# COMAR Title 10 — Maryland Department of Health ## Subtitle 25 — Maryland Health Care Commission ### Chapter 01 — Small Employer Health Benefit Plan Premium Subsidy Program **Authority:** Insurance Article, §§15-12A-01 — 15-12A-05, Annotated Code of Maryland **Administrative History:** Effective date: **Administrative History:** Regulations .01 — .24 adopted as an emergency provision effective June 12, 2008 (35:14 Md. R. 1243); adopted permanently effective August 25, 2008 (35:17 Md. R. 1486) **Administrative History:** Regulation .02B amended as an emergency provision effective July 16, 2009 (36:17 Md. R. 1310); amended permanently effective October 19, 2009 (36:21 Md. R. 1591) **Administrative History:** Regulation .06D adopted as an emergency provision effective July 16, 2009 (36:17 Md. R. 1310); amended permanently effective October 19, 2009 (36:21 Md. R. 1591) **Administrative History:** Regulation .10B amended as an emergency provision effective July 16, 2009 (36:17 Md. R. 1310); amended permanently effective October 19, 2009 (36:21 Md. R. 1591) **Administrative History:** Regulation .10C adopted as an emergency provision effective July 16, 2009 (36:17 Md. R. 1310); adopted permanently effective October 19, 2009 (36:21 Md. R. 1591) **Administrative History:** Regulation .17A amended as an emergency provision effective July 16, 2009 (36:17 Md. R. 1310); amended permanently effective October 19, 2009 (36:21 Md. R. 1591) #### Regulation .01 Scope. *COMAR 10.25.01.01* A. This chapter only applies to the Small Employer Health Benefit Plan Premium Subsidy Program as authorized by Insurance Article, §§15-12A-01 — 15-12A-05, Annotated Code of Maryland. B. Premium subsidies authorized under this chapter shall only be provided for health benefit plans that also comply with the provisions of COMAR 31.11.06. #### Regulation .02 Definitions. *COMAR 10.25.01.02* A. In this chapter, the following terms have the meanings indicated. B. Terms Defined. (1) “Affiliated companies” means companies that are eligible to file a consolidated federal income tax return. (2) “Average wage of business” means the average of the annual wage of all eligible employees; for each eligible owner, the wage used to calculate the average for the business shall be the lesser of: (a) The eligible owner's countable wage; or (b) The eligible owner's adjusted gross income. (3) “Carrier” has the meaning stated in Insurance Article, §15-1201(c), Annotated Code of Maryland. (4) “COMAR” means the Code of Maryland Regulations. (5) “Commission” means the Maryland Health Care Commission. (6) “Commission registry” means a web-based utility by which employers and employees are enrolled in the Premium Subsidy Program. (7) “Commission's official website” means http://mhcc.maryland.gov/. (8) “Designated financial institution” means one or more financial institutions with whom the participating carrier has made arrangements for administration of HSAs in conjunction with the participating carrier's HSA compatible health benefit plan. (9) “Eligible employee” means an individual who: (a) Works on a full-time basis and has a normal workweek of at least 30 hours; and (b) Is either: (i) An employee; (ii) A partner of a partnership; (iii) An eligible owner; or (iv) An independent contractor who is included as an employee under a health benefit plan. (10) Eligible Owner. (a) “Eligible owner” means: (i) A person with a 20 percent or greater financial interest in a small employer who works at least 30 hours per week for that small employer; or (ii) An Executive Director of a nonprofit corporation that has been determined by the Internal Revenue Service to be exempt from taxation under §501(c)(3), (4), or (6) of the Internal Revenue Code who works at least 30 hours per week for that small employer. (b) “Eligible owner” includes an eligible owner's spouse who works at least 30 hours per week for the small employer. (11) “Eligible owner's adjusted gross income” means an amount equal to the adjusted gross income reported on the eligible owner's individual federal tax return or 50 percent of the adjusted gross income reported on the eligible owner's joint federal tax return for the most recent year. (12) “Eligible owner's countable wage” means an amount published by the Commission used to calculate the average wage of a small employer. (13) “Employee premium” means the amount of the premium that is paid by the employee for that employee's selected type of coverage. (14) “Employee premium subsidy” means, for a given employee's selected type of coverage, the amount of the premium subsidy that shall be passed through to the enrolled employee by the employer in the form of reduced payroll deductions for the health benefit plan. (15) “Employee's eligible HSA contribution” means the lesser of: (a) An amount published by the Commission; or (b) An employee's contribution to an HSA, made through regular payroll deductions deposited by the employer on behalf of the employee in the employee's HSA established at the carrier's designated financial institution. (16) Employee Wage. (a) “Employee wage” means, for a given eligible employee, the employee's estimated annual earnings at the time of initial or renewal application for the Premium Subsidy Program, including any salary, wages, commissions, bonuses, profit sharing, and reportable tips. (b) “Employee wage” includes, for purposes of this program, income received from an employee's ownership interest in the business. (17) “Employer's eligible HSA contribution” means an annual contribution to an employee's HSA: (a) Established at the carrier's designated financial institution; (b) Made by an employer according to a commitment made at enrollment or renewal; (c) Equal for all employees choosing a given HSA-compatible health benefit plan; and (d) Contributed either in a single payment at the beginning of the policy year or in equal installments throughout the policy year. (18) “Enrolled employee” means an eligible employee approved by the Commission to receive the premium subsidy. (19) “Enrolled employer” means a small employer approved by the Commission to receive the premium subsidy. (20) “Family” has the meaning stated in COMAR 31.11.06.02B(19). (21) Family Adjusted Gross Income. (a) “Family adjusted gross income” means, for an unmarried employee and for a married employee filing jointly, the adjusted gross income reported on the employee's most recent federal tax return. (b) “Family adjusted gross income”, for a married employee filing separately, means the sum of the adjusted gross income reported on the employee's most recent federal tax return and the adjusted gross income reported on the most recent federal tax return of the employee's spouse. (22) “Health benefit plan” has the meaning stated in Insurance Article, §15-1201(f), Annotated Code of Maryland. (23) “Health insurance” has the meaning stated in Insurance Article, §1-101(p), Annotated Code of Maryland. (24) “Health savings account (HSA)” means a health savings account as defined in the Medicare Prescription Drug, Improvement and Modernization Act of 2003, Title 12, §1201(a), as codified at Part VII, Subchapter B, Chapter 1, §223(d) of the Internal Revenue Code. (25) “Individual coverage” means a health benefit plan that insures an individual employee only. (26) “Initial application” means a subsidy applicant's first application to receive the premium subsidy. (27) “Licensed insurance producer” has the meaning stated in Insurance Article, §1-101(w), Annotated Code of Maryland. (28) “Maximum average wage for new applications” means an amount published by the Commission that represents the maximum average annual wage at which an employer not currently participating in the Premium Subsidy Program is eligible to apply for participation. (29) “Maximum average wage for participants” means an amount published by the Commission that represents the maximum average annual wage, calculated at time of renewal, at which an enrolled employer may continue to participate in the Premium Subsidy Program. (30) “Maximum eligible firm size” means a number published by the Commission that represents the largest number of eligible employees a small business may have at the time of policy renewal and still be eligible for participation in the Premium Subsidy Program. (31) “Maximum income for other than individual coverage” means an amount published by the Commission that represents the maximum family adjusted gross income at which an eligible employee may receive a premium subsidy for other than individual coverage. (32) “Maximum subsidy table” means a table published by the Commission that describes, for each type of coverage and average wage of business, the maximum premium subsidy that may be provided for each employee electing that type of coverage. (32-1) “Minimum countable wage” means an amount published by the Commission that represents the minimum annual wage for an eligible employee that can be used to calculate the average wage of a small employer. (33) “Other than individual coverage” means the following types of coverage: (a) Individual plus children; (b) Individual plus spouse; or (c) Individual plus children and spouse. (34) “Participating carrier” means a carrier who: (a) Participates in the Maryland small group market as defined under COMAR 31.11.06; (b) Agrees to offer a qualifying health plan; and (c) Enters into a written participation agreement with the Commission. (35) “Policy” has the meaning stated in Insurance Article, §1-101(ee), Annotated Code of Maryland. (36) “Policy year” means a 365-day period that begins on the policy's effective date or a period of 1 full calendar-year, under a health benefit plan providing coverage to employers and their employees, as defined in the policy. (37) “Premium” has the meaning stated in Insurance Article, §1-101(ff), Annotated Code of Maryland, applied to a given employee's selected type of coverage. (38) “Premium subsidy” means the amount paid to the participating carrier by the State in order to reduce the premium paid by the enrolled employer for a given eligible employee's selected type of coverage. (39) “Premium Subsidy Program” means the Small Employer Health Benefit Plan Premium Subsidy Program, as defined in Insurance Article, §15-12A-02, Annotated Code of Maryland. (40) “Prominent carrier” means a carrier that insures at least 10 percent of the total lives insured in the small group market. (41) “Qualifying health plan” means a Comprehensive Standard Health Benefit Plan, as defined under COMAR 31.11.06, together with riders, that includes a wellness benefit defined in Insurance Article, §15-1201(s), Annotated Code of Maryland. (42) “Quarterly wage reports” means the reporting of wages on quarterly employment reports as described in COMAR 09.32.01.14. (43) “Renewal application” means an application designated by the Commission for applying for renewal of the premium subsidy. (44) “Section 125 Payroll Deduction Plan” means a payroll deduction plan pursuant to §125 of the Internal Revenue Code. (45) “Size factor” means a factor published by the Commission, based on the number of eligible employees of a small employer at the time of policy renewal, and used to calculate the premium subsidy. (46) “Small employer” has the meaning stated in Insurance Article, §15-1201, Annotated Code of Maryland. (47) “Subsidy administrator” means one or more entities: (a) Designated by the participating carrier to administer enrollment, registration, billing, accounting, or reconciliation on behalf of the participating carrier; and (b) That is either a component of the carrier organization, or a separate entity under contract with the participating carrier that is bonded and subject to audit by the participating carrier and the Commission. (48) “Subsidy applicant” means either an employer or employee applying to receive the premium subsidy. (49) “Subsidy application” means an application designated by the Commission to be completed, signed, and submitted in order for the Commission to determine eligibility for the Premium Subsidy Program. (50) “Subsidy program cap” means a dollar amount published by the Commission that represents the Commission's estimate of the total annualized subsidy payment that is sustainable. (51) “Total premium” means the sum of all premiums for coverage under the employer's health benefit plan. (52) “Total premium subsidy” means the sum of all premium subsidies for coverage under the employer's health benefit plan. (53) “Type of coverage” means the choice of coverage for each eligible employee's health benefit plan, specifically: (a) Individual only; (b) Individual plus children; (c) Individual plus spouse; or (d) Individual plus children and spouse. (54) “Wellness benefit” has the meaning stated in Insurance Article, §15-201, Annotated Code of Maryland. (55) “Written participation agreement” means a contract between a participating carrier and the Commission that defines: (a) The terms and conditions of the participating carrier's involvement in the Premium Subsidy Program; and (b) The roles and responsibilities of the subsidy administrator in administering the Premium Subsidy Program. #### Regulation .03 Purpose. *COMAR 10.25.01.03* The Premium Subsidy Program is designed to: A. Provide an incentive for small employers to offer and maintain a small employer health benefit plan for their employees; B. Help low and moderate wage employees of small employers afford health benefit plan premiums; C. Promote access to health care services, particularly preventive health care services that might reduce the need for emergency room care and other acute care services; and D. Reduce uncompensated care in hospitals and other health care settings. #### Regulation .04 Employer Eligibility. *COMAR 10.25.01.04* A. A small employer is eligible to receive a premium subsidy if, at the time of initial application for the premium subsidy, the employer: (1) Meets the requirements under Insurance Article, §15-1203(b)(i), Annotated Code of Maryland; (2) Has been in operation for at least 12 months and, if required to file quarterly wage reports, has filed quarterly wage reports with the Maryland Department of Labor for, at a minimum, the three calendar quarters immediately preceding initial application for the premium subsidy; (3) Has not offered a health benefit plan to its employees for at least 12 consecutive months immediately before initial application for the premium subsidy; (4) Employed at least two but not more than nine eligible employees: (a) At the time the employer's subsidy application is entered into the Commission registry; and (b) On at least 50 percent of its working days during the preceding calendar quarter; (5) Has an average wage of business that does not exceed the maximum average wage for new applications; (6) Agrees to offer a health benefit plan to its eligible employees that contains a wellness benefit; (7) Commits to establish a Section 125 payroll deduction plan within 60 days of enrollment in the Premium Subsidy Program; (8) Completes and signs the subsidy application; and (9) Complies with the other regulations of this chapter. B. Affiliated companies are considered one employer for purposes of this chapter. C. An enrolled employer is eligible to continue receiving a premium subsidy if, at the time of the renewal application, the employer: (1) Has filed quarterly wage reports with the Maryland Department of Labor for, at a minimum, the three calendar quarters immediately preceding the renewal application for the premium subsidy; (2) Has at least two eligible employees and the number of eligible employees is not more than the maximum eligible firm size; (3) Has an average wage of business that does not exceed the maximum average wage for participants; (4) Continues to offer a health benefit plan to its eligible employees that contains a wellness benefit; (5) Has an established Section 125 payroll deduction plan in place for at least 10 months; (6) Completes and signs the subsidy application; and (7) Complies with the other regulations of this chapter. D. An enrolled employer whose coverage is terminated before the end of the policy year for any cause, including nonpayment of premium, is required to reapply and to meet all of the requirements for an initial application. E. If the carrier terminates the coverage but then reinstates the employer's coverage with the same premium and policy expiration date, the employer shall be reinstated in the Premium Subsidy Program without reapplication. F. Retroactive payments made by a small employer who is terminated and then reinstated by a carrier during a policy year are eligible for a premium subsidy. #### Regulation .05 Employee Eligibility. *COMAR 10.25.01.05* A. An eligible employee of a small employer is eligible to receive the premium subsidy if, at the time of initial application and at the time of each renewal application: (1) The small employer meets the requirements of Regulation .04 of this chapter; (2) The eligible employee enrolls in a health benefit plan offered by the small employer; (3) The eligible employee completes and signs the subsidy application; and (4) The eligible employee complies with the regulations of this chapter. B. An eligible employee applying for a premium subsidy for other than individual coverage shall satisfy the conditions described in Regulation .06 of this chapter. C. At the time of initial application for the premium subsidy and at the time of each renewal application, each employee subsidy applicant shall complete, sign, and submit to a licensed insurance producer a form designated by the Commission which includes the following information: (1) The type of coverage selected by the employee subsidy applicant; (2) Information requested by the Commission about any insurance coverage carried by the employee subsidy applicant or the applicant's family members during the 3 months immediately before the employee subsidy applicant's initial application for the premium subsidy; (3) Acknowledgement that the employee subsidy applicant's share of the premium will be deducted through a Section 125 payroll deduction plan; (4) If other than individual coverage is sought, an affidavit regarding the family's adjusted gross income and an agreement to provide documentation of the family's adjusted gross income to the Commission on request; and (5) Other information considered appropriate by the Commission. D. Unless allowed under Regulation .08 of this chapter, the following individuals are ineligible to receive a premium subsidy: (1) A former employee eligible for Continuation of Coverage under COMAR 31.11.04; (2) Divorced spouses eligible for Continuation of Coverage under COMAR 31.11.02; and (3) Surviving spouses eligible for Continuation of Coverage under COMAR 31.11.03. #### Regulation .06 Employee Selection of Other Than Individual Coverage. *COMAR 10.25.01.06* A. An eligible employee may apply for a premium subsidy for other than individual coverage if the eligible employee's family adjusted gross income does not exceed the maximum income for other than individual coverage. B. An eligible employee applying for a premium subsidy for other than individual coverage shall comply with requirements considered necessary by the Commission to verify the reported family adjusted gross income. C. An eligible employee with a family adjusted gross income greater than the maximum income for other than individual coverage is eligible for the premium subsidy for individual coverage if the eligible employee satisfies the conditions of Regulation .05 of this chapter. D. If a carrier offers coverage for domestic partners and the employer selects that coverage, a domestic partner is a spouse for the purposes of this chapter. #### Regulation .07 Initial Application and Enrollment. *COMAR 10.25.01.07* A. Initial application for the Premium Subsidy Program shall be made according to the procedures designated by the Commission and published on the Commission's official website. B. The small employer shall complete an initial application published on the Commission's official website that includes the following: (1) Information necessary to establish the eligibility of the small employer and the amount of the available subsidy; (2) An agreement by the small employer that the employer will establish a Section 125 payroll deduction plan within 60 days of enrollment; (3) An acknowledgement that: (a) The Commission may employ an auditor to examine an enrolled employer's records to determine the accuracy of statements made on the application; (b) Incorrect statements may be cause for exclusion from the Premium Subsidy Program; and (c) Fraudulent applications may be referred for prosecution; (4) An agreement to cooperate fully with the Commission and the Commission's auditor; and (5) An affidavit signed by the small employer that the information in the initial application is correct and that the small employer meets the eligibility criteria for receipt of a premium subsidy. C. The initial application shall include an affirmation signed by the licensed insurance producer that: (1) The health benefit plan or plans selected by the small employer include a wellness benefit; (2) The licensed insurance producer has examined the small employer's most recent Quarterly Wage Report, and the information in the initial application is consistent with that report; and (3) To the best of