. For example, a protective order may be granted if the records are not relevant to the issues in this case, the request unduly invades your privacy, or causes you specific harm. Also attached to this form is a copy of the subpoena duces tecum issued for these records. If you believe you need further legal advice about this matter, you should consult your attorney. ______________________________ Attorney (Firm Name Attorney address Attorney phone number) Attorneys for (Name of Party Represented) Certificate of Service I hereby certify that a copy of the foregoing notice was mailed, first–class    postage prepaid, this ___ day of _________, 20__ to ___________________________________ Patient ___________________________________ Each Counsel in Case ___________________________________ Attorney Subject to the additional limitations for a medical record developed primarily in connection with the provision of mental health services in § 4–307 of this subtitle, and the limitations on patient overdose information under § 13–3602(e) of this article, to grand juries, prosecution agencies, law enforcement agencies or their agents or employees to further an investigation or prosecution, pursuant to a subpoena, warrant, or court order for the sole purposes of investigating and prosecuting criminal activity, provided that the prosecution agencies and law enforcement agencies have written procedures to protect the confidentiality of the records; To the Maryland Insurance Administration when conducting an investigation or examination pursuant to Title 2, Subtitle 2 of the Insurance Article, provided that the Insurance Administration has written procedures to maintain the confidentiality of the records; To a State or local child fatality review team established under Title 5, Subtitle 7 of this article as necessary to carry out its official functions; To a local domestic violence fatality review team established under Title 4, Subtitle 7 of the Family Law Article as necessary to carry out its official functions; To a local drug overdose fatality review team established under Title 5, Subtitle 9 of this article as necessary to carry out its official functions, subject to: The additional limitations under § 4–307 of this subtitle for disclosure of a medical record developed primarily in connection with the provision of mental health services; and Any additional limitations for disclosure or redisclosure of a medical record developed in connection with the provision of substance abuse treatment services under State law or 42 U.S.C. § 290dd–2 and 42 C.F.R. Part 2; or To a guardian ad litem appointed by a court to protect the best interests of a minor or a disabled or elderly individual who is a victim of a crime or a delinquent act, for the sole purpose and use of the guardian ad litem in carrying out the guardian ad litem’s official function to protect the best interests of the minor or the disabled or elderly individual in a criminal or juvenile delinquency court proceeding as permitted under 42 C.F.R. § 164.512(e). Subject to paragraphs (2) through (4) of this subsection, a health care provider shall disclose medical and legal records without the authorization of an individual to a public defender who states in writing that the Office of the Public Defender represents the individual in: An involuntary admission proceeding under Title 10, Subtitle 6 of this article; A release proceeding under Title 10, Subtitle 8 of this article; or A commitment or release proceeding under Title 3 of the Criminal Procedure Article. Legal records required to be disclosed under paragraph (1) of this subsection include: An emergency petition; An application for involuntary admission; and A certification for involuntary admission. The records disclosed under paragraph (1) of this subsection shall be limited to those records needed by the public defender to represent the individual in the proceedings listed in paragraph (1) of this subsection. Records provided under paragraph (1)(i) of this subsection shall be provided: Within 24 hours after the health care provider receives a written request for the records from the public defender; and Only if the individual has not yet retained private counsel. When a disclosure is sought under this section: A written request for disclosure or written confirmation by the health care provider of an oral request that justifies the need for disclosure shall be inserted in the medical record of the patient or recipient; and Documentation of the disclosure shall be inserted in the medical record of the patient or recipient. Subject to paragraph (2) of this subsection, a health care provider shall disclose a medical record in accordance with compulsory process not later than 30 days after receiving: The documentation required under subsection (b)(6) of this section; and Any fees owed to the health care provider by the party or the attorney representing the party seeking the medical record for the retrieval, copying, preparation, mailing, and actual cost of postage and handling of the medical record under § 4–304(c) of this subtitle. On a showing of good cause, a health care provider may request up to 30 additional days beyond the date by which disclosure is required under paragraph (1) of this subsection to disclose a medical record.

