This chapter applies to medical records and protected health information held by health care providers practicing in Maryland, their agents, and their records management service. This chapter does not supersede any federal or State laws or regulations that exceed this chapter's requirements by requiring that a medical record: Be retained for a longer period of time; Be afforded greater security measures; Be afforded more privacy measures; and Be more easily accessible to the patient. This chapter is not intended to address the disposition of abandoned medical records. In this chapter, the following terms have the meanings indicated. Terms Defined. “Divisible” means a medical record that is amenable to separation or division after the expiration of the retention time stated in Regulation .04 of this chapter. Health Care Provider. “Health care provider” means an acupuncturist, audiologist, chiropractor, dietician, dentist, electrologist, massage therapist, mortician, nurse, nutritionist, occupational therapist, optometrist, physical therapist, physician, podiatrist, professional counselor, psychologist, social worker, speech-language pathologist, or a health care facility or entity that is a: Freestanding, ambulatory care facility as defined in Health-General Article, §19-3B-01, Annotated Code of Maryland; Freestanding medical facility as defined in Health-General Article, §19-3A-01, Annotated Code of Maryland; Health maintenance organization as defined in Health-General Article, §19-701, Annotated Code of Maryland; Hospital as defined in Health-General Article, §19-301, Annotated Code of Maryland; Limited service hospital as defined in Health-General Article, §19-301, Annotated Code of Maryland; Related institution as defined in Health-General Article, §19-301, Annotated Code of Maryland; Residential treatment center as defined in Health-General Article, §19-301, Annotated Code of Maryland; and Health care facility as defined in Health-General Article, §10-101, Annotated Code of Maryland. “Health care provider” includes an agent, officer, director, or employee of any entity listed in §B(2)(a) of this regulation. Medical Record. “Medical record” means any oral, written, or other transmission in any form or medium of information that: Is entered in the record of a patient; Identifies or can readily be associated with the identity of a patient; and Relates to the health care of the patient. “Medical record” includes any: Documentation of disclosures of the medical record to any person who is not an employee, agent, or consultant of the health care provider; File or record maintained under Health Occupations Article, §12-403(b)(13), Annotated Code of Maryland, by a pharmacy of a prescription order for drugs, medicines, or devices that identifies or may be readily associated with the identity of a patient; Documentation of an examination of a patient regardless of who requested the examination or is making payment for the examination; File or record received from another health care provider that relates to the health care of a patient received from that health care provider, and identifies or can readily be associated with the identity of the patient; and To the extent not narrowed by §B(3)(a) and (b)(i)—(iv) of this regulation, “protected health information” as defined by 45 CFR §160.103, as amended. “Medical records series” means a set of medical records, as defined in §B(3) of this regulation, that is maintained on paper, microform, magnetic disk, magnetic tape, or other medium. “Patient” has the meaning stated in Health-General Article, §4-301(j), Annotated Code of Maryland. “Person in interest” has the meaning stated in Health-General Article, §4-301(k), Annotated Code of Maryland. “Records management service” means any agent that has been procured by a health care provider to transport, handle, manage, maintain, store, or destroy medical records. “Records retention schedule” means a records management plan that includes: A list and description of the medical records series of an office or unit; The minimum retention period required to keep each medical record series; The eventual disposition instructions; If desired: Maintenance procedures, such as access or copy control, for each medical records series both in office and in storage; Scanning or microfilming instructions; or Disposal methods such as shredding or incineration; and A signature of approval by an individual with authority over all the medical records series listed. “Sanitizing” means overwriting, degaussing, shredding, or burning electronic or other media. In this chapter, the following documents are incorporated by reference: 45 CFR Part 160, as amended; and 45 CFR Part 164, as amended. A health care provider shall develop and maintain a records retention schedule compatible with the requirements of Regulations .04—.07 of this chapter. Except as provided in Regulations .06 and .07 of this chapter, a health care provider shall maintain medical records for all patients in the health care provider's care for a minimum of 5 years after the medical record is made or until the patient is 21 years old, whichever is longer. Medical records are the personal property of the entity providing health care and are maintained for: The patient; The medical or treatment staff; and Other treatment, payment, and health care operations. A health care provider shall retain medical records in: An office with access restricted to authorized staff; A computer or other device with appropriate security such as passwords or data encryption; A commercial records storage site with appropriate environmental and security controls; or Other storage options that ensure protection, security, and access control. Maintenance of medical records may be contracted to a records management service that agrees to comply with and be subject to this chapter. Medical records that have been placed in storage remain the responsibility of the health care provider, including: Providing the patient or person in interest access to their medical records and authorized copies upon request in accordance with Health-General Article, §4-304, Annotated Code of Maryland, and 45 CFR §164.524, as amended; Ensuring the confidentiality of the medical records; Providing security and restricted access to the medical records; and Protecting the medical records from: Damage; Loss; and Deterioration. If a medical record is kept in electronic form, a health care provider shall: Maintain or have access to compatible electronic hardware and software that will enable the health care provider to generate a legible copy of the record in order to comply with patient and governmental access needs; and Prepare and maintain a current back-up copy of electronic medical record files. A health care provider shall maintain a medical record in accordance with the records retention schedule and may dispose of the record when the minimum retention requirements as