the licensed insurance producer's knowledge, the information in the initial application is correct. D. The initial application for each employee shall include the following: (1) Information about any private or public health insurance program that provided coverage at any time during the preceding 3 months for the employee or any of the employee's dependents who will be insured under the health benefit plan; and (2) For other than individual coverage: (a) An affidavit that the employee's family adjusted gross income is less than or equal to the maximum income for other than individual coverage; and (b) An agreement to provide copies of relevant tax return forms, if requested by the Commission. E. The participating carrier's procedures and written participation agreement determines whether the licensed insurance producer, the subsidy administrator, or the participating carrier shall enter the information from the initial application in the Commission registry to register the small employer to receive a premium subsidy. F. The Commission registry will generate: (1) A registration number; (2) The total premium subsidy that the participating carrier shall provide to the small employer in the form of a reduced total premium; (3) The amount of premium subsidy for each employee that the small employer shall pass through in the form of reduced payroll deductions for health benefits; and (4) Other information that the Commission may consider useful for administration of the Premium Subsidy Program. #### Regulation .08 Application and Enrollment of Additional Employees During the Policy Year. *COMAR 10.25.01.08* A. A newly hired eligible employee of an enrolled employer, an employee who becomes an eligible employee during the policy year, or an eligible employee who qualifies for a special enrollment period under 29 U.S.C. §1181(f) is eligible to be enrolled in the Premium Subsidy Program during the policy year under the terms established at the beginning of the policy year, unless either: (1) The participating carrier recalculates premiums charged to the enrolled employer; or (2) The Premium Subsidy Program is closed to registration of additional employees of enrolled employers under Regulation .19 of this chapter. B. The additional employee shall complete and sign the employee subsidy application required under Regulation .07 of this chapter. C. The participating carrier's procedures and the written participation agreement determines whether the licensed insurance producer, the subsidy administrator, or the participating carrier shall enter the information from the additional employee's subsidy application in the Commission registry to register the additional employee to receive the premium subsidy. D. If the participating carrier recalculates the premium rates charged to the enrolled employer, the employer shall complete the renewal application required under Regulation .09 of this chapter, including information about all current eligible employees. In this case, the total premium subsidy shall be recalculated for the small employer and eligible employees. #### Regulation .09 Renewal Application. *COMAR 10.25.01.09* A. The enrolled employer shall complete a renewal application published on the Commission's official website. The renewal application shall include: (1) Information necessary to establish the eligibility of the employer and the amount of the available premium subsidy; (2) An acknowledgement that the Commission may request that certain records be produced and made available; (3) An affidavit signed by the enrolled employer that the information in the renewal application is correct and that the enrolled employer meets the eligibility criteria for receipt of a premium subsidy; and (4) An affidavit signed by the enrolled employer that the enrolled employer has had a Section 125 payroll deduction plan in place over the 10-month period immediately preceding the planned date of premium subsidy renewal. B. The renewal application shall include an affirmation signed by the licensed insurance producer that: (1) The health benefit plan or plans selected by the enrolled employer include a wellness benefit; (2) The licensed insurance producer has examined the enrolled employer's most recent Quarterly Wage Report, and the information in the renewal application is consistent with that report; and (3) To the best of the licensed insurance producer's knowledge, the information in the renewal application is correct. C. The renewal application shall include a signed form from each employee applying for the Premium Subsidy Program who was either not insured under the employer's health benefit plan during the previous policy year or who is changing coverage from individual coverage to other than individual coverage. The form shall include: (1) Information about any private or public health insurance program that provided coverage at any time during the preceding 3 months for the employee or any of the employee's dependents who will be covered under the enrolled employer's health benefit plan; and (2) If the type of coverage is for other than individual coverage: (a) An affidavit that the employee's family adjusted gross income is less than the maximum income for other than individual coverage; and (b) An agreement to provide copies of relevant tax return forms, if requested by the Commission. D. The Commission's registry will generate: (1) A registration number; (2) The total premium subsidy that the participating carrier shall provide to the small employer in the form of reduced total premium; (3) Total premium subsidy for each enrolled employee that the small employer shall pass through in the form of reduced payroll deductions for health benefits; and (4) Other information that the Commission may consider useful for administration of the Premium Subsidy Program. E. The participating carrier's procedures and written participation agreement determines whether the licensed insurance producer, the subsidy administrator, or the participating carrier shall enter the information from the renewal application in the Commission registry to register the enrolled employer to receive a premium subsidy. #### Regulation .10 Calculation of the Average Wage of Business. *COMAR 10.25.01.10* A. The average wage of business is the average of the wage for each of the eligible employees of the business. B. For employees who are eligible owners, the wage used in calculating the average wage of business shall be the greater of the following: (1) The lesser of: (a) The eligible owner's countable wage; or (b) The eligible owner's adjusted gross income; or (2) The minimum countable wage. C. For all other eligible employees, the wage used in calculating the average wage of business is the greater of: (1) The employee wage; or (2) The minimum countable wage. #### Regulation .11 Calculation of the Premium Subsidy. *COMAR 10.25.01.11* A. At the time of initial application for the Premium Subsidy Program, the premium subsidy is the lower of: (1) The amount from the maximum subsidy table applicable for the average wage of business and the type of coverage chosen by the employee; or (2) 50 percent of the sum of: (a) The premium for the type of coverage chosen by the eligible employee; (b) The employer's eligible HSA contribution, if any; and (c) The employee's eligible HSA contribution, if any. B. At the time of renewal application for the Premium Subsidy Program, the premium subsidy is the lower of: (1) The amount from the maximum subsidy table applicable for the average wage of business and the type of coverage chosen by the employee, multiplied by the size factor for the number of eligible employers; or (2) 50 percent of the sum of: (a) The premium for the type of coverage chosen by the eligible employee; (b) The employer's eligible HSA contribution, if any; and (c) The employee's eligible HSA contribution, if any. C. For each health benefit plan offered by an enrolled employer, the premium subsidy remains constant throughout the policy year unless the premium changes during the policy year. #### Regulation .12 Change in Employer's Federal Employer Identification Number. *COMAR 10.25.01.12* If the federal employer identification number of the employer changes, because the company changes its form of ownership or for any other reason, the company may petition the Commission for continued eligibility for the Premium Subsidy Program under the new federal employer identification number. The Executive Director shall rule on the petition within 14 days of the receipt of all information necessary to make the determination of continued eligibility. #### Regulation .13 Change of Participating Carrier by the Enrolled Employer. *COMAR 10.25.01.13* A. If the enrolled employer elects to change coverage from one participating carrier to a different participating carrier at the time of policy renewal and premium subsidy renewal, the enrolled employer shall identify the new carrier in the renewal application. B. If the enrolled employer elects to change coverage from one participating carrier to a different participating carrier at any time other than the time of policy renewal and premium subsidy renewal, the enrolled employer shall notify the Commission at least 30 days in advance of the change and shall complete the renewal application specified under Regulation .09 of the chapter for the new health benefit plan. #### Regulation .14 Payment of the Premium Subsidy. *COMAR 10.25.01.14* A. Payment of the total premium subsidy is subject to the following: (1) The total premium subsidy for each enrolled employer shall be paid to the subsidy administrator and shall reduce the total premium owed by the enrolled employer; (2) The enrolled employer shall pass the employee premium subsidy to the enrolled employee in the form of reduced payroll deductions for the health benefit plan; (3) The employee premium subsidy is calculated as the premium subsidy for that employee's coverage multiplied by the ratio of the sum of the employee premium plus the employee's eligible HSA contribution, if any, to the sum of the premium, the employer's eligible HSA contribution, if any, and the employee's eligible HSA contribution, if any; (4) Each month, the subsidy administrator or participating carrier shall invoice the enrolled employer for the total premium due for the subsequent month, minus the subsidy amount for enrolled employees registered in the Commission registry; (5) At the time the enrolled employer is invoiced for the premium by the subsidy administrator or participating carrier, the subsidy administrator or participating carrier shall submit an invoice to the Commission, in a format set forth in the written participation agreement between the Commission and the participating carrier, that lists, for each enrolled employer, the invoiced premium and the premium subsidy due for each enrolled employee; (6) The Commission shall promptly forward the invoice to the Comptroller for payment of the premium subsidy to the subsidy administrator or participating carrier; (7) The subsidy payment is accounted for separately from other funds and is not considered to be earned by the participating carrier until the participating carrier has received the corresponding premium payment from the enrolled employer; and (8) Each month, the subsidy administrator or participating carrier shall provide to the Commission, in a format set forth in the written participation agreement between the Commission and the participating carrier, the following: (a) A list of all premium payments received from enrolled employers during the previous month, including the coverage period for which each premium payment was made; and (b) A list of the enrolled employees covered by each premium payment. B. Each premium subsidy paid in advance to a participating carrier that does not correspond to an enrolled employer's premium payment shall be deducted from a subsequent premium subsidy paid to the participating carrier, and a reconciliation statement shall be provided by the Commission to the participating carrier. #### Regulation .15 Carrier Requirements. *COMAR 10.25.01.15* A. To participate in the Premium Subsidy Program, a carrier shall meet the definition of a participating carrier under Regulation .02B(34) of this chapter. B. The written participation agreement shall include: (1) The carrier's designation of its subsidy administrator or administrators; (2) The Commission's requirement for monthly data submissions regarding premium subsidy recipients covered by the participating carrier; and (3) The participating carrier's agreement to cooperate with any audits of the Premium Subsidy Program. C. A participating carrier may not condition the sale of a wellness benefit to a small employer based on participation of the eligible employees of that small employer in wellness programs or activities. D. A prominent carrier shall offer at least one health benefit plan to a small employer who meets the requirements described in Regulation .04 of this chapter and shall enter into a written participation agreement with the Commission. #### Regulation .16 Licensed Insurance Producer Requirements. *COMAR 10.25.01.16* A licensed insurance producer in connection with the sale, solicitation, or negotiation of a health benefit plan to a small employer who meets the requirements described in Regulation .04 of this chapter shall: A. Provide information to the small employer about wellness benefits; B. At the time of initial application or at the time of policy renewal, advise the small employer to consult a tax advisor about the tax advantages of a Section 125 payroll deduction plan; C. For small employers providing an HSA compatible health benefit plan to their employees, advise the small employers of the designated financial institution required to be utilized for administration of the employee's HSA account, if the HSA contributions are to be included in the calculation of the total premium subsidy; and D. Ensure completion of the required employer and employee applications including any required affidavits, and forward the original copies of the applications to the carrier's subsidy administrator. #### Regulation .17 Premium Subsidy Program Design Factors. *COMAR 10.25.01.17* A. At least once each year, the Commission shall publish on the Commission's official website for informal public comment a list of the proposed Premium Subsidy Program design factors, including: (1) Eligible owner's countable wage; (2) Employee's eligible HSA contribution; (3) Maximum average wage for new applications; (4) Maximum average wage for participants; (5) Maximum eligible firm size; (6) Maximum income for other than individual coverage; (7) Maximum subsidy table; (8) Minimum countable wage; (9) Size factor; and (10) Subsidy program cap. B. Proposed components of the Premium Subsidy Program may be based on a number of factors including, but not limited to: (1) Current and projected enrollment in the Premium Subsidy Program; (2) Current and projected demographics of enrolled employers and enrolled employees in the Premium Subsidy Program; (3) Enrollment rate by small employers and eligible employees; (4) Inflation; (5) Changes in premiums; (6) Appropriations for the Premium Subsidy Program by the Maryland General Assembly; (7) Any surplus amounts in the Premium Subsidy Program; and (8) Any projected shortages in the Premium Subsidy Program. C. Following the informal public comment period, the Commission shall consider the public comments received, adopt revisions that the Commission considers appropriate, and publish the revisions on the Commission's official website and in the Maryland Register. #### Regulation .18 Closing the Premium Subsidy Program to the Entry of New Businesses. *COMAR 10.25.01.18* A. The Executive Director may close the program to the entry of new businesses by closing the Commission registry to new registration, notifying the participating carriers, and posting notice on the Commission's official website. B. This action shall be taken when the subsidies for the coming year are projected to reach or exceed the subsidy program cap, and may be taken at other times for reasons that the Executive Director considers sufficient. C. Advance notice of this action is desirable, but not required. D. This action shall be reviewed by the Commission at its next meeting. #### Regulation .19 Closing the Premium Subsidy Program to the Entry of Additional Employees of Enrolled Employers. *COMAR 10.25.01.19* A. The Executive Director may close the Premium Subsidy Program to the entry of new employees by closing the Commission registry to registration of additional employees, notifying the participating carriers and enrolled employers, and posting notice on the Commission's official website. B. This action shall be reviewed by the Commission at its next meeting. #### Regulation .20 Reopening the Premium Subsidy Program. *COMAR 10.25.01.20* A. Following closure of the Premium Subsidy Program under Regulation .18 or .19 of this chapter, the Commission may reopen the Premium Subsidy Program through a formal action specifying both the application process and the criteria that will be used to select new participants from among those applying. Selection criteria may include the average wage of the business, the geographic distribution of enrolled employers, or any other factor formally designated by the Commission. B. The Commission shall notify the participating carriers and shall post notice on the Commission's official website of the reopening of the Premium Subsidy Program. If the Premium Subsidy Program was closed under Regulation .19 of this chapter, the Commission shall also notify enrolled employers. #### Regulation .21 Penalties. *COMAR 10.25.01.21* A. In any conduct relating to the Premium Subsidy Program, employers, employees, participating carriers, subsidy administrators, and licensed insurance producers are subject to criminal and civil penalties under applicable law for any knowing and willful making of a materially false or fraudulent statement and the knowing and willful use of a false or fraudulent document. B. Employers, employees, participating carriers, subsidy administrators, and licensed insurance producers deemed by the Commission to be in violation of this chapter may be temporarily or permanently excluded from participation in the Premium Subsidy Program by the Commission. C. If temporarily excluded from the Premium Subsidy Program by the Commission, an enrolled employer and its enrolled employees are not eligible for the Premium Subsidy Program for 12 months and must requalify for the Premium Subsidy Program at the time of reapplication. #### Regulation .22 Decisions of the Commission — Delegation of Program Administration to the Executive Director. *COMAR 10.25.01.22* A. Decisions of the Commission relating to policies, regulations, and program design under Regulations .17 — .20 of this chapter may not be delegated. B. All other decisions of the Commission regarding program administration, including determinations of eligibility under Regulations .04, .05, .06, .12, and 13 of this chapter, subsidy calculations under Regulation .11 of this chapter, and penalties under Regulation .21 of this chapter are delegated to the Executive Director. #### Regulation .23 Appeals of Decisions of the Executive Director. *COMAR 10.25.01.23* A. Decisions of the Executive Director may be appealed to the Commission. B. The appeal shall be in writing and filed with the Commission within 30 days of the date of the decision of the Executive Director. C. The appeal shall state specifically the facts of the situation and the justification for the Commission to change the decision of the Executive Director. The appeal may: (1) Present significant, relevant information that was not previously presented to the Commission and that, with reasonable diligence, could not have been presented before the Executive Director made a decision; (2) Demonstrate that there have been significant changes in factors or circumstances relied upon by the Executive Director in reaching the decision; or (3) Demonstrate that the Executive Director has materially failed to follow the Commission's adopted procedures in reaching the decision. D. Within 15 days of the filing of the appeal, the Executive Director shall submit a written response to the appeal and send it to the appellant. The appellant shall have 10 days to submit a written response for consideration by the Commission. E. The Commission may act on the appeal in one of the following ways: (1) By a majority vote of the full Commission; (2) By a majority vote of an appeals committee, whose members shall be appointed by the Chair of the Commission; or (3) By a decision of an appeals commissioner, appointed by the Chair of the Commission. F. The Chair of the Commission shall determine which of the methods under §E of this regulation the Commission will use to act on the appeal. G. The Commission may act on the appeal based on the written appeal record alone, or may hold a hearing before acting on the appeal. H. The Commission may affirm, reverse, or modify the decision of the Executive Director and shall make written findings of fact and conclusions of law stating the basis for its decision within 30 days of its decision on the appeal. #### Regulation .24 Appeals of Decisions of a Participating Carrier. *COMAR 