In this section the following words have the meanings indicated. “Case management” means an individualized recipient centered service designed to assist a recipient in obtaining effective mental health services through the assessing, planning, coordinating, and monitoring of services on behalf of the recipient. “Core service agency” has the meaning stated in § 7.5–101 of this article. “Director” means the Director of the Behavioral Health Administration or the designee of the Director. “Mental health director” means the health care professional who performs the functions of a clinical director or the designee of that person in a health care, detention, or correctional facility. “Personal note” means information that is: The work product and personal property of a mental health provider; and Except as provided in subsection (d)(3) of this section, not discoverable or admissible as evidence in any criminal, civil, or administrative action. Except as provided in subsection (d)(2) of this section, a medical record does not include a personal note of a mental health care provider, if the mental health care provider: Keeps the personal note in the mental health care provider’s sole possession for the provider’s own personal use; Maintains the personal note separate from the recipient’s medical records; and Does not disclose the personal note to any other person except: The mental health provider’s supervising health care provider that maintains the confidentiality of the personal note; A consulting health care provider that maintains the confidentiality of the personal note; or An attorney of the health care provider that maintains the confidentiality of the personal note. “Personal note” does not include information concerning the patient’s diagnosis, treatment plan, symptoms, prognosis, or progress notes. The disclosure of a medical record developed in connection with the provision of mental health services shall be governed by the provisions of this section in addition to the other provisions of this subtitle. When a medical record developed in connection with the provision of mental health services is disclosed without the authorization of a person in interest, only the information in the record relevant to the purpose for which disclosure is sought may be released. To the extent a mental health care provider determines it necessary and appropriate, the mental health care provider may maintain a personal note regarding a recipient. A personal note shall be considered part of a recipient’s medical records if, at any time, a mental health care provider discloses a personal note to a person other than: The provider’s supervising health care provider; A consulting health care provider; An attorney of the health care provider; or A recipient under paragraph (3) of this subsection. The provisions of this subsection do not prohibit the disclosure, discovery, or admissibility of a personal note regarding a recipient who has initiated an action for malpractice, an intentional tort, or professional negligence against the health care provider. Except as otherwise provided in paragraphs (3), (4), and (5) of this subsection, if the disclosure of a portion of a medical record relating to a psychological test would compromise the objectivity or fairness of the test or the testing process, a mental health care provider may not disclose that portion of the medical record to any person, including a subject of the test. The raw test data relating to a psychological test is only discoverable or admissible as evidence in a criminal, civil, or administrative action on the determination by the court or administrative hearing officer that the expert witness for the party seeking the raw test data is qualified by the appropriate training, education, or experience to interpret the results of that portion of the raw test data relating to the psychological test. A recipient who has been the subject of a psychological test may designate a psychologist licensed under Title 18 of the Health Occupations Article or a psychiatrist licensed under Title 14 of the Health Occupations Article to whom a health care provider may disclose the medical record. The recipient shall: Request the disclosure authorized under this paragraph in writing; and Comply with the provisions of § 4–304 of this subtitle. A health care provider may disclose a medical record relating to a psychological test as provided under § 4–305(b)(2)(i) of this subtitle. The provisions of this subsection may not restrict access to or affect the disclosure of a medical record which is also an education record under the federal Individuals with Disabilities Education Act, the federal Family Educational Rights and Privacy Act, or any federal and State regulations that have been adopted to implement those laws. Notwithstanding any other provision of this subtitle, a person in interest shall have the right to obtain a medical record of a recipient that is developed in conjunction with a mental health evaluation relating to obtaining or continuing employment, if the evaluation has been performed at the request of or on behalf of an employer or prospective employer: In connection with a civil action or U.S. Equal Employment Opportunity Commission complaint initiated by the person in interest; or On a written authorization of the employer or prospective employer. A health care provider may disclose a medical record that relates to and identifies more than one recipient in group or family therapy only: On the authorization of a person in interest for each recipient; As provided in this subtitle; or As otherwise provided by law. This section may not be construed to prevent the disclosure of a medical record that relates to the provision of mental health services between or among the health care providers that participate in the approved plan of a core service agency or local behavioral health authority for the delivery of mental health services, if a recipient: Has received a current list of the participating providers; and Has signed a written agreement with the core service agency or local behavioral health authority to participate in the client information system developed by the agency. If an individual given access to a medical record that relates to the provision of mental health services signs an acknowledgment of the duty under this Act not to redisclose personal identifying information about a recipient, this section may not be construed to prevent the disclosure of the medical record for rate review, auditing, health planning, licensure, approval, or accreditation of a facility by governmental or professional standard setting entities. A health care provider may disclose a medical record without the authorization of a person in interest: To the medical or mental health director of a juvenile or adult detention or correctional facility if: The recipient has been involuntarily committed under State law or a court order to the detention or correctional facility requesting the medical record; and After a review of the medical record, the health care provider who is the custodian of the record is satisfied that