described in Regulation .04B of this chapter have been met. For purposes of destruction, a medical record is an indivisible entity unless, in the health care provider's professional judgment, the medical record is divisible. A health care provider shall ensure confidentiality of medical records throughout the disposal process: For paper records, by incineration, shredding, pulping, or other comparable process which renders the records permanently unreadable; For electronic or magnetic media, such as computer disks or magnetic tapes, by completely sanitizing the media, and not just by erasure or deletion; For other media, such as film, photos, or compact discs, by destroying the media with no possibility of recovery; and By complying with the HIPAA security provisions at 45 CFR §164.310(d), as amended. At the time a health care provider discontinues medical practice, the health care provider shall immediately secure the medical records until one of the following options are taken: Medical records may be transferred to a health care provider who will be assuming the medical practice; Medical records may be given to the patient; At the patient's direction, the medical record may be transferred to a new health care provider; or Medical records may be destroyed in accordance with §B of this regulation, Regulation .07 of this chapter, or both. On the death, retirement, surrender of license, or discontinuance of the practice or business of a health care provider, the administrator of the estate or a designee, who: Agrees to provide for the maintenance of the medical records of the practice; and States in writing to the appropriate health occupations board within a reasonable time that the medical records will be maintained in compliance with this chapter, shall: Publish a notice in a daily newspaper that is circulated locally for 2 consecutive weeks: Stating that the medical records will be destroyed or transferred; and Designating a location, date, and time when the medical records may be retrieved by the person in interest; or Forward the notice required in §B(2)(a), of this regulation, to the patient in the following manner: In the case of an adult, the notification shall be sent by first-class mail to the last known address of the patient; or In the case of a minor, notification shall be sent by first-class mail to the last known address of the parent or guardian, or if the medical care documented was provided under Health-General Article, §20-102(c) or 20-103(c), Annotated Code of Maryland, notification shall be given to the minor, by certified mail, addressee only. Medical records that have not met the retention requirements of Regulation .04 of this chapter, may be destroyed only if: In the case of an adult, notification is sent by first-class mail to the last known address of the patient which includes: The proposed date of disposal; and A statement that the record, or a synopsis of the record, may be retrieved at a designated location within 30 days of the proposed destruction; or In the case of a minor, notification is sent by first-class mail to the last known address of the parent or guardian, or if the medical care documented was provided under Health-General Article, §20-102(c) or 20-103(c), Annotated Code of Maryland, notification is given to the minor, by certified mail, addressee only, which includes: The proposed date of disposal; and A statement that the record, or a synopsis of the record, may be retrieved at a designated location within 30 days of the proposed destruction. For entities and individuals not regulated by the Office of Health Care Quality or the appropriate health occupations board, the Secretary shall have the authority to investigate any complaint concerning medical records that are covered by this chapter. By letter, the Secretary may delegate this authority to any unit of the Department, including a health occupations board, the Office of Health Care Quality, or the Office of the Inspector General. To ensure compliance and enforce this chapter: The Office of Health Care Quality shall have authority over a health care facility; and A health occupations board shall have authority over an individual who is a health care provider. The Office of Health Care Quality, the appropriate health occupations board, or both, shall investigate any complaint concerning medical records that are or were in the possession of a person or entity covered by this chapter. After giving a person or entity an opportunity for a hearing to be held in accordance with the disciplinary hearing procedures that would be applicable to a health care provider who owned or possessed the medical records at issue, the Office of Health Care Quality, the appropriate health occupations board, or both, may impose any fines stated in Regulation .09B, of this chapter, as appropriate. After giving a person or entity an opportunity for a hearing to be held in accordance with COMAR 10.01.03, the Secretary may impose any fines stated in Regulation .09B of this chapter for entities which are not regulated by the Office of Health Care Quality or an appropriate health occupations board. Damages. As provided in Health-General Article, §4-403(g)(1), Annotated Code of Maryland, a health care provider, record management service, or other person who knowingly violates any provision of Health-General Article, Title 4, Subtitle 4, is liable in court for actual damages. Fines. A health care facility that knowingly violates this chapter is subject to an administrative fine not to exceed $10,000 for all violations cited in a single day. In addition to any other penalties provided, an individual who is a health care provider, an agent, employee, officer, or director of a health care provider, or a records management service, who knowingly violates this chapter, is subject to administrative fines as follows: The first fine or set of fines assessed in a single day may not exceed $1,000; The second fine or second set of fines assessed concurrently for all violations cited in a single day may not exceed $2,500; and The third or subsequent fine assessed, or third or subsequent set of fines assessed concurrently, for all violations cited in a single day may not exceed $5,000. Factors to be Considered in the Assessment of Penalties. When considering whether to impose an administrative penalty and the amount of the penalty, the Secretary, the Office of Health Care Quality, or the appropriate health occupations board shall consider the following factors: The nature and seriousness of the violations; The willfulness of the violation or violations; The history of previous violations; The extent of the actual harm or potential risk of divulging confidential information; The efforts made to correct the violation or violations in a timely manner; and The existence of mitigating factors. Health-General Article, §4-403, Annotated Code of Maryland; Effective date: March 24, 2008 (35:6 Md. R. 697)