10.25.01.24* Actions taken by a participating carrier, including actions taken by a participating carrier that affect a small employer's eligibility for participation in the Premium Subsidy Program or the amount of the premium subsidy, shall be handled through the customary appeals processes for carrier decisions and may not be appealed to the Commission. ### Chapter 02 — User Fee Assessment on Health Care Practitioners **Authority:** Health-General Article, §19-111, Annotated Code of Maryland **Administrative History:** Effective date: June 6, 1994 (21:11 Md. R. 951) **Administrative History:** Regulation .01B amended effective August 21, 2000 (27:16 Md. R. 1524); April 11, 2005 (32:7 Md. R. 681) **Administrative History:** Regulation .02 amended effective March 18, 2002 (29:5 Md. R. 503); April 11, 2005 (32:7 Md. R. 681) **Administrative History:** Regulation .02C amended effective August 21, 2000 (27:16 Md. R. 1524); April 20, 2009 (36:8 Md. R. 596); July 22, 2013 (40:14 Md. R. 1175); May 22, 2017 (44:10 Md. R. 473) **Administrative History:** Regulation .03 adopted effective March 18, 2002 (29:5 Md. R. 503) #### Regulation .01 Definitions. *COMAR 10.25.02.01* A. In this chapter, the following terms have the meanings indicated: B. Terms Defined. (1) “Affected licensing board” means a licensing board of which all licensees are required by the Commissioner to pay a user fee. (2) “Commission” means the Maryland Health Care Commission. (3) “Health care practitioner” has the meaning stated in Health-General Article, §19-111, Annotated Code of Maryland. (4) “Licensing board” means a unit within the Maryland Department of Health that regulates health care practitioners by the issuance and renewal of licenses to practice a health care profession. (5) “User fee” means the amount set forth in the fee schedule that each assessed health care practitioner pays as part of a license renewal fee. #### Regulation .02 Method of User Fee Assessment. *COMAR 10.25.02.02* A. The Commission annually shall identify the health care practitioners to be assessed a user fee. B. Based on the Commission budget, the Commission shall establish a fee schedule which sets forth the fee that each health care practitioner shall pay as part of the renewal fee required to be paid to an affected licensing board. C. The formula the Commission shall use to calculate the fee set forth in the fee schedule is 16 percent of the total assessed fees per fiscal year divided by the number of health care practitioners identified pursuant to §A of this regulation. D. The Commission shall provide the affected licensing boards with the fee schedule within sufficient time for the user fee to be included in the license renewal billing cycle. #### Regulation .03 Waiver of the Fee Assessment Requirements. *COMAR 10.25.02.03* A. The Commission shall identify the average annual wage for health care practitioners by using comparable classifications in the State Classification and Salary Compensation Plan. B. The Commission shall determine the average annual wage by utilizing a salary range based on compensation from lowest to highest for each health care practitioner. C. The Commission shall waive the assessment for a health care practitioner whose average annual wage is substantially below that of other health care practitioners. ### Chapter 03 — User Fee Assessment on Payers, Hospitals, and Nursing Homes **Authority:** Health-General Article, §19-111, Annotated Code of Maryland **Administrative History:** Effective date: **Administrative History:** Regulations .01 — .04 adopted as an emergency provision effective July 1, 1994 (21:15 Md. R. 1301); adopted permanently effective December 5, 1994 (21:24 Md. R. 1988) **Administrative History:** Regulations .01 — .03 amended as an emergency provision effective June 8, 1995 (22:13 Md. R. 965); emergency status extended at 22:20 Md. R. 1540; emergency status expired January 15, 1996; adopted permanently effective February 12, 1996 (23:3 Md. R. 168) **Administrative History:** Regulations .01 — .04 repealed and new Regulations .01 — .03 adopted effective August 21, 2000 (27:16 Md. R. 1525) **Administrative History:** Regulation .02C amended effective March 18, 2002 (29:5 Md. R. 503); April 11, 2005 (32:7 Md. R. 681); April 20, 2009 (36:8 Md. R. 596); July 22, 2013 (40:14 Md. R. 1175); May 22, 2017 (44:10 Md. R. 473); July 22, 2024 (51:14 Md. R. 678) #### Regulation .01 Definitions. *COMAR 10.25.03.01* A. In this chapter, the following terms have the meanings indicated. B. Terms Defined. (1) “Assessment” means the total dollar amount that the Commission bills payers, hospitals, and nursing homes for a given fiscal year. (2) “Commission” means the Maryland Health Care Commission. (3) “Health benefit plan” has the meaning stated in Insurance Article, §15-201, Annotated Code of Maryland. (4) “Hospital” has the meaning stated in Health-General Article, §19-301, Annotated Code of Maryland. (5) “Nursing home” means a related institution, as defined in Health-General Article, §19-301, Annotated Code of Maryland, that is classified as a nursing home. (6) “Payer” means a: (a) Health insurer; (b) Nonprofit health service plan that holds a certificate of authority and provides health insurance policies or contracts in the State; or (c) Health maintenance organization that holds a certificate of authority in this State. (7) “User fee” means that portion of the assessment that each payer remits to the Administration pursuant to the formula established in Health-General Article, §19-111, Annotated Code of Maryland. #### Regulation .02 Method of User Fee Assessment. *COMAR 10.25.03.02* A. On or before June 30 of each year, the Commission shall assess each payer, hospital, and nursing home a fee in accordance with §B of this regulation. B. Assessment of Fees. (1) For each fiscal year, the Commission shall assess a fee on payers, hospitals, and nursing homes. (2) Fees shall be assessed on each payer by apportioning the total amount of fees to be assessed payers based on the ratio of each payer's total premiums collected in the State for health benefit plans to the total collected premiums of all payers collected in the State. The apportionment shall be based on premium information reported by the Insurance Commissioner. (3) A fee shall be assessed on each hospital that is equal to the sum of: (a) The amount equal to one-half of the total fees to be assessed on hospitals under §C of this regulation times the ratio of admissions of the hospital to total admissions of all hospitals; and (b) The amount equal to one-half of the total fees to be assessed on hospitals under §C of this regulation times the ratio of gross operating revenue of each hospital to total gross operating revenues of all hospitals. (4) A fee shall be assessed on each nursing home that is equal to the sum of: (a) The amount equal to one-half of the total fees to be assessed on nursing homes under §C of this regulation times the ratio of admissions of the nursing home to total admissions of all nursing homes; and (b) The amount equal to one-half of the total fees to be assessed on nursing homes under §C of this regulation times the ratio of gross operating revenue of each nursing home to total gross operating revenues of all nursing homes. C. For July 1, 2023 — June 30, 2026, the amount assessed on payers may not exceed 26 percent of the total amount assessed by the Commission. The amount assessed on hospitals may not exceed 39 percent of the total amount assessed. The amount assessed on nursing homes may not exceed 19 percent of the total amount assessed. #### Regulation .03 Payment of User Fees. *COMAR 10.25.03.03* A. On or before September 1, each payer assessed a user fee in accordance with the provisions of Health-General Article, §19-111, Annotated Code of Maryland, and this chapter shall make payment in the manner directed by the Commission. B. The Commission may make provisions upon the request of a payer for installment payments of the user fee, as the Commission considers necessary and appropriate. C. Any bill not paid within 30 days of the payment due date may be subject to an interest penalty to be determined and collected by the Commission. D. In addition to any penalties the Commission may impose on a payer, hospital, or nursing home that fails to pay the user fee in a timely manner, the Commission may refer the payer's delinquent account to the Department of Budget and Management's Central Collection Unit pursuant to the procedures in State Finance and Procurement Article, §3-301 et seq., Annotated Code of Maryland, and COMAR 17.01.01. ### Chapter 04 — Hospital Quality and Performance Evaluation System **Authority:** Health-General Article, §§19-109(a)(1) and (7) and 19-134(e), Annotated Code of Maryland **Administrative History:** Effective date: October 15, 2001 (28:20 Md. R. 1783) **Administrative History:** Regulation .04 amended effective December 23, 2002 (29:25 Md. R. 1982) **Administrative History:** Chapter revised effective June 16, 2008 (35:12 Md. R. 1120) #### Regulation .01 Definitions. *COMAR 10.25.04.01* A. In this chapter, the following terms have the meanings indicated. B. Terms Defined. (1) “Commission” means the Maryland Health Care Commission. (2) “Hospital” has the meaning stated in Health-General Article, §19-301, Annotated Code of Maryland. #### Regulation .02 Hospital Evaluation — Data Collection and Reporting Requirements. *COMAR 10.25.04.02* A. Each hospital shall file with the Commission data on measures to be included in the Commission's comparative quality and performance evaluation system and the Health Services Cost Review Commission's quality-based reimbursement initiative. The measures may be drawn from, but are not limited to, the: (1) National Quality Forum; (2) Hospital Quality Alliance; (3) Quality Indicator Project of the Maryland Hospital Association; (4) Agency for Healthcare Research and Quality; (5) Hospital Quality Initiative of the Centers for Medicare and Medicaid Services; (6) Centers for Disease Control and Prevention's National Healthcare Safety Network; (7) Joint Commission's ORYXR initiative; or (8) Work of academic, professional, healthcare research, and patient safety organizations. B. The measures shall relate to the outcomes of healthcare services and the process through which those services are delivered for the hospital as a whole as well as specific clinical areas and may include, but are not limited to, the following: (1) Acute myocardial infarction; (2) Cardiac surgery and angioplasty; (3) Emergency department care; (4) Healthcare-associated infections; (5) Heart failure; (6) Maternity and newborn care; (7) Patient experience; (8) Patient safety; (9) Pediatric care; (10) Pneumonia; (11) Health information technology; and (12) Intensivist staffing. C. The Commission shall provide notice in the Maryland Register and on its website of the form, format, and schedule for submission of data on measures to be reported to the Commission under this regulation. #### Regulation .03 Summary Studies, Reports, and Compilations. *COMAR 10.25.04.03* A. Subject to §B of this regulation, summary studies, reports, or other compilations of data developed by the Commission from the data submitted in accordance with this chapter are public information. B. Disclosure under §A of this regulation may not be made in such a way that the data furnished for a specific patient can be identified. C. The Commission shall publish annually, on a comparative basis, the results of the quality and performance evaluation system through one or more reports. The reports may also compare hospital performance to public health goals established by the Secretary of Health or the United States Public Health Service, United States Department of Health and Human Services. #### Regulation .04 Extension of Time. *COMAR 10.25.04.04* A. A hospital may request an extension of time of up to 30 days for submission of data required in Regulation .02 of this chapter. B. The hospital shall: (1) Submit the request to the Executive Director of the Commission not later than 30 days before the data are due; (2) Explain the reason for the extension request; and (3) Propose a reasonable specific date for submission of the report. C. A hospital may file a written petition with the Commission for review of a denial of an extension of time request. D. The Commission shall review the decision of the Executive Director. The Commission may affirm, reverse, or modify the decision of the Executive Director after providing the hospital with an opportunity to present its position to the Commission. #### Regulation .05 Penalty for Failure to File Reports. *COMAR 10.25.04.05* A hospital that does not timely file data may be subject to penalties described in COMAR 10.25.12. ### Chapter 05 — Data Release **Authority:** Health-General Article, §§19-103(c)(3), 19-109(a)(1) and (7) and (b)(5), and 19-133(d), and 19-134, Annotated Code of Maryland **Administrative History:** Effective date: June 19, 1995 (22:12 Md. R. 900) **Administrative History:** Regulation .01 amended effective October 15, 2001 (28:20 Md. R. 1783) **Administrative History:** Regulation .02 amended effective October 15, 2001 (28:20 Md. R. 1783); October 22, 2007 (34:21 Md. R. 1915) **Administrative History:** Regulation .04 amended effective December 23, 2002 (29:25 Md. R. 1983) **Administrative History:** Regulation .06 amended effective March 10, 1997 (24:5 Md. R. 412) **Administrative History:** Regulation .06 repealed and new Regulation .06 adopted effective October 15, 2001 (28:20 Md. R. 1783) **Administrative History:** Regulation .06 repealed effective October 22, 2007 (34:21 Md. R. 1915) **Administrative History:** Regulations .01—.05 under Small Group Market Data Collection repealed and new Regulations .01—.14 under Data Release adopted effective December 13, 2021 (48:25 Md. R. 1079) #### Regulation .01 Scope and Purpose. *COMAR 10.25.05.01* A. This chapter addresses the requirements, parameters, administrative process, and procedures for submission, review, approval, and disapproval of requests for data from the Maryland Medical Care Data Base, any other information collected and stored in the Maryland Medical Care Data Base, and any data submitted to the Maryland Health Care Commission from a claims clearinghouse certified by the Commission that qualify as directly or indirectly individually identifiable health information, as defined in the Health Insurance Portability and Accountability Act of 1996, including all pertinent implementing regulations at 45 CFR Parts 160 and 164. B. The Commission releases data pursuant to this chapter to facilitate uses of data that are in the public interest, such as to develop public policy, promote improvement in health care access, delivery, efficiency, quality, safety, and public health outcomes, contain costs, and advance the transparency of the health care system. C. The Commission retains all ownership rights to any data released pursuant to this chapter. A recipient of data released pursuant to this chapter does not obtain any right, title, or interest in data released to a data recipient pursuant to this chapter. D. This chapter does not apply to: (1) Requests for information from the Maryland Medical Care Data Base or any other Commission data base considered public under the Maryland Public Information Act and any other applicable laws and regulations; (2) Internal activities that are required of the Commission to conduct its lawful business of assembling the Maryland Medical Care Data Base, or any other data base that it is authorized to create and maintain; (3) Data released to any person, governmental entity, or other entity with which the Commission has contracted pursuant to State procurement policy and laws; (4) Data released, pursuant to the terms and conditions of a written, signed data use agreement entered into between the Commission and a State governmental entity, as defined in Regulation .02B of this chapter, that has an express statutory or regulatory mandate under Maryland law to access and use requested data; (5) Data that the Commission is expressly authorized and required to release under applicable federal or State law requirements, provided the release of the data complies with and is limited to the relevant requirements of the applicable law. (6) Data released pursuant to compulsory process, such as a subpoena, discovery request, warrant, or court order, issued under lawful authority in the course of litigation or an administrative proceeding before a State or federal court or administrative tribunal of competent jurisdiction, provided that prior to release of the data the Commission has made a reasonable effort to secure, or has secured, an appropriate protective order from the court or administrative tribunal, or a stipulation of the parties that: (a) Prohibits the use or disclosure of the data by the parties for any purpose other than the litigation or proceeding for which the data was sought; and (b) Requires the return of the data to the Commission or destruction of the data, including all copies of the data, at the end of the litigation or proceeding. #### Regulation .02 Definitions. *COMAR 10.25.05.02* A. In this chapter, the following terms have the meanings indicated. B. Terms Defined. (1) “All-payor claims database” or “APCD” means a large-scale database that systematically collects and aggregates enrollment, claims, and provider information from private and public payors in a state. (2) “Applicant” means a person, governmental entity, or other entity that submits an application requesting data from the Commission. (3) “Application” means a written request for data submitted in the form and manner specified by the Commission. (4) “Commission” means the Maryland Health Care Commission. (5) “Data extract” means a subset of information from the Maryland medical care database or other data base maintained by the Commission based on criteria provided by an applicant. (6) “Data recipient” means a person, governmental entity, or other entity whose application has been approved and who is authorized to access and use data requested in an application in accordance with a data use agreement. (7) “Data release” means the process of providing a data recipient with access and use of data requested in an application in accordance with a data use agreement. (8) “Data Release Advisory Committee” or “DRAC” means a multi-stakeholder group of individuals appointed by the Commission whose functions include but are not limited to that of privacy board review as described in 45 CFR §164.512, reviewing completed applications, and making a written recommendation to the Executive Director regarding whether an application should be approved, approved with conditions, or disapproved. (9) “Data set” means a collection of separate data elements or variables that can be manipulated as a unit. (10) “Data use agreement” means a written contractual document entered into between the Commission and a data recipient that contains terms and conditions that govern a data recipient’s access to and use of data provided by the Commission. (11) “De-identified data” means information that does not identify an individual and for which there is no reasonable basis to believe that it can be used to identify an individual. (12) “Direct individual identifier” means personal information such as name, Social Security number, and date of birth that uniquely identifies an individual or that can be combined with other readily available information to uniquely identify an individual. (13) “Disclose” means the release, redisclosure, transfer, provision, access, transmission, communication, or divulgence in any other manner of data release pursuant to this chapter. (14) Entity. (a) “Entity” means a person, partnership, firm, association, limited liability company, limited liability partnership, or public or private corporation. (b) “Entity includes a county or municipality of Maryland or a governmental entity of another state. (15) “Executive Director” means the Executive Director of the Maryland Health Care Commission. (16) “Funding source” means any federal or state governmental entity, public or private corporation or organization, educational or research institution or organization, foundation, person, individual, or other entity that has committed to give or grant, or has already given or granted, monetary funds to an applicant to cover all or part of the costs of the proposed use of the data described in an application submitted to the Commission. (17) Governmental Entity. (a) “Governmental entity” means any agency, authority, board, commission, council, department, instrumentality, unit, or other body of State government or the federal government that is established by law. (b) “Governmental entity” does not include a county or municipality of Maryland or a governmental entity of another state. (18) “HIPAA” means the United States Health Insurance Portability and Accountability Act of 1996, P.L.10491, as implemented and amended in federal regulations, including the HIPAA Privacy and Security Rules, 45 CFR Parts 160 and 164, as they may be amended, modified, or renumbered, including as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act. (19) “Identifiable data” means information that contains data elements that can be used to identify a specific individual. (20) “Indirect