disclosure is necessary for the proper care and treatment of the recipient; As provided in § 5–609 of the Courts Article; If a health care provider is a facility as defined in § 10–101 of this article, to a law enforcement agency concerning a recipient who: Has been admitted involuntarily or by court order to the facility; and Is on an unauthorized absence or has otherwise left the facility without being discharged or released; The facility director may disclose to the law enforcement agency identifying information and only such further information that the director believes is necessary to aid the law enforcement agency in locating and apprehending the recipient for the purpose of: Safely returning the recipient to custody; or Fulfilling the provisions of subparagraph (ii) of this paragraph; If a health care provider is a facility as defined in § 10–101 of this article, the facility director may confirm or deny the presence in the facility of a recipient to a parent, guardian, next of kin, or any individual who has a significant interest in the status of the recipient if that individual has filed a missing persons report regarding the recipient; and To allow for the service of process or a court order in a facility when appropriate arrangements have been made with the facility director so as to minimize loss of confidentiality. When a disclosure is made under this subsection, documentation of the disclosure shall be inserted in the medical record of the recipient. A health care provider shall disclose a medical record without the authorization of a person in interest: To the medical or mental health director of a juvenile or adult detention or correctional facility or to another inpatient provider of mental health services in connection with the transfer of a recipient from an inpatient provider, if: The health care provider with the records has determined that disclosure is necessary for the continuing provision of mental health services; and The recipient is transferred: As an involuntary commitment or by court order to the provider; Under State law to a juvenile or adult detention or correctional facility; or To a provider that is required by law or regulation to admit the recipient; To the State designated protection and advocacy system for mentally ill individuals under the federal Protection and Advocacy for Mentally Ill Individuals Act of 1986, as amended, if: The State designated protection and advocacy system has received a complaint regarding the recipient or the director of the system has certified in writing to the chief administrative officer of the health care provider that there is probable cause to believe that the recipient has been subject to abuse or neglect; The recipient by reason of mental or physical condition is unable to authorize disclosure; and The recipient does not have a legal guardian or other legal representative who has the authority to consent to the release of health care information; or The legal guardian of the recipient is a representative of a State agency; To another health care provider or legal counsel to the other health care provider prior to and in connection with or for use in a commitment proceeding in accordance with Title 10, Subtitle 6 or Title 12 of this article; In accordance with a court order, other than compulsory process compelling disclosure, as permitted under § 9–109(d), § 9–109.1(d), or § 9–121(d) of the Courts Article, or as otherwise provided by law, to: A court; An administrative law judge; A health claims arbitrator; or A party to a court, administrative, or arbitration proceeding; In accordance with a subpoena for medical records on specific recipients: To health professional licensing and disciplinary boards for the sole purpose of an investigation regarding licensure, certification, or discipline of a health professional or the improper practice of a health profession; and To grand juries, prosecution agencies, and law enforcement agencies under the supervision of prosecution agencies for the sole purposes of investigation and prosecution of a provider for theft and fraud, related offenses, obstruction of justice, perjury, unlawful distribution of controlled substances, and of any criminal assault, neglect, patient abuse or sexual offense committed by the provider against a recipient, provided that the prosecution or law enforcement agency shall: Have written procedures which shall be developed in consultation with the Director to maintain the medical records in a secure manner so as to protect the confidentiality of the records; and In a criminal proceeding against a provider, to the maximum extent possible, remove and protect recipient identifying information from the medical records used in the proceeding; or In the event of the death of a recipient, to the office of the medical examiner as authorized under § 5–309 or § 10–713 of this article. If a recipient believes that a medical record has been inappropriately obtained, maintained, or disclosed under paragraph (1)(vi) of this subsection, the recipient may petition the State prosecutor for an investigation of the allegation. Except in a proceeding relating to payment for the health care of a recipient, the medical record of a recipient and any information obtained as a result of disclosure under paragraph (1)(vi) of this subsection is disclosable, notwithstanding any privilege in law, but may not be used in any proceeding against the recipient. A written request for disclosure or written confirmation of an oral request in an emergency that justifies the need for disclosure shall be inserted in the medical record of the recipient. Documentation of the disclosure shall be inserted in the medical record of the recipient. This subsection may not preclude a health care provider, a recipient, or person in interest from asserting in a motion to quash or a motion for a protective order any constitutional right or other legal authority in opposition to disclosure. Subject to paragraphs (2) through (4) of this subsection, a health care provider shall disclose medical and legal records without the authorization of an individual to a public defender who states in writing that the Office of the Public Defender represents the individual in: An involuntary admission proceeding under Title 10, Subtitle 6 of this article; A release proceeding under Title 10, Subtitle 8 of this article; or A commitment or release proceeding under Title 3 of the Criminal Procedure Article. Legal records required to be disclosed under paragraph (1) of this subsection include: An emergency petition; An application for involuntary admission; and A certification for involuntary admission. The records disclosed under paragraph (1) of this subsection shall be limited to those records needed by the public defender to represent the individual in the proceedings listed in paragraph (1) of this subsection. Records provided under paragraph (1)(i) of this subsection shall be provided: Within 24 hours after the health care provider receives a written request for the records from the public defender; and Only if the individual has not yet retained private counsel.