individual identifier” means a data element that can be used to identify an individual when combined with other information or data. (21) “Institutional Review Board” or “IRB” has the meaning stated in 45 CFR Part 46, and any subsequent revisions of those regulations, as they may be amended, modified, or renumbered, regarding the protection of human subject research. (22) “Medicaid” means the Maryland Medical Assistance Program. (23) “Medical Care Data Base” or “MCDB” means the data base established and maintained by the Commission pursuant to Health-General Article, §19-133, Annotated Code of Maryland, that collects eligibility data, professional services claims, institutional services claims, pharmacy claims, and provider data for Maryland residents enrolled in private insurance, Medicaid, or Medicare. The MCDB is Maryland’s all-payer claims data base. (24) “Person” means an individual, receiver, trustee, guardian, personal representative, fiduciary, representative of any kind, partnership, firm, association, corporation, or other entity. (25) “Product” means any creation derived in whole or part from data released pursuant to this chapter, including an analysis, article, chart, compilation, display, finding, graph, information, manuscript, map, presentation, publication, report, service, software, study, subscription service, summary, table, or website. (26) “Protected health information” or “PHI” means individually identifiable health information as defined in the HIPAA Privacy Rule at 45 CFR §160.103, as it may be amended, modified, or renumbered. (27) “State” means: (a) When capitalized, the State of Maryland; or (b) When lowercase, any state, possession, territory, or commonwealth of the United States, or the District of Columbia. #### Regulation .03 Types of Data Available for Release. *COMAR 10.25.05.03* A. The types of data specified in §C of this regulation may be released to an applicant whose application has been approved in accordance with the requirements of this chapter. B. The availability of the types of data specified in §C of this regulation requesting Medicaid data are subject to a determination of availability by Medicaid. C. Data may be provided pursuant to an approved application at the following levels of detail: (1) De-identified standard analytic file: A data extract that contains only data elements that are not considered PHI because the extract excludes direct and indirect individual identifiers as defined in the HIPAA Privacy Rule. (2) Limited data set: A data extract that contains a limited set of indirect individual identifiers as defined in the HIPAA Privacy Rule and excludes direct individual identifiers. (3) Custom data file: A data extract that is created based on criteria provided by an applicant and deemed the minimum amount necessary for an applicant’s proposed use of the data and consists of: (a) Indirect individual identifiers that can be used to identify individuals when combined with other information or data; or (b) Aggregate, summary data in which the risk of identifying individuals is minimal. #### Regulation .04 Requests for Medicaid Data. *COMAR 10.25.05.04* A. An application submitted to the Commission that includes a request for Medicaid data shall be referred to Medicaid for review after Commission staff has reviewed the application and determined the application to be complete in accordance with Regulation .06 of this chapter. B. Medicaid shall review an application referred pursuant to §A of this regulation and notify Commission staff in writing within 15 business days of the date of referral of Medicaid’s decision to: (1) Proceed with its own independent application review and decision-making process on that part of an application requesting Medicaid data: (a) Without further involvement or participation of Commission staff, the DRAC, or the full Commission; and (b) That is not governed by the review and decision-making process in Regulations .07—.14 of this chapter; (2) Decline to proceed with its own independent application review and decision-making process as described in §B(1) of this regulation and direct Commission staff to proceed with processing the referred application in accordance with Regulations .07—.11 of this chapter; or (3) Disapprove the request for Medicaid data based on the information provided in an application, in which case Medicaid shall provide reasons for the disapproval in the written notification to Commission staff. C. If Commission staff does not receive written notification from Medicaid within 15 business days of referring an application to Medicaid pursuant to §§A and B of this regulation, Commission staff shall proceed with processing the application in accordance with Regulations .07—.11 of this chapter. #### Regulation .05 Requests for Data from Governmental Entities. *COMAR 10.25.05.05* A. A governmental entity requesting data shall submit a written data request in the form and manner specified by the Commission that shall: (1) Be signed by the agency head or chief executive officer of a governmental entity; and (2) Include a signed statement by a governmental entity’s legal counsel that the governmental entity has legal authority to use the requested data for the purpose described in the written data request. B. The written data request submitted in accordance with §A of this regulation shall include at a minimum: (1) A description of the proposed purpose and use of the data requested and, if applicable, a description of an intention to incorporate the data requested into a product; (2) A description of, and reasons for, any proposed linkages to other data; (3) A data management plan that demonstrates appropriate privacy and security controls for access and storage of the data and for protection against inadvertent and unauthorized access and disclosure of the data; and (4) The safeguards against re-identification of an individual in a product that will be created or published publicly by the governmental entity. C. The Executive Director may make a final decision on whether to approve, approve with conditions, or disapprove a governmental entity’s data request provided that, prior to making a final decision, the Executive Director considers each of the criteria for approval and each reason for disapproval described in §E of this regulation. D. The Executive Director may exercise the discretion not to make a final decision on a governmental entity’s request for data and refer the data request to the DRAC for review and a written recommendation in accordance with Regulation .09 of this chapter. Upon receipt of a written report and recommendation from the DRAC, the Executive Director may, in the Executive Director’s discretion, either: (1) Make a final decision in accordance with Regulation .10A—C of this chapter; or (2) Refer the DRAC’s report and recommendation to a panel of three Commission members or the full Commission in accordance with Regulation .10D—E of this chapter for a decision on the data request. E. In reviewing and making a recommendation or final decision on whether a data request shall be approved, approved with conditions, or disapproved, the Executive Director, the DRAC, a panel of three Commission members, or the full Commission, as applicable, shall determine whether the proposed use of the data requested: (1) Falls within the public interest uses described in Regulation .01B of this chapter; (2) Meets the applicable criteria for approval in Regulation .09C of this chapter; or (3) Should be disapproved for any of the reasons in Regulation .09D of this chapter. F. Prior to the receipt of data pursuant to an approved data request, a governmental entity shall enter into a written data use agreement with the Commission in accordance with Regulation .13 of this chapter. #### Regulation .06 Requests for Data from Nongovernmental Entities. *COMAR 10.25.05.06* A. Submission of Applications. (1) An applicant shall complete and submit a written application in the form and manner specified by the Commission. (2) An applicant shall disclose on an application all potential or approved funding sources at the time of submission of an application. (3) If applicable, an applicant shall disclose any data sharing or other requirements imposed by a funding source as a condition of receipt of funding. (4) An applicant shall disclose on an application whether an applicant or any person or entity that is an officer, owner, operator, or part of management of an applicant’s organization who will have access and use of the requested data is currently, or has been within 10 years prior to the date of the application, a subject of or a party to a state or federal regulatory agency action or civil or criminal action involving a data breach, HIPAA violation, or other matter involving unauthorized access, use, and disclosure of data regardless of whether there has been a finding or admission of guilt, including being: (a) Convicted of a felony or pleading guilty, nolo contendere, entering a best interest plea of guilty, or receiving a diversionary disposition regarding a felony; (b) A subject of an investigation conducted by, or a pending complaint, charge, or indictment issued by, a local, state, or federal governmental regulatory agency or other state or federal law enforcement agency; or (c) A party to a final dispositive action in a state or federal governmental agency regulatory action or a civil action that resulted in entry into a settlement agreement, consent agreement, decree or order, corporate integrity agreement, corrective action agreement, or other similar agreement or other disposition in a civil action regardless of whether there has been an admission or finding of guilt or liability. (5) A person who signs an application shall: (a) Be an officer of an applicant’s organization who has been given signatory authority to bind the organization, unless an applicant is not part of an organization and is requesting data in an applicant’s individual capacity, in which case the applicant shall sign an application; and (b) Sign the following affirmation statement: “I solemnly affirm under the penalties of perjury that the contents of the application and any supplementary information are true to the best of my knowledge, information, and belief.” (6) An applicant shall pay a nonrefundable application fee in the amount specified in the list of fees published on the Commission’s website at the time of submission of an application. B. Completeness Review. (1) An application is not complete until an applicant has submitted a completed application, as determined by Commission staff, and provided any additional information, documentation, answers to questions, and clarifications requested by Commission staff within the time limit specified by Commission staff. (2) After Commission staff has determined that an application is complete, Commission staff shall refer an application requesting Medicaid data to Medicaid for review in accordance with Regulation .04 of this chapter. (3) If Commission staff has received a written response from Medicaid specifying its decision on whether to proceed on the request for Medicaid data under either Regulation .04B(1), (2) or (3) of this chapter, Commission staff shall refer a completed application, Medicaid’s written response, all supporting documentation, and any public comment received under Regulation .07 of this chapter, to the DRAC for further review in accordance with Regulation .09 of this chapter. (4) In accordance with Regulation .04C of this chapter, if Commission staff has not received a written response from Medicaid within 15 business days of Commission staff’s referral of the application to Medicaid, then Commission staff shall proceed with processing the application, including the request for Medicaid data, in accordance with Regulations .07—.11 of this chapter. (5) If Medicaid disapproves the part of an application requesting Medicaid data pursuant to Regulation .04B(3) of this chapter, an applicant shall notify Commission staff in writing within 15 business days of an applicant’s wishes regarding further consideration of a non-Medicaid part of an application, specifically, whether an applicant requests that: (a) Commission staff refer the part of a completed application requesting non-Medicaid data to the DRAC for further review in accordance with Regulation .09 of this chapter; or (b) An applicant’s entire application be withdrawn and receive no further consideration, in which case Commission staff shall administratively close the application pursuant to §B(7) of this regulation. (6) If an applicant fails to notify Commission staff in writing within 15 business days of receiving notice that Medicaid has disapproved the Medicaid part of an application as required under §B(5) of this regulation, Commission staff may administratively close an application pursuant to §B(7) of this regulation. (7) An application may be administratively closed and receive no further consideration if: (a) An applicant fails to provide a complete application, in the judgment of Commission staff, including providing all additional information, documentation, answers to questions, and clarifications requested by Commission staff, or by the DRAC during its review of an application under Regulation .09 of this chapter, within the time limit specified by Commission staff or the DRAC; or (b) An applicant fails to provide the written notification within 15 business days as required under §B(5) of this regulation. (8) For an applicant to receive further consideration of a request for data in an application that was administratively closed under §B(7) of this regulation, an applicant shall file a new application and pay the required fees that are in effect at the time of submission of a new application. #### Regulation .07 Transparency of Data Request and Data Release Process. *COMAR 10.25.05.07* A. Except for applications submitted by governmental entities pursuant to an express state or federal statutory or regulatory mandate, all completed applications shall be published on the Commission’s website during the pendency of the review process, without those parts of the application that specify an applicant’s proposed data management plan and security measures. B. Members of the public may submit written comment on an application for a period of 10 business days following the date on which an application is published on the Commission’s website. C. Commission staff shall provide all public comments received on an application to the DRAC for review and consideration in accordance with Regulation .09 of this chapter. D. After a decision has been made on an application, the following information shall be published on the Commission’s website: (1) The disposition of an application; that is, whether the application has been: (a) Approved; (b) Approved with conditions; (c) Disapproved; or (d) Withdrawn; (2) For approved applications: (a) The amount of fees charged for requested data; (b) A statement that all fees were waived; or (c) In the case of a partial waiver of fees, the amount of fees waived; (3) If applicable, notice that further review of a decision on the application is pending under Regulation .11 of this chapter and a description of the final decision when the further review process is completed; and (4) A summary description of a product derived in whole or part from data released to an applicant pursuant to this chapter, subject to any prohibition on public disclosure under applicable federal or State law, including the Maryland Public Information Act. #### Regulation .08 Data Release Advisory Committee. *COMAR 10.25.05.08* A. The Commission shall establish a Data Release Advisory Committee (DRAC) that meets the membership composition requirements and performs the review functions of a privacy board as described in 45 CFR §164.512. B. The Commission shall appoint the members of the DRAC and a chairperson from among the appointed members. C. The number of members appointed to the DRAC shall be at the discretion of the Commission but large enough to: (1) Represent the appropriate range of stakeholder groups described in §D of this regulation; and (2) Provide relevant experience, professional competency, and subject matter expertise in the areas of consumer privacy and advocacy, data analytics, data privacy, data security, health policy research, individual privacy issues, information technology, public health, and the use and analysis of health care claims data. D. The membership of the DRAC shall include, but not be limited to: (1) Representatives of various stakeholder groups, including academic research organizations, consumer advocacy organizations, employers, health care providers, health maintenance organizations, insurers, and nonprofit health service plans, that possess the relevant experience, professional competency, and subject matter expertise described in §C(2) of this regulation; (2) At least one representative from Medicaid; (3) At least one Commission staff member who shall serve as an ex-officio member; and (4) Any additional representatives that the Commission determines are needed. E. Members of the DRAC shall serve for a term not to exceed 3 years. At the end of a term, a member continues to serve until a successor is appointed. A member of the DRAC may be reappointed. F. The DRAC shall meet as necessary to: (1) Review completed applications requesting data; (2) Prepare reports and recommendations, with the administrative support of Commission staff, and submit them to the Executive Director; (3) If requested by Commission staff or the Executive Director, provide advice, consultation, and expertise on issues and questions that may arise: (a) During Commission staff’s review of applications under Regulations .05 and .06 of this chapter; (b) During the Executive Director’s review of applications under Regulation .10 of this chapter; and (c) After an application has been approved and requested data has been released to a data recipient, regarding compliance and enforcement of a data use agreement under Regulations .13 and .14 of this chapter; and (4) Perform any other duties and obligations required of the DRAC under this chapter. G. Commission staff shall provide the necessary administrative support required for the DRAC to perform its duties and obligations under this chapter, such as facilitating the scheduling and conducting of DRAC meetings, providing DRAC meeting agendas and supporting reference materials, conducting research and obtaining additional information as requested by the DRAC, and assisting in the preparation of written reports and recommendations. H. The Executive Director may remove a member of the DRAC for neglect of duty or misconduct by providing written notification to the DRAC member, stating the reason for the removal. I. A member of the DRAC who receives written notification of removal under §H of this regulation may submit a written request for full Commission review of the Executive Director’s removal decision within 20 business days of the date of the Executive Director’s written notification of removal. The written request for full Commission review shall state with particularity the grounds and factual basis for the DRAC member’s disagreement with the Executive Director’s decision to remove the DRAC member. #### Regulation .09 Data Release Advisory Committee Review. *COMAR 10.25.05.09* A. The following data requests are not subject to review by the DRAC: (1) Those categories of data requests and data release described in Regulation .01D(1)—(5) of this chapter; (2) Requests for data submitted by a governmental entity that the Executive Director determines warrants an expedited review under Regulation .05 of this chapter; and (3) Requests for aggregate, summarized data as described in Regulation .03C(3)(b) of this chapter. B. In reviewing an application, the DRAC shall consider the criteria for approval and reasons for disapproval of an application in §§C and D of this regulation and all public comment received under Regulation .07 of this chapter before preparing a written report and recommendation. C. The DRAC shall determine whether an application has met the following criteria for approval: (1) An applicant has provided documentation of relevant education, training, and experience that demonstrates the applicant is capable of undertaking and accomplishing the objective of the proposed use of the data and being a responsible steward of the requested data. (2) The data elements requested by an applicant are the minimum amount necessary to achieve the intended purpose for which the data is requested. (3) The proposed use of the data complies with applicable State and federal laws, including those laws relating to the privacy and security of protected health information (PHI). (4) The applicant has provided a written data management plan that demonstrates appropriate privacy and security controls for access and storage of the data and for safeguarding individual privacy and preventing unauthorized access and use of the data. (5) The requirement of obtaining written authorization from each individual who is the subject of requested identifiable data can be waived in accordance with 45 CFR §164.512. (6) If the applicant has proposed linkage of the requested data to other data source(s), the applicant has provided: (a) Sufficient written justification of the need to link the requested data to the other data source(s) named in the application to accomplish the objective and achieve the results of the proposed use of the data; and (b) Written proof that an additional level of data privacy and security controls will be in place to protect the privacy and identification of the individuals who are the subject of the requested data and the other data source(s) to which the requested data is to be linked. (7) An applicant who proposes to develop and sell a product that contains de-identified data has provided satisfactory written justification of how the proposed sale of the product using the de-identified data will serve the public interest. (8) The proposed use of the data is in the public interest. Examples of uses of data that serve the public interest include: (a) Health care cost and utilization analysis to guide and develop public policy; (b) Studies that promote improvement in public health, health care quality, and health care access; (c) Health planning and resource allocation studies; (d) Making information on cost and quality accessible to the public; and (e) Studies directly tied to evaluation and improvement of federal and State government initiatives. D. The DRAC shall determine whether an application has met any of the following criteria for disapproval: (1) The proposed use of the data violates State or federal law. (2) The proposed use of the data is not in the public interest. (3) The proposed use of the data is designed so that the stated objective of the project cannot be met. (4) False information or documentation on, or related to, an application was provided to Commission staff, the DRAC, the Executive Director, or the Commission. (5) An applicant provided incomplete information upon which to base a decision on the application. (6) An applicant or any person or entity that is an officer, owner, operator, or part of management of an applicant’s organization who will have access and use of the requested data is currently, or has been within 10 years prior to the date of the application, a subject of or a party to a state or federal regulatory agency action or civil or criminal action involving a data breach, HIPAA violation, or other matter involving unauthorized access, use, and disclosure of data regardless of whether there has been a finding or admission of guilt, including being: (a) Convicted of a felony or pleading guilty, nolo contendere, entering a best interest plea of guilty, or receiving a diversionary disposition regarding a felony; (b) A subject of an investigation conducted by, or a pending complaint, charges, or indictment issued by a local, state, or federal governmental regulatory agency or other state or federal law enforcement agency; or (c) A party to a final dispositive action in a state or federal governmental agency regulatory action or a civil action that resulted in entry into a settlement agreement, consent agreement, decree or order, corporate integrity agreement, corrective action agreement, or other similar agreement or other disposition in a civil action regardless of whether there has been an admission or finding of guilt or liability. (7) Violation of a previous data use agreement. (8) The data management plan does not demonstrate privacy and security controls for safeguarding individual privacy and preventing unauthorized access to or use of the data. (9) The proposed use of the data is for an impermissible purpose, which includes but is not limited to: (a) Using the requested data to identify an individual using a particular product or drug in order to develop a marketing campaign and directly contact an individual; (b) Using the requested data to contact an individual for fund-raising purposes directly; and (c) Using the requested data to contact an individual who is the subject of the data for any reason. (10) An applicant who proposes to develop and sell a product that contains requested de-identified data has not provided satisfactory written justification of how the proposed sale of the product using the de-identified data will serve the public interest. E. A member of the DRAC who has an affiliation with an applicant, or with any entity sponsoring, participating, or otherwise affiliated with an applicant’s proposed use of the requested data or any other conflict of interest or appearance of impropriety, shall recuse from consideration of that applicant’s application and may not participate in any discussions with other DRAC members or vote on the application. F. The DRAC may request that the Executive Director authorize the DRAC to invite an individual with expertise and competence in certain areas to assist the DRAC in the review of complex issues that require expertise beyond, or in addition to, that available among the membership of the DRAC. An individual invited pursuant to this section may not: (1) Have an affiliation with an applicant, or with any entity sponsoring, participating in, or otherwise affiliated with an applicant’s proposed use of the requested data or any other conflict of interest or appearance of impropriety; and (2) Vote on an application. G. The DRAC may require an applicant to obtain Institutional Review Board review prior to deciding on a recommendation for an application. H. The DRAC may request that Commission staff obtain additional information and documentation from an applicant if needed to determine whether the criteria for approval in §C of this regulation have been met or the reasons for disapproval in §D of this regulation exist. If an applicant does not provide the additional information within the time limit specified by the DRAC, the DRAC may refer the application to Commission staff with a request that the application submitted by the applicant be administratively closed per Regulation .06B(7) of this chapter. I. The DRAC, at its discretion, may require that an applicant meet with the DRAC to provide additional information, answer questions, or provide clarification on information provided in an application, the proposed use of the data requested, or the capability of an applicant to accomplish the objective of the proposed use of requested data. J. The DRAC shall review and consider all public comment received regarding an application under Regulation .07 of this chapter before making a recommendation to the Executive Director. K. The DRAC, with the administrative support of Commission staff, shall prepare a written report and recommendation for the Executive Director on each application reviewed, which shall address: (1) Each of the approval criteria in §C of this regulation; (2) Each of the disapproval criteria in §D of this regulation; (3) Any public comment received; and (4) The DRAC’s recommendation on whether an application should be approved, approved with conditions, or disapproved. L. After an application is approved pursuant to Regulation .10 of this chapter, Commission staff may: (1) Seek the advice and expertise of the DRAC on any issues regarding the applicant’s receipt of data or compliance with the terms and conditions of a data use agreement entered into under Regulation .13 of this chapter; and (2) Request that the DRAC prepare a written report and recommendation to the Executive Director regarding whether any compliance and enforcement actions may be warranted under Regulation .14 of this chapter. M. A DRAC recommendation on an application or on other issues related to an applicant’s receipt of data or compliance with the terms and conditions of a data use agreement entered into under Regulation .13 of this chapter is advisory and not binding on the Executive Director’s decision on an application or on whether to pursue an enforcement action under Regulation .14 of this chapter for noncompliance with a data use agreement. #### Regulation .10 Executive Director Review and Decision on Requests for Data. *COMAR 10.25.05.10* A. Before making a decision on an application requesting data, the Executive Director shall: (1) Review and consider the DRAC’s written report and recommendation; (2) Review all public comment received; (3) Determine whether the approval criteria set forth in Regulation .09C of this chapter have been met; and (4) Determine whether any of the disapproval criteria set forth in Regulation .09C of this chapter exists for disapproval of an application under Regulation .09D of this chapter. B. If the Executive Director determines that there is insufficient information upon which to base a decision on an application, the Executive Director may refer an application back to the DRAC with a request that the DRAC, through Commission staff, obtain and provide more specific or additional information, conduct a more detailed review and evaluation of the review criteria, and, if appropriate, submit a revised written report and recommendation. C. After considering the DRAC’s written report and recommendation on an application, the Executive Director shall issue a written decision: (1) Approving an application; (2) Approving an application subject to conditions, which shall be included as conditions in the data use agreement required under Regulation .13 of this chapter; or (3) Disapproving an application. D. If the Executive Director decides not to adopt the DRAC’s recommendation, specifically to approve an application that the DRAC has recommended be disapproved, or to disapprove an application that the DRAC has recommended be approved, then the Executive Director shall prepare a proposed recommended decision and refer to the full Commission for consideration and issuance of a final decision affirming, reversing, or modifying the Executive Director’s recommended decision. E. The Executive Director may exercise the discretion not to make a decision on an application and refer the DRAC’s written report and recommendation, and all public comment received on an application, to a review panel of 3 Commission members, which shall include a consumer member of the Commission. A review panel may render a final written decision on the application, or elect not to make a decision and refer the application to the full Commission for a decision. F. The Executive Director may not make a decision on an application that proposes to develop and sell a product that contains requested de-identified data and shall refer the application, the DRAC’s written report and recommendation, and all public comment received on the application to the full Commission for a decision. G. The Executive Director, a review panel, or the full Commission, as applicable, shall issue a written decision notifying an applicant that an application has been approved, approved with conditions, or disapproved. The written decision shall state the conditions imposed, if any, and, if an application is disapproved, state the reasons for disapproval. #### Regulation .11 Review of Decisions on Requests for Data. *COMAR 10.25.05.11* A. Request for Further Review of Decisions on Requests for Data. (1) An applicant may submit a written request for full Commission review of a written decision issued by the Executive Director or a review panel, as applicable, under Regulation .10G of this chapter, within 20 business days of the date the written decision is issued, which shall: (a) State with particularity the grounds and factual basis for an applicant’s disagreement with the decision and include citations to specific documentation or authority for each argument made in support of an applicant’s disagreement with the decision; (b) Include all relevant supporting documentation and authority cited in §A(1)(a) of this regulation; (c) Specify the remedy requested: (i) Reversal of the decision and unconditional release of the requested data; or (ii) Modification of the decision to release the requested data subject to conditions; and (d) If desired, include a written request to present oral argument to the full Commission, which shall be scheduled if requested. (2) After reviewing and considering an applicant’s written request for review of a decision and any oral argument, if applicable, the full Commission shall issue a written decision affirming, reversing, or modifying the decision reviewed. B. Request for Reconsideration of Commission Decisions on Requests for Data. (1) If the full Commission, instead of the Executive Director or a review panel, issues a decision on an application, an applicant may submit, within 20 business days of the date the Commission’s written decision was issued, a written request, which shall conform to §A(1) of this regulation, that the Commission reconsider its decision. (2) The Commission shall review and consider an applicant’s written request for reconsideration of its previous decision and any oral argument, if requested, and issue a written decision affirming, reversing, or modifying its previous decision. #### Regulation .12 Fees. *COMAR 10.25.05.12* A. The Commission may charge fees to an applicant and data recipient for: (1) Submission of an application; and (2) The cost of accessing data, which may include but is not limited to the costs of producing and releasing data to a data recipient. B. A list of fees to be charged pursuant to §A of this regulation shall be published on the Commission’s website, reviewed annually, and updated as needed. C. A list of proposed fees shall be published on the Commission’s website for receipt of written public comment for a period of 30 days before the proposed fees become final. All public comment received shall be considered before the proposed fees become final. D. An applicant shall pay the required application fee in full before Commission staff may begin the application review process. An application fee paid by an applicant is nonrefundable. E. An applicant who is approved to receive requested data shall pay all required fees in full prior to receipt of requested data. Fees paid by an approved data recipient for receipt of requested data are nonrefundable. F. If an approved applicant does not pay the required fees in full within 30 days of the date of written notification of application approval, the applicant will not receive the requested data and the application shall be deemed withdrawn and will receive no further consideration. G. The Executive Director may grant a partial or full waiver of fees for requested data if: (1) An applicant submits a written request for partial or full waiver of fees detailing reasons for the waiver request and, if applicable, state the amount of partial waiver requested; (2) An applicant provides financial statements or any other supporting documentation requested by the Executive Director regarding the applicant’s inability to pay required fees; (3) An applicant is a recipient of monetary funds from a funding source that covers all or part of the costs of an applicant’s use of the data, and the applicant provides documentation of: (a) An applicant’s written proposal requesting funding submitted to a funding source; (b) A funding source’s response to an applicant’s request for funding and, if applicable, funding approval; (c) Any requirements, including data sharing, imposed by a funding source as a condition of receipt of funding; (d) The budget governing an applicant’s use and allocation of the monetary funds that a funding source has granted or given to an applicant; and (e) Any other documentation regarding a funding source requested by the Executive Director; (4) An applicant timely provides any other information and documentation requested by the Executive Director; and (5) After considering all information provided by an applicant in support of a full or partial fee waiver, the Executive Director determines that a full or partial waiver of fees is in the public interest. H. Before making a final decision on a request for a partial or full waiver of fees under §G of this regulation, the Executive Director may consult with a review panel or the full Commission if the Executive Director deems it appropriate. #### Regulation .13 Data Use Agreement. *COMAR 10.25.05.13* A. An approved applicant shall enter into and sign a data use agreement prior to receipt of the requested data. If an approved applicant does not sign a data use agreement within 30 days of the date of written notification of application approval, the application shall be deemed withdrawn and will receive no further consideration. B. Prior to entry into a data use agreement and receipt of requested data, an approved applicant shall disclose any data sharing plan or agreement required by a funding source as a condition of an applicant’s receipt of funding. C. A data use agreement entered into with a data recipient under §A of this regulation shall, at a minimum: (1) Define the scope of use of the requested data and the research methodology; (2) Provide a plan for safeguarding the privacy and security of the data and complying with all applicable laws governing the privacy and security of data; (3) Require a data recipient to adhere to security processes and procedures aimed at preventing unauthorized access, use, or disclosure of the data; (4) Require that a data recipient notify Commission staff of any potential or actual data breach, including any instance of unauthorized access, use, or disclosure of data, no later than 7 days from the date of knowledge of the breach; (5) Require a data recipient to notify Commission staff in writing within 24 hours of receipt of any request from a third party requesting a data recipient to disclose all or part of the data received from the Commission, including but not limited to compulsory process, such as a subpoena, discovery request, warrant, or judicial or administrative order, or a public information act request, to provide the Commission adequate time to intervene and respond before the date that a data recipient has been requested or ordered to provide the data; (6) Specify the beginning and end dates of a data use agreement; (7) Provide for the return or destruction of data by a certain date upon termination of a data use agreement, or upon a determination that a data recipient has failed to comply with a data use agreement; (8) Require that a data recipient comply and assist, if requested, in any audit of compliance with a data use agreement; (9) Provide that a breach of any term or condition of a data use agreement is a breach of contract; (10) Permit that appropriate administrative and judicial remedies under applicable law may be pursued against a data recipient for failing to comply with the terms and conditions of a data use agreement; and (11) Be signed by: (a) A person authorized to contractually bind a data recipient’s organization; or (b) A data recipient, if a data recipient is not part of an organization. D. The Executive Director may consider a request from a data recipient for an extension of time or a modification of a term or condition of an executed data use agreement if: (1) A data use agreement includes an express provision allowing a request for an extension of time or a modification of a term or condition; (2) A data recipient submits a written request in the form and manner specified by the Commission, which shall include the reasons for the request, or specify good cause for the extension or modification request; (3) A request for an extension of time states the requested new end date for the data use agreement; and (4) A request for modification does not seek approval of a new or different use of the released data that was not approved under Regulation .10 of this chapter. E. Commission staff shall refer a written request for an extension of time or a modification of a term or condition of a data use agreement to the Executive Director for a decision. The Executive Director shall: (1) Consider a data recipient’s written request submitted under §D of this regulation before making a decision; and (2) Make a decision to approve, approve with conditions, or disapprove the request, and notify the data recipient in writing of the decision. F. If the Executive Director approves an extension or modification request, or approves with conditions, the Executive Director shall issue a signed, dated written amendment to the data use agreement approving the extension or modification request, stating the new end date of the data use agreement, if applicable, and specifying any additional conditions on the extension or modification. G. Re-Use of Data. (1) A data recipient who wishes to re-use data previously released, pursuant to an approved application and executed data use agreement prior to the termination of the data use agreement and destruction of the data, for a different use or purpose or to link with other data sources not described in the approved application shall submit a written application in the form and manner specified by the Commission and pay a nonrefundable application fee in the amount published on the Commission’s website at the time of submission of an application for re-use of previously released data. (2) Commission staff shall refer a data recipient’s completed application for re-use of previously released data prior to termination of a data use agreement for a different use for DRAC and Executive Director review, in accordance with Regulations .09—.11 of this chapter. (3) If a re-use application is approved, a data recipient shall pay the applicable nonrefundable data re-use fees in full in the amount published on the Commission’s website