A health care provider, who in good faith discloses or does not disclose a medical record, is not liable in any cause of action arising from the disclosure or nondisclosure of the medical record.

If a health care provider knowingly refuses to disclose a medical record within a reasonable time but no more than 21 working days after the date a person in interest requests the disclosure, the health care provider is liable for actual damages. A health care provider may not refuse to disclose a medical record on the request of a person in interest because of the failure of the person in interest to pay for health care rendered by the health care provider. A health care provider or any other person is in violation of this subtitle if the health care provider or any other person: Requests or obtains a medical record under false pretenses or through deception; or Discloses a medical record in violation of this subtitle. Except as otherwise provided in subsection (e) of this section, a health care provider or any other person, including an officer or employee of a governmental unit, who knowingly and willfully violates any provision of this subtitle is guilty of a misdemeanor and on conviction is subject to a fine not exceeding $1,000 for the first offense and not exceeding $5,000 for each subsequent conviction for a violation of any provision of this subtitle. A health care provider or any other person, including an officer or employee of a governmental unit, who knowingly and willfully requests or obtains a medical record under false pretenses or through deception or knowingly and willfully discloses a medical record in violation of this subtitle is guilty of a misdemeanor and on conviction is subject to the following penalties: A fine not exceeding $50,000, imprisonment for not more than 1 year, or both; If the offense is committed under false pretenses, a fine not exceeding $100,000, imprisonment for not more than 5 years, or both; and If the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, a fine not exceeding $250,000, imprisonment for not more than 10 years, or both. This subsection does not apply to an officer or employee of a governmental unit that is conducting a criminal investigation. A health care provider or any other person who knowingly violates any provision of this subtitle is liable for actual damages.

There is a Protected Health Care Commission. The purpose of the Commission is to make recommendations to the Secretary regarding sensitive health services that should be determined by the Secretary to be legally protected health care under this subtitle. The Commission consists of the following members: The Attorney General or the Attorney General’s designee; The Executive Director of the Maryland Health Care Commission or the Executive Director’s designee; and The following members appointed by the Secretary: A resident of the State who is a licensed physician and nominated by the American College of Obstetricians and Gynecologists; A resident of the State who is a licensed clinician who provides reproductive health care and nominated by the Reproductive Health Access Project; A resident of the State who is a certified nurse–midwife nominated by the Maryland affiliate of the American College of Nurse Midwives; A resident of the State who is a representative of Physicians for Reproductive Health; Two residents of the State who are consumer representatives with expertise in consumer data privacy; and A resident of the State with expertise in health information. The Commission shall: Select a chair of the Commission each year; and Meet at least four times a year. The Department shall provide staff for the Commission. The Commission shall identify sensitive health services information by diagnosis, procedural, medication, or related codes for which disclosure by a health information exchange or electronic health network to a treating provider, business entity, another health information exchange, or another electronic health network would create a substantial risk to patients or health care providers. In carrying out its work, the Commission may consult with: Organizations with expertise in legal issues impacting providers of legally protected health care; Organizations with expertise in consumer health privacy; Organizations with expertise in health information technology; and Other organizations with clinical, policy, or legal expertise related to the work of the Commission. The Commission shall issue semiannual reports to the Secretary on recommendations regarding sensitive health services that should be determined by the Secretary to be legally protected health care under this subtitle or for which the Secretary should rescind a previous determination. The reports shall include an assessment of the potential risk to patients and health care providers that would result from the disclosure of the sensitive health services that are addressed in the reports. Within 60 days after receiving a semiannual report under paragraph (1) of this subsection, the Secretary shall submit a written response to the report that includes the findings and determinations of the Secretary to: The Commission; and In accordance with § 2–1257 of the State Government Article, the Senate Finance Committee and the House Health and Government Operations Committee.