before a data recipient can use the previously released data for a different use or purpose. H. A data recipient who wishes to request additional data not requested in a data recipient’s approved application and described in a data use agreement shall: (1) Submit a new application in the form and manner specified by the Commission and pay a new nonrefundable application fee in accordance with Regulation .12 of this chapter, regardless of whether a data recipient intends to use the additional data for the same use described in a data recipient’s previously approved application; and (2) Pay required fees for receipt of additional data in accordance with Regulation .12 of this chapter if a data recipient’s request for additional data is approved. #### Regulation .14 Compliance and Enforcement. *COMAR 10.25.05.14* A. If a data recipient fails to comply with any of the terms and conditions of a data use agreement, or it becomes known after execution of a data use agreement that a data recipient provided false information during the application process, the Commission, acting through the Executive Director, may take one or more of the following administrative and judicial enforcement actions, depending upon the facts, circumstances, and gravity of the acts of noncompliance: (1) Terminate a data recipient’s current access to data; (2) Suspend a data recipient’s current access to data for a period of time: (a) Subject to conditions that a data recipient must satisfy before the suspension may be lifted and access to data reinstated; or (b) If required by the Executive Director, until a data recipient enters into a new data use agreement that requires compliance with a corrective action plan addressing the acts of noncompliance; (3) Require a data recipient to suspend or retract for a designated period of time a product that has been created or published from the data, subject to conditions that a data recipient must satisfy before the suspension or retraction may be lifted; (4) Demand the secure destruction or return of data and require documentary proof that all data released to a data recipient has been destroyed; (5) Terminate a data use agreement; or (6) Prohibit a data recipient from submitting a new application requesting data for a designated period of time. B. The Executive Director may refer an instance of unauthorized access, use, or disclosure of data to the Office of the Attorney General of Maryland, the Maryland State’s Attorney Office, or any other appropriate State or federal law enforcement authority. C. The Commission, based upon information provided by the Executive Director, may seek any appropriate administrative and judicial remedy allowed by State or federal law for: (1) Failing to comply with any terms and conditions for accessing and using data; and (2) Any instance of unauthorized or impermissible access, use, and disclosure of data. ### Chapter 06 — Maryland Medical Care Data Base and Data Collection **Authority:** Health-General Article, §§19-101, 19-103(c)(3), (4), (7), and (8), 19-109(a)(1), (6), and (7), 19-133, 19-134, and 19-137, Annotated Code of Maryland **Administrative History:** Effective date: January 15, 1996 (23:1 Md. R. 26) **Administrative History:** Regulation .06 amended effective October 7, 1996 (23:20 Md. R. 1423) **Administrative History:** Regulation .10A amended effective October 7, 1996 (23:20 Md. R. 1423) **Administrative History:** Chapter revised effective March 9, 1998 (25:5 Md. R. 369) **Administrative History:** Regulation .01-1 amended effective October 18, 1999 (26:21 Md. R. 1629) **Administrative History:** Regulation .02 amended effective October 18, 1999 (26:21 Md. R. 1629) **Administrative History:** Regulation .06B, D, F amended effective October 18, 1999 (26:21 Md. R. 1629) **Administrative History:** Regulation .07A amended effective October 18, 1999 (26:21 Md. R. 1629) **Administrative History:** Regulation .10C amended effective October 18, 1999 (26:21 Md. R. 1629) **Administrative History:** Regulation .11 amended effective October 18, 1999 (26:21 Md. R. 1629) **Administrative History:** Regulation .12B, D amended effective October 18, 1999 (26:21 Md. R. 1629) **Administrative History:** Regulation .13A, D amended effective October 18, 1999 (26:21 Md. R. 1629) **Administrative History:** Regulations .01—.14 repealed and new Regulations .01—.14 adopted effective August 21, 2000 (27:16 Md. R. 1525) **Administrative History:** Regulation .13 amended effective December 23, 2002 (29:25 Md. R. 1983) **Administrative History:** Regulations .01—.14 repealed and new Regulations .01—.17 adopted effective April 19, 2010 (37:8 Md. R. 617) **Administrative History:** Regulations .01—.17 repealed and new Regulations .01—.19 adopted as an emergency provision effective January 9, 2014 (41:3 Md. R. 200); adopted permanently effective March 17, 2014 (41:5 Md. R. 344) **Administrative History:** Chapter revised effective October 18, 2021 (48:21 Md. R. 889) #### Regulation .01 Scope and Purpose. *COMAR 10.25.06.01* These regulations establish appropriate methods for collecting and compiling Statewide data on selected health care services provided either under a Maryland contract or to Maryland residents by health care practitioners and facilities: A. From payors; B. From third-party administrators; C. From managed behavioral health care organizations; D. From pharmacy benefit managers; and E. Regarding providers for whom the Maryland Health Care Commission otherwise receives data. #### Regulation .02 Definitions. *COMAR 10.25.06.02* A. In this chapter, the following terms have the meanings indicated. B. Terms Defined. (1) “Adjudicated” means paid, resolved, or settled. (2) “Behavioral health care services” means procedures or services rendered by a health care practitioner for the treatment of mental health or substance use disorders. (3) “Capitated encounter” means a health care visit in which a health care practitioner or office facility provides a service pursuant to an agreement with a reporting entity for reimbursement on an aggregate fixed sum or per capita basis. (4) “Commission” means the Maryland Health Care Commission. (5) “Crosswalk” means a list of all codes and their definitions in a separate file that maps to a specific data field. (6) “Executive Director” means the Executive Director of the Maryland Health Care Commission. (7) “Fee-for-service encounter” means a health care visit in which a health care practitioner or office facility provided a health care service for which a claim was submitted to a reporting entity for payment, and payment was made on a per service basis. (8) “General health benefit plan” means: (a) A hospital or health care policy, contract, or certificate issued by a payor as defined in this section; (b) A behavioral health services plan; (c) A pharmacy benefit management services plan; (d) A vision plan certified by the Maryland Health Benefit Exchange; or (e) A dental plan certified by the Maryland Health Benefit Exchange. (9) “Health Benefit Exchange” or “Exchange” means the Maryland Health Benefit Exchange established as a public corporation under Insurance Article, §31-102, Annotated Code of Maryland, and includes the Individual Exchange and the Small Business Health Operations Program (SHOP) Exchange. (10) “Health care service” means a health or medical care procedure or service rendered by a health care practitioner that: (a) Provides testing, diagnosis, or treatment of human disease or dysfunction; or (b) Dispenses drugs, medical devices, medical appliances, or medical goods for the treatment of human disease or dysfunction. (11) “Health information exchange” or “HIE” means an entity that creates or maintains an infrastructure that provides organizational and technical capabilities in an interoperable system for the electronic exchange of protected health information among participating organizations not under common ownership, in a manner that ensures the secure exchange of protected health information to provide care to patients. An HIE does not include an entity that is acting solely as a health care clearinghouse, as defined in 45 CFR §160.103. A payor may act as, operate, or own an HIE subject to these regulations. (12) “HIPAA” means the U.S. Health Insurance Portability and Accountability Act of 1996, P.L.104-191, as implemented and amended in federal regulations, including the HIPAA Privacy and Security rules, 45 CFR §§160 and 164, as may be amended, modified, or renumbered and including as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act. (13) “Managed behavioral health care organization” means a company, organization, private review agent, or subsidiary that: (a) Contracts with a payor as defined in this section to provide, undertake to arrange, or administer behavioral health care services to members; or (b) Otherwise makes behavioral health care services available to members through contracts with health care providers. (14) “Managed care organization” or “MCO” means: (a) A certified health maintenance organization that is authorized to receive medical assistance prepaid capitation payments; or (b) A corporation that: (i) Is a managed care system that is authorized to receive medical assistance prepaid capitation payments; (ii) Enrolls only program recipients or individuals or families served under the Maryland Children's Health Program; and (iii) Is subject to the requirements of Health-General Article, §15-102.4, Annotated Code of Maryland. (15) “Master Patient Index” means a database that maintains a unique index identifier for each patient whose protected health information may be accessible through the HIE and is used to cross reference patient identifiers across multiple participating organizations to allow for patient search, patient matching, and consolidation of duplicate records. (16) “Medical Care Data Base” or “MCDB” means the data base established and maintained by the Commission pursuant to Health-General Article, §19-133, Annotated Code of Maryland, that collects eligibility data, professional services claims, institutional services claims, pharmacy claims, and provider data for Maryland residents enrolled in private insurance, Medicaid, or Medicare. The MCDB is Maryland’s All Payer Claims Data Base. (17) “MCDB Submission Manual” or “Manual” means the composition of data reporting requirements with guidelines of technical specifications, layouts, and definitions necessary for filing the reports required by this chapter. (18) “Non-Fee-for-Service Expenses Report” means a report with information on lump sum payments made by a reporting entity to providers as part of the reporting entity’s compensation to the providers for non-claims-based services. (19) “Office facility” means a freestanding facility providing: (a) Ambulatory surgery; (b) Radiologic or diagnostic imagery; or (c) Laboratory services. (20) “Payor” means: (a) An insurer or nonprofit health service plan that holds a certificate of authority and provides health insurance policies or contracts in Maryland; (b) A health maintenance organization (HMO) that holds a certificate of authority in Maryland; or (c) For Medical Care Data Base purposes: (i) A third-party administrator registered under Insurance Article, Title 8, Subtitle 3, Annotated Code of Maryland; (ii) A managed behavioral health care organization as defined in this section; or (iii) A pharmacy benefit manager. (21) “Person” means an individual, receiver, trustee, guardian, personal representative, fiduciary, representative of any kind, partnership, firm, association, corporation, or other entity. (22) “Pharmacy benefit management services” means: (a) The procurement of prescription drugs at a negotiated rate for dispensation within the State to beneficiaries; (b) The administration or management of prescription drug coverage provided by a purchaser for beneficiaries; and (c) Any of the following services provided with regard to the administration of prescription drug coverage: (i) Mail service pharmacy; (ii) Claims processing, retail network management, and payment of claims to pharmacies for prescription drugs dispensed to beneficiaries; (iii) Clinical formulary development and management services; (iv) Rebate contracting and administration; (v) Patient compliance, therapeutic intervention, and generic substitution programs; or (vi) Disease management programs. (d) “Pharmacy benefit management services” does not include any service provided by a nonprofit health maintenance organization that operates as a group model, provided that the service is provided solely to a member of the nonprofit health maintenance organization and is furnished through the internal pharmacy operations of the nonprofit health maintenance organization. (23) “Pharmacy benefit manager” means a person who performs pharmacy benefit management services and is registered as a pharmacy benefit manager under Insurance Article, Title 15, Subtitle 16, Annotated Code of Maryland. (24) “Practitioner” means a person who is licensed, certified, or otherwise authorized under Health Occupations Article, Annotated Code of Maryland, to provide health care services in the ordinary course of business or practice of a profession or in an approved education or training program. (25) “Practitioner federal tax ID number” means the federal tax identification number of the practitioner, practice, supplier or office facility receiving reimbursement for the service provided. (26) “Practitioner/supplier ID number” means the unique identification number used by the reporting entity to identify the particular practitioner or supplier. (27) “Primary diagnosis” means the principal diagnosis for the health care service visit. (28) "Provider” means: (a) A practitioner; (b) A facility where health care is provided to patients or recipients, including: (i) A facility, as defined in Health-General Article, §10-101(e), Annotated Code of Maryland; (ii) A hospital, as defined in Health-General Article, §19-301, Annotated Code of Maryland; (iii) A related institution, as defined in Health-General Article, §19-301, Annotated Code of Maryland; (iv) A health maintenance organization, as defined in Health-General Article, §19-701(g), Annotated Code of Maryland; (v) An outpatient clinic; and (vi) A medical laboratory; or (c) The agents and employees of a facility who are licensed or otherwise authorized to provide health care, the officers and directors of a facility, and the agents and employees of a health care provider who are licensed or otherwise authorized to provide health care. (29) “Qualified dental plan” means a dental plan certified by the Maryland Health Benefit Exchange that provides limited scope dental benefits, as described in §1311(c) of the Affordable Care Act and Insurance Article, §31-115, Annotated Code of Maryland. (30) “Qualified health plan” means a general health benefit plan that has been certified by the Maryland Health Benefit Exchange to meet the criteria for certification described in §1311(c) of the Affordable Care Act and Insurance Article, §31-115, Annotated Code of Maryland. (31) “Qualified vision plan” means a vision plan certified by the Maryland Health Benefit Exchange that provides limited scope vision benefits, as described in the Insurance Article, §31-108(b)(3), Annotated Code of Maryland. (32) “Reporting entity” means a payor, third-party administrator, managed behavioral health care organization, or pharmacy benefit manager that is designated by the Commission to provide reports consistent with this chapter to be collected and compiled into the Medical Care Data Base. (33) “State-designated health information exchange” or “State-designated HIE” means an HIE designated by the Maryland Health Care Commission and the Health Services Cost Review Commission pursuant to the statutory authority set forth in Health-General Article, §19-143, Annotated Code of Maryland. (34) “Supplier” means a person or entity, including a health care practitioner, which supplies medical goods or services. (35) “Third-party administrator” means a person that is registered as an administrator under Insurance Article, Title 8, Subtitle 3, Annotated Code of Maryland. #### Regulation .03 Persons Designated to Provide Data to the Commission. *COMAR 10.25.06.03* A. Reporting Entities. By December 31 of each year, the Commission shall make available a list of each payor, third-party administrator, pharmacy benefit manager, and managed behavioral health care organization meeting the criteria for designation as a reporting entity and who shall file the reports under this chapter in the following year. (1) The Commission shall designate as a reporting entity each payor and third-party administrator whose total lives covered exceeds 1,000, as reported to the Maryland Insurance Administration. (2) The Commission shall designate as a reporting entity each payor offering a qualified health plan, qualified dental plan, or qualified vision plan certified by the Maryland Health Benefit Exchange, under Insurance Article, §31-115, Annotated Code of Maryland. (3) The Commission shall designate as a reporting entity each payor that is a managed care organization participating in the Maryland Medical Assistance Program in connection with the enrollment of an individual in the Maryland Medical Assistance Program or the Maryland Children's Health Program. (4) The Commission may conduct surveys as needed to fulfill the purposes of the MCDB. (a) The Commission may conduct a survey of any reporting entity to determine if the reporting entity is required to report data or for other purposes consistent with this chapter. (b) If necessary, the Commission may institute an annual survey to obtain information needed to determine and designate a third-party administrator whose annual covered lives report filed with the Maryland Insurance Administration does not delineate the number of covered lives for the following: (i) A behavioral health services plan; or (ii) A pharmacy benefit management services plan. (c) A reporting entity shall timely report information sought by the Commission in a survey. B. Data Otherwise Collected by the Commission from Reporting Entities or Providers. (1) A reporting entity’s reports are considered submitted to the Commission if the reports are contained within the submission of another reporting entity. (2) For purposes of supplementing the MCDB, the Commission may include information that the Commission has otherwise received regarding providers and services. C. Data Collected from other State or Federal Agencies. The Commission designates and selects any data obtained from a state or federal agency to be a part of the MCDB for use consistent with this chapter. #### Regulation .04 Process for Submitting Data. *COMAR 10.25.06.04* A. The Commission shall provide each reporting entity with an annual update to the MCDB Submission Manual, and each current Manual update available, as specified in Regulation .15 of this chapter. B. Each reporting entity shall provide each of the following reports, if applicable: (1) Professional Services Data Report; (2) Pharmacy Data Report; (3) Provider Directory Report; (4) Institutional Services Data Report; (5) Eligibility Data Report; (6) Plan Benefit Design Report; (7) Dental Services Data Report; and (8) Non-Fee-for-Service Expenses Report. C. An MCO shall provide each required report to the Commission through the Maryland Medical Assistance Program, which will provide the MCO reports and related information to the Commission. #### Regulation .05 Time Period for Submitting Data Reports. *COMAR 10.25.06.05* A. Unless a different reporting time period is specified in the MCDB Submission Manual pursuant to §B of this regulation, each reporting entity shall submit to the Commission a complete set of the entity’s data for claims paid during each quarter of a calendar year in the form and manner described in Regulations .07—.14 of this chapter within 2 months of the last day in the applicable quarter. B. Each reporting entity shall submit at least quarterly to the Commission a complete set of the reporting entity’s data for claims paid during the specific time period in the form and manner described in Regulations .07—.14 of this chapter and within the time period specified in the MCDB Submission Manual, unless a more frequent submission schedule is instituted by the Commission pursuant to §C of this regulation. C. Before instituting a requirement that a reporting entity submit data for claims paid more frequently than quarterly, as required in §§A and B of this regulation, the Commission shall: (1) Establish a multi-stakeholder group consisting of representatives of reporting entities, involved State agencies, and other stakeholders, as appropriate, to discuss the benefits and costs of expanding data collection; and (2) Include a transition period for reporting entities to adjust to the new data submission schedule and process. #### Regulation .06 Protection of Confidential Information in Submissions. *COMAR 10.25.06.06* A. To assure that confidential records or information are protected, each reporting entity shall encrypt each of the following data elements in such a manner that each unique value for a data element produces an identical unique encrypted data element: (1) Patient or enrollee identifier; and (2) Internal subscriber contract number. B. In order to maintain a consistent and unique identifier for each patient across providers, payors, and services, the Commission shall: (1) Provide selected data to the State-designed HIE for the creation and encryption of a Master Patient Index; and (2) Include Master Patient Index identifiers received from the State-designated HIE in each eligibility data report submitted under Regulation .11 of this chapter. C. Each reporting entity shall maintain the security and preserve the confidentiality of the encrypted data. #### Regulation .07 Professional Services Data Report Submission. *COMAR 10.25.06.07* A. Each reporting entity shall submit a professional services data report that provides the data for each fee-for-service and capitated encounter, including fee-for-service equivalents prices for capitated services, provided by a health care practitioner or office facility. This report shall include all health care services provided: (1) To each Maryland resident insured by that entity under a fully insured or a self-insured contract; and (2) To each non-Maryland resident insured under a Maryland contract. B. Each professional services data report shall contain the information specified by the Commission in its annual update to the MCDB Submission Manual and be filed in a form and manner specified in the Manual. #### Regulation .08 Pharmacy Data Report Submission. *COMAR 10.25.06.08* A. Each reporting entity shall submit a pharmacy data report for each prescription drug encounter for services provided by a pharmacy located in or out of the State. This report shall include all pharmacy services provided to each Maryland resident insured under a fully insured contract or a self-insured contract, and to each non-Maryland resident insured under a Maryland contract. B. Each pharmacy data report shall contain the information specified by the Commission in its annual update to the MCDB Submission Manual and be filed in a form and manner specified in the Manual. #### Regulation .09 Provider Directory Report Submission. *COMAR 10.25.06.09* A. Each reporting entity shall submit a provider directory report detailing each health care practitioner or supplier that provided services to any enrollee of that reporting entity during the reporting period. This report shall contain information for each in-State Maryland practitioner or supplier, and for each out-of-State practitioner or supplier that has served a Maryland resident or a non-Maryland resident under a Maryland contract. B. Each provider directory report shall include a crosswalk to each practitioner or supplier ID listed in the professional services data report submitted under Regulation .07 of this chapter or the pharmacy data report submitted under Regulation .08 of this chapter. C. Each provider directory report shall contain the information specified by the Commission in its annual update to the MCDB Submission Manual and be filed in a form and manner specified in the Manual. #### Regulation .10 Institutional Services Data Report Submission. *COMAR 10.25.06.10* A. Each reporting entity shall submit an institutional services data report that reports all institutional health care services provided to each Maryland resident insured under a fully insured contract or self-insured contract, and each non-Maryland resident insured under a Maryland contract, whether those services were provided: (1) By a health care facility located in-State or out-of-State; or (2) Under a general health benefit plan. B. Each institutional services data report shall contain the information specified by the Commission in its annual update to the MCDB Submission Manual and be filed in a form and manner specified in the Manual. #### Regulation .11 Eligibility Data Report Submission. *COMAR 10.25.06.11* A. Each reporting entity shall submit an eligibility data report that provides information on the characteristics of each enrollee that is a Maryland resident insured under a fully insured contract or a self-insured contract, and each enrollee that is a non-Maryland resident insured under a Maryland contract, for services covered under each policy or contract issued by the reporting entity that are subject to this chapter. B. Each eligibility data report shall contain the information specified by the Commission in its annual update to the MCDB Submission Manual and be filed in a form and manner specified in the Manual. #### Regulation .12 Plan Benefit Design Report. *COMAR 10.25.06.12* Each plan benefit design report shall contain the information specified by the Commission in its annual update to the MCDB Submission Manual and be filed in a form and manner specified in the Manual. #### Regulation .13 Dental Services Data Report. *COMAR 10.25.06.13* Each dental services data report shall contain the information specified by the Commission in its annual update to the MCDB Submission Manual and be filed in a form and manner specified in the Manual. #### Regulation .14 Non-Fee-for-Service Expenses Report. *COMAR 10.25.06.14* Each non-fee-for-service expenses report shall contain the information specified by the Commission in its annual update to the MCDB Submission Manual and be filed in a form and manner specified in the Manual. #### Regulation .15 Report Submission Methods. *COMAR 10.25.06.15* A. When a reporting entity collects more granular information than required under this chapter, the reporting entity shall provide a conversion table that describes how internal values are mapped to each required category. B. The MCDB Submission Manual shall contain technical specifications, layouts, required reports, and definitions for each reporting entity. (1) The Commission shall provide an annual MCDB Submission Manual by November 21 of each year to be used for the reporting periods in the subsequent year. (2) The Commission may correct incomplete or erroneous information in the MCDB Submission Manual as necessary, and provide notice of each correction on the Commission website and by email to the contact persons designated by the reporting entities. (3) The Commission shall timely post the annual MCDB Submission Manual on the Commission website and provide notice in the Maryland Register. C. Master Patient Index. (1) The Commission may require that each reporting entity electronically submit sufficient demographic information on each enrollee to create a Master Patient Index. (2) The Commission may require that a reporting entity provide the information required under §C(1) of this regulation to the State-designated HIE solely for the purpose of creating a Master Patient Index. (3) The information required under §C(1) of this regulation shall be submitted in a manner consistent with all relevant federal and State privacy laws and regulations. #### Regulation .16 Request for an Extension of Time. *COMAR 10.25.06.16* A. A reporting entity may request an extension of an additional 30 days time to provide the required data report. B. For a 30-day extension request to be considered by Commission staff, the reporting entity shall submit a written request to the Executive Director at least 30 days before the required submission date that includes: (1) The extraordinary cause necessitating the extension request; and (2) A proposed date, which is no more than 30 days after the initial required submission date, when the reporting entity will provide the required data to the Commission. #### Regulation .17 Request for an Annual Waiver or Format Modification. *COMAR 10.25.06.17* A. Annual Waiver Request. (1) When a reporting entity is not able to submit a data report as set forth in this chapter, the reporting entity shall file with the Commission by March 15 of the year for which a waiver is sought a written request for an annual waiver that shall include an explanation of why the reporting entity is not able to provide the data report, including any extraordinary circumstances. (2) Supporting Documentation Required for an Annual Waiver Request. (a) A general health benefit plan shall include an affidavit from an officer of the organization stating that its total lives covered does not exceed 1,000, as reported to the Maryland Insurance Administration. (b) A qualified health benefit plan, a qualified vision plan or a qualified dental plan shall include a relevant document from the Health Benefit Exchange indicating that the entity’s filing of the data is not required. (c) A third party administrator shall include an affidavit from an officer of the organization stating that its total lives covered does not exceed 1,000, as reported to the Maryland Insurance Administration. (d) A behavioral health care services organization shall include an affidavit from an officer of the organization stating that its total lives covered does not exceed 1,000, as reported to the Maryland Insurance Administration. (e) A pharmacy benefit manager shall include an affidavit from an officer of the organization stating that its total lives covered does not exceed 1,000. B. Format Modification Request. When a reporting entity is not able to provide all the information required in Regulations .07—.14 of this chapter, the reporting entity shall file with the Commission a written request for a format modification at least 30 days before the applicable submission date that shall include: (1) The extraordinary circumstances surrounding the reporting entity’s inability to submit values for a specific data element; (2) An explanation of each reason why a format modification is necessary; and (3) A detailed description of the reporting entity’s proposed layout or submission method, or both, when applicable. C. The Executive Director shall provide the reporting entity with a written decision within 30 days of the filing of a completed request. D. Appeal of the Executive Director’s Decision. The aggrieved party may file a written request for Commission review of the Executive Director’s written decision within 14 days of the decision. (1) The Commission may provide an opportunity for the reporting entity to present argument to the Commission. (2) The Commission may affirm, reverse, or modify the decision of the Executive Director. (3) The decision by the Commission shall be by a majority of the quorum present and voting. #### Regulation .18 Failure to File Data Reports. *COMAR 10.25.06.18* A. A reporting entity that does not timely file a data report in compliance with the MCDB Submission Manual may be subject to monetary penalties as provided in COMAR 10.25.12. B. In accordance with COMAR 10.25.12.01C, a data report that is substantially incomplete or inaccurate is not timely filed within the meaning of §A of this regulation and may be subject to monetary penalties as provided in COMAR 10.25.12. #### Regulation .19 Summaries and Compilations. *COMAR 10.25.06.19* The Commission shall develop public-use data, summaries, and compilations for public disclosure, pursuant to Health-General Article, §§19-103(c)(3), 19-109(a)(6), and 19-134, Annotated Code of Maryland, in compliance with all applicable federal and State laws and regulations. ### Chapter 07 — Certification of Electronic Health Networks and Medical Care Electronic Claims Clearinghouses **Authority:** Health-General Article, §§4-302.1, 4-302, 4-302.2—.3, 4-302.5, 19-103(c)(2), (9) and (10), 19-109(a)(1) and (8), 19-133(d), 19-134, and 19-135(a) and (b), Annotated Code of Maryland **Administrative History:** Effective date: July 15, 1996 (23:14 Md. R. 1008) **Administrative History:** Regulation .01 amended effective July 23, 2001 (28:14 Md. R. 1322) **Administrative History:** Regulation .02 amended effective April 3, 2000 (27:6 Md. R. 641) **Administrative History:** Regulation .03 amended effective July 23, 2001 (28:14 Md. R. 1322) **Administrative History:** Regulation .05 amended effective April 15, 2002 (29:7 Md. R. 620) **Administrative History:** Regulation .10 amended effective July 23, 2001 (28:14 Md. R. 1322) **Administrative History:** Regulation .11 amended effective April 3, 2000 (27:6 Md. R. 641); December 23, 2002 (29:25 Md. R. 1983) **Administrative History:** Regulations .01—.11 repealed and new Regulations .01—.11 adopted effective March 24, 2008 (35:6 Md. R. 698) **Administrative History:** Regulation .02B amended effective December 15, 2008 (35:25 Md. R. 2150) **Administrative History:** Regulation .02B amended as an emergency provision effective January 11, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440) **Administrative History:** Regulation .04A amended effective December 15, 2008 (35:25 Md. R. 2150) **Administrative History:** Regulation .04B amended as an emergency provision effective January 11, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440) **Administrative History:** Regulation .05A amended effective December 15, 2008 (35:25 Md. R. 2150) **Administrative History:** Regulation .05A amended as an emergency provision effective January 11, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440) **Administrative History:** Regulation .06A, D amended effective December 15, 2008 (35:25 Md. R. 2150) **Administrative History:** Regulation .09 amended as an emergency provision effective January 11, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440) **Administrative History:** Regulation .09C amended effective December 15, 2008 (35:25 Md. R. 2150) **Administrative History:** Chapter revised effective November 10, 2025 (52:22 Md. R. 1095) #### Regulation .01 Scope. *COMAR 10.25.07.01* A. This chapter provides for the certification of electronic health networks and medical care electronic claims clearinghouses that operate in Maryland. Payors that accept electronic health care transactions originating in Maryland may only accept electronic health care transactions from electronic health networks or medical care electronic claims clearinghouses that obtain certification pursuant to this chapter. B. This chapter applies to: (1) An electronic health network, as defined in Regulation .02 of this chapter; and (2) The State-designated health information exchange or State-designated HIE as designated by the Maryland Health Care Commission and the Health Services Cost Review Commission pursuant to the statutory authority set forth under Health-General Article, §19-143, Annotated Code of Maryland.. #### Regulation .02 Definitions. *COMAR 10.25.07.02* A. In this chapter, the following terms have the meanings indicated. B. Terms Defined. (1) “Adjudication of claims” means the activities necessary for the adjudication or subrogation of a health benefit claim that has been filed or may be filed by a patient, or with the authorization of a patient on the patient’s behalf, including: (a) Determinations of eligibility or coverage, including coordination of benefits or the determination of cost-sharing amounts; (b) Reasonable prospective, concurrent, or retrospective utilization review or predetermination of benefit coverage; (c) Review, audit, and investigation of a specific claim for payment of benefits with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges; (d) Billing, claims management, collection activities, obtaining payment under a contract for reinsurance, and related health care data processing; and (e) Risk adjustments based on enrollee health status and demographic characteristics. (2) “Commission” means the Maryland Health Care Commission. (3) “Disclose” or “disclosure” means the release, redisclosure, transfer, provision, access, transmission, communication, or divulgence in any other manner of health information, including an acknowledgement that a health record on a particular patient or recipient exists outside the entity holding the information. (4) “Electronic health care transactions” means health care transactions that have been approved by a nationally recognized health care standards development organization (SDO) to support health care informatics, information exchange, systems integration, and other health care applications. (5) “Electronic Health Network (EHN)” means an entity involved in the exchange of electronic health care transactions between electronic health networks, payors, providers, vendors, or other entities. (6) “Entity” means a partnership, firm, association, limited liability company, limited liability partnership, or a public or private corporation. (7) “Grievance” means a written complaint or other information received by the Commission indicating that an MHCC-certified EHN may have violated one of the provisions of Regulation .09 of this chapter. (8) “Health information” means any information, whether oral or recorded in any form or medium, including electronic health information, that: (a) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, or health care clearinghouse; and (b) Relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual. (9) “Improvement of patient safety” means actions, strategies, or protocols to prevent health care errors, enhance the quality of care, and ensure a safe health care environment. (10) “Legally protected health information” means the health information with a date of service after May 31, 2022, that is subject to restrictions under Health-General Article, §4-302.5, Annotated Code of Maryland, and COMAR 10.11.08, including: (a) Mifepristone data, as defined by the Secretary; and (b) As specified by the Secretary, the diagnosis, procedure, medication, and other codes related to: (i) Abortion care; and (ii) Sensitive health services, as defined by Health-General, §4-301, Annotated Code of Maryland. (11) Medical Care Electronic Claims Clearinghouse. (a) “Medical care electronic claims clearinghouse” is an entity that transmits electronic health care transactions. (b) “Medical care electronic claims clearinghouse” includes an electronic health network. (12) “MHCC” means the Maryland Health Care Commission. (13) “MHCC-Certified Electronic Health Network” means an entity that has received certification from the Maryland Health Care Commission. (14) “Mitigation of a public health emergency” means taking actions to lessen the impact of a public health emergency and reduce harm, including implementing preventive measures, managing resources, and coordinating responses to limit disease spread, minimize health risks, and support affected communities effectively. (15) “Payor” means an entity that administers or provides reimbursement for health care benefits on an expense-incurred basis, including: (a) A health maintenance organization issued a certificate of authority in accordance with Health-General Article, Title 19, Subtitle 7, Annotated Code of Maryland; (b) A health insurer or nonprofit health service plan authorized to offer health insurance policies or contracts in this State in accordance with Insurance Article, Title 14, Annotated Code of Maryland; (c) A third-party administrator registered under Insurance Article, Title 8, Subtitle 3, Annotated Code of Maryland; (d) An entity that subcontracts with a third-party payor to provide specialty health care services including, but not limited to, a dental benefit payor, a vision benefit payor, a mental health benefit payor, and a pharmacy benefit manager; or (e) A managed care organization that contracts with the Maryland Medical Assistance program to provide health services to Maryland Medical Assistance recipients in accordance with Health-General Article, Title 15, Subtitle 1, Annotated Code of Maryland. (16) “State-designated health information exchange” or “State-designated HIE” means a health information exchange designated by the Maryland Health Care Commission and the Health Services Cost Review Commission pursuant to the statutory authority set forth under Health-General Article, §19-143, Annotated Code of Maryland. (17) “State health improvement program” means a State initiative designed to enhance public health through strategic planning, targeted interventions, and collaboration with stakeholders and the federal government, including State efforts in support of the Total Cost of Care model and successor models agreed to by the federal government and the State. (18) “Qualified accreditation or certification organization” means a nationally recognized entity that has established privacy and security standards for electronic health networks and accredits or certifies networks that meet those standards. #### Regulation .03 Duration of Certification. *COMAR 10.25.07.03* A certification is valid for a 2-year period from the date of certification unless withdrawn by the Commission prior to the end of the 2-year period. #### Regulation .04 Procedure to Obtain Certification. *COMAR 10.25.07.04* A. Application for Certification. An EHN seeking Commission certification shall: (1) Complete and submit an application for MHCC Electronic Health Network Certification in the form and manner specified by the Commission; (2) Provide evidence that it has been granted either candidacy status or full accreditation or certification status by a qualified accreditation or certification organization; and (3) Meet all Commission certification requirements set forth in Regulation .05 of this chapter. B. Fees. (1) An application fee shall be paid to the Commission within 30 days of receipt of an invoice from the Commission. (2) For an electronic health network with one operational site, an application fee of $400 shall be paid within 30 days of receipt of an invoice from the Commission. (3) For an electronic health network with more than one operational site, an application fee of $400, plus a $200 fee for each additional operational site, shall be paid within 30 days of receipt of an invoice from the Commission. #### Regulation .05 Standards for Certification. *COMAR 10.25.07.05* A. In order to obtain certification, an applicant shall: (1) Provide evidence that the applicant is accredited or certified by a qualified accreditation or certification organization; and (2) Meet the following standards for certification: (a) Demonstrate compliance with the HIPAA privacy standards set forth in 45 CFR Parts 160 and 164; (b) Demonstrate compliance with HIPAA security standards set forth in 45 CFR Parts 160, 162, and 164; (c) Provide an attestation signed by an officer of the applicant that to the extent required by Health-General Article, §4-302.5, Annotated Code of Maryland, the applicant: (i) Possesses the technological capability to filter and restrict from disclosure legally protected health information; (ii) Is parsing restricted codes and conveying all other information in the health record that is not prohibited by law to exchange; and (iii) Possesses the technological capacity to allow a consumer to request and consent to the exchange of legally protected health information to a specific treating provider; (d) Provide evidence of ability to measure technical performance and manage future capacity demands; (e) Provide evidence of initial and ongoing employee training in HIPAA privacy and security requirements and customer communication procedures; and (f) Provide additional information requested by the Commission as necessary to determine the applicant's compliance with the standards for certification. B. The Commission shall issue certification to an applicant that has met all the requirements of §A of this regulation. #### Regulation .06 Candidacy Status. *COMAR 10.25.07.06* A. Subject to the provisions of this section, the Commission shall issue candidacy status to an applicant that: (1) Has been granted candidacy status by a qualified accreditation or certification organization; (2) Has submitted an application for certification to the Commission; (3) Has paid the application fee; and (4) Has submitted documentation satisfactory to the Commission demonstrating compliance with the requirements set forth in Regulation .05B of this chapter. B. The Commission shall issue candidacy status to an applicant that has met all the requirements of §A of this regulation. C. An applicant that has achieved candidacy status may transmit electronic health care transactions while completing the certification requirements of this chapter. D. Candidacy status expires on the expiration of the applicant's candidacy status with a qualified accreditation or certification organization, on the approval of certification by the Commission, or 2 years from the date that candidacy status was issued. #### Regulation .07 Notice Required. *COMAR 10.25.07.07* A. Within 30 days after the closure, sale, lease, assignment, or transfer of an MHCC-certified EHN to any person or entity, the MHCC-certified EHN and the other party to the transaction shall notify the Commission of that event. Upon such notice, the Commission may seek further information to determine whether the certification should remain in effect notwithstanding the sale or other event. B. At least 60 days before changing its address, an MHCC-certified EHN shall notify the Commission of its intent and provide the Commission with the new address. C. At least 60 days before changing its name, an MHCC-certified EHN shall notify the Commission of its intent to change its name and provide the Commission with the new name. #### Regulation .08 Renewal of Certification. *COMAR 10.25.07.08* A. Application for renewal of certification shall be made at least 60 days before the expiration of the certification in a form and manner specified by the Commission. B. A recertification fee shall be paid to the Commission at the time the MHCC Electronic Health Network recertification application is filed. C. For an electronic health network with one operational site, a recertification fee of $250 shall be paid at the time the application is filed. D. For an electronic health network with more than one operational site, a recertification fee of $250, plus a $125 fee for each additional operational site, shall be paid at the time the application is filed. E. The Commission shall renew the certification of each renewal applicant that continues to meet the standards set forth in Regulation .05 of this chapter. F. The Commission shall issue a renewal of certification to an applicant that has met all the requirements of this regulation. #### Regulation .09 Electronic Health Network Transaction Submission. *COMAR 10.25.07.09* A. An MHCC-certified EHN shall submit electronic health care transactions information in accordance with this regulation to the State-designated HIE for public health and clinical purposes to facilitate: (1) A State health improvement program; (2) Mitigation of a public health emergency; (3) Improvement of patient safety; or (4) The participation of the State in the Center for Medicare and Medicaid Innovation’s Achieving Healthcare Efficiency through Accountable Design (AHEAD) model and any successor models. B. Transactions to be Submitted. (1) An MHCC-certified EHN shall submit electronic health care transactions information for services delivered in Maryland to the State-designated HIE that consist of the following transactions: (a) Health care claim or equivalent encounter information (837P and 837I); and (b) Health plan eligibility inquiry and response (270). (2) Only the EHN that receives the transaction from or returns the transaction to the originating submitter directly is required to submit the transaction information to the State-designated HIE. C. The Commission may request the submission of other electronic administrative transactions adopted by the Department of Health and Human Services. D. An MHCC-certified EHN may include transactions related to pharmaceuticals covered by medical benefits with its submission under §B of this regulation if excluding that data would be burdensome. E. Electronic Health Care Transactions Technical Submission Guidance. (1) In consultation with stakeholders, including Commission staff, the State-designated HIE shall develop an Electronic Health Care Transactions Technical Submission Guidance that: (a) Contains detailed technical requirements for submitting electronic health care transaction information to the State-designated HIE; (b) Provides an option for MHCC-certified EHNs to submit electronic health care transactions in a flat file; and (c) To the extent possible, utilizes industry recognized standards. (2) The State-designated HIE shall: (a) Invite all MHCC-certified EHNs and Commission staff to at least one meeting to discuss the initial development of the Electronic Health Care Transactions Technical Submission Guidance; (b) Invite all MHCC-certified EHNs and Commission staff to at least one meeting prior to making any material updates to the Electronic Health Care Transactions Technical Submission Guidance; (c) Solicit public comments on a draft copy of the initial Electronic Health Care Transactions Technical Submission Guidance, and any material updates to the guidance, by: (i) Publishing the draft guidance on its website; and (ii) Sending the draft guidance to MHCC-certified EHNs and the Commission by e-mail; (d) Accept comments on the draft Electronic Health Care Transactions Technical Submission Guidance for at least 30 days; (e) Publish a written response to any significant, substantive issues raised in comments; and (f) Consider all stakeholder feedback prior to finalizing the Electronic Health Care Transactions Technical Submission Guidance. (3) The State-designated HIE shall annually submit to Commission staff a final draft of the Electronic Health Care Transactions Technical Submission Guidance for approval, which shall not be unreasonably denied. (4) The State-designated HIE and the Commission shall publish the final, approved Electronic Health Care Transactions Technical Submission Guidance on their websites. (5) An MHCC-certified EHN shall submit electronic health care transaction information to the State-designated HIE in a manner detailed in the most recent version of the Electronic Health Care Transactions Technical Submission Guidance. F. Submission Schedule. (1) No later than the last business day of each month, an MHCC-certified EHN shall submit electronic health care transactions information from the preceding month to the State-designated HIE. (2) An MHCC-certified EHN shall submit electronic health transaction information at least once per month, but may submit data more often. G. An EHN may not charge a fee to a health care provider, health care payor, or the State-designated HIE for providing the information required under this regulation. H. Exemptions. (1) An MHCC-certified EHN may request a 1-year exemption from certain reporting requirements in this regulation. (2) An exemption request shall: (a) Be in writing; (b) Identify each specific requirement of this regulation from which the EHN is requesting an exemption; (c) Identify the time period of the exemption, if any; (d) State the reason for each exemption request; and (e) Include information that justifies the exemption request. (3) Within 45 days after receipt of complete information from an EHN requesting an exemption, the Commission shall take one of the following actions: (a) Grant the exemption by providing written notification; or (b) Deny the exemption request by providing written notification that enumerates the reasons for the denial to the EHN. (4) The Commission may not exempt an MHCC-certified EHN from any requirement within this regulation that is otherwise required by federal or other State law. (5) The Commission may grant an exemption on the following grounds: (a) The absence of functionality in the infrastructure of the EHN that prevents the EHN from complying with the requirement; (b) The requirement would hinder the ability of the EHN to comply with other requirements of this chapter or federal or other State laws; or (c) The requirement would cause an undue burden or hardship on the EHN, such that the EHN would no longer be able to provide EHN services in the State. (6) For good cause shown, the Commission may renew a 1-year exemption for an additional 1-year period. I. Effective Date. (1) The State-designated HIE shall publish the Electronic Health Care Transactions Technical Submission Guidance within 12 months of the final effective date of this regulation. (2) An MHCC-certified EHN shall begin submitting electronic health care transaction information based on the most recent version of the Electronic Health Care Transactions Technical Submission Guidance within 18 months following the initial publication of the Electronic Health Care Transactions Technical Submission Guidance. J. Implementation Reporting. (1) Upon request, the State-designated HIE shall submit to the Commission updates on: (a) Its status of developing the Electronic Health Care Transactions Technical Submission Guidance; (b) Its progress in supporting MHCC-certified EHN implementation of the Electronic Health Care Transactions Technical Submission Guidance; and (c) Any disruptions or technology failures that delay implementation and associated impacts, if any. (2) An MHCC-certified EHN shall submit to the Commission at least quarterly: (a) An implementation plan and timeline detailing progress the MHCC-certified EHN has made towards submitting electronic health care transaction information to the State-designated HIE; and (b) Any other information requested by the Commission related to the implementation of this regulation. #### Regulation .10 Withdrawal of Certification and Other Penalties. *COMAR 10.25.07.10* A. The Commission may withdraw certification from an MHCC-certified EHN if the Commission finds that: (1) The MHCC-certified EHN fails to meet the certification standards set forth in Regulation .05 of this chapter; (2) A principal or owner of the MHCC-certified EHN, or the entity itself, is convicted of, or pleads guilty or nolo contendere to, a crime related to the operation of the EHN or to a crime involving financial improprieties; (3) A principal or owner of the MHCC-certified EHN, or the entity itself, is notified by a qualified accreditation or certification organization or the Commission of a violation of HIPAA privacy or security standards and fails to take action to remedy the violation within the period of time specified by a qualified accreditation or certification organization or by the Commission; (4) The MHCC-certified EHN disclosed legally protected health information in violation of Health-General Article, §4-302.5, Annotated Code of Maryland; or (5) The MHCC-certified EHN fails to submit electronic health care transactions information to the State-designated HIE in accordance with Regulation .09 of this chapter. B. Beginning June 1, 2024, a person who knowingly violates Health-General Article, §4-302.5, Annotated Code of Maryland, shall be guilty of a misdemeanor and on conviction is subject to a fine not to exceed $10,000 per day based on: (1) The extent of actual or potential public harm caused by the violation; (2) The cost of investigating the violation; and (3) The person’s prior record of compliance. C. A MHCC-certified EHN that fails to submit electronic health transactions information to the State-designated HIE in accordance with Regulation .09 of this chapter may be subject to a financial penalty not to exceed $10,000 per day based on: (1) The extent of actual or potential public harm caused by the violation; (2) The cost of investigating the violation; and (3) Whether the MHCC-certified EHN committed previous violations. #### Regulation .11 Notice Prior to Withdrawal. *COMAR 10.25.07.11* A. Before withdrawal of certification on one of the bases provided in Regulation .10 of this chapter, the Executive Director shall inform the MHCC-certified EHN, setting forth in writing the reasons for withdrawal. B. The notice of withdrawal shall set forth the right of the MHCC-certified EHN to an evidentiary hearing, conducted in accordance with Regulation .12 of this chapter, to show cause why the certification should not be withdrawn. C. Within 15 days of receipt of the notice of withdrawal, the MHCC-certified EHN may make a written filing that details the EHN's position and provides supporting documentation, before the Commission takes final action to withdraw the EHN's certification. #### Regulation .12 Hearing Procedures. *COMAR 10.25.07.12* A. Reviewer as Presiding Officer. (1) If an evidentiary hearing is requested, the Executive Director shall appoint a single commissioner to act as reviewer and preside at the hearing. (2) The reviewer shall hold a prehearing conference, at which the reviewer shall: (a) Summarize the rules of procedure governing the evidentiary hearing; (b) Determine the date, time, and place of the evidentiary hearing; (c) Determine the form and manner of the presentation of evidence; (d) Rule on any pending motions; and (e) Make other decisions as appropriate. B. Hearing. The reviewer is empowered to: (1) Make all rulings as to evidence, testimony, and the conduct of the evidentiary hearing; and (2) Take other actions consistent with the duties of a reviewer. C. Proposed Decision. The reviewer shall prepare a proposed decision and order which shall state the reviewer's determination as to whether the allegations that formed the basis for the hearing are substantiated or not, and if substantiated, include a proposed sanction. D. Exceptions. (1) If the proposed decision is adverse to the MHCC-certified EHN, the EHN may submit written exceptions to the proposed decision and order by submitting written argument with citation to supporting documentation from the record. (2) Exceptions shall be filed according to a schedule set by the reviewer, with a party filing exceptions having at least 7 days to file exceptions, and a party filing a response to exceptions having at least 5 days to file a response, unless this period is shortened by agreement of the parties. E. Final Decision. (1) The Commission shall issue a final decision based on the record of the proceeding including findings of fact and conclusions of law, that: (a) Finds the allegations to be substantiated and withdraws the MHCC-certified EHN status of the entity; (b) Finds the allegations to be substantiated, but permits the entity to retain MHCC-certified EHN status, with appropriate conditions; or (c) Finds the allegations to be unsubstantiated and continues the entity's MHCC-certified EHN status. (2) An MHCC-certified EHN aggrieved by the Commission's final decision may seek judicial review pursuant to State Government Article, Title 10, Annotated Code of Maryland. ### Chapter 08 — Evaluation of Quality and Performance of Health Benefit Plans **Authority:** Health-General Article, §§19-109(a)(1) and (7), 19-132, and 19-134(c), Annotated Code of Maryland **Administrative History:** Effective date: October 17, 2011 (38:21 Md. R. 1278) #### Regulation .01 Scope. *COMAR 10.25.08.01* A. This chapter applies to each carrier that participates in the health benefit plan quality and performance evaluation system. B. This chapter requires participation in the health benefit plan quality and performance evaluation system by each carrier that: (1) Holds a certificate of authority in the State; (2) Has a premium volume in Maryland for each category of health benefit plan that exceeds $1,000,000; and (3) Has no more than 65 percent of its Maryland enrollees covered through the Medicaid and Medicare Programs (for each category of health benefit plan), as reported in an annual statement submitted by a carrier to the Commission that includes premium volume and enrollment percentages for the calendar year preceding the reporting period. C. The evaluation system described in this chapter is designed to address the information needs of consumers and purchasers by providing an assessment of the quality and performance of health benefit plans based on measures endorsed or implemented by nationally recognized organizations involved in quality of care and performance measurement. #### Regulation .02 Definitions. *COMAR 10.25.08.02* A. In this chapter, the following terms have the meanings indicated. B. Terms Defined. (1) “Carrier” means an insurer or nonprofit health service plan that holds a certificate of authority and provides health insurance policies or contracts in the State in accordance with Insurance Article, Annotated Code of Maryland, or a health maintenance organization that holds a certificate of authority in the State. (2) “Commission” means the Maryland Health Care Commission. (3) Health Benefit Plan. (a) “Health benefit plan” means a hospital or medical policy, contract, or certificate issued by a carrier. (b) “Health benefit plan” does not include: (i) Coverage for accident or disability income insurance; (ii) Coverage issued as a supplement to liability insurance; (iii) Liability insurance, including general liability insurance and automobile liability insurance; (iv) Workers’ compensation or similar insurance; (v) Automobile or property medical payment insurance; (vi) Credit-only insurance; (vii) Coverage for on–site medical clinics; (viii) Dental or vision insurance; (ix) Long-term care insurance or benefits for nursing home care, home health care, community-based care, or any combination of these; (x) Coverage only for a specified disease or illness; (xi) Hospital indemnity or other fixed indemnity insurance or a hospital or medical policy, contract, or certificate issued by a carrier; or (xii) If offered as a separate insurance policy, Medicare supplemental health insurance, as defined in §1882(g)(1) of the Social Security Act, coverage supplemental to the coverage provided under Chapter 55 of Title 10 of the United States Code, or similar supplemental coverage provided under an employer sponsored plan. (4) “HEDIS” means the Healthcare Effectiveness Data and Information Set published by the National Committee for Quality Assurance. (5) “Measurement year” means the calendar year in which services take place and that precedes the reporting period in which the quality and performance measures report is submitted to the Commission or its contractor. (6) “Performance measures report” means the report that a carrier submits to the Commission or its contractor that includes the performance measures calculated in accordance with the HEDIS and other applicable performance measure specifications. (7) “Proprietary information” means information that would put a carrier at a competitive disadvantage if such information were disclosed. (8) “Quality and performance evaluation system” means the process by which the Commission carries out its responsibilities related to the evaluation and reporting of quality and performance of health benefit plans. (9) “Reporting period” means the year in which a carrier submits HEDIS and other performance measures to the Commission or its contractor and which follows the measurement year. #### Regulation .03 Health Benefit Plan Quality and Performance Evaluation System — Implementation. *COMAR 10.25.08.03* A. Carrier Participation. (1) Each carrier may participate in the health benefit plan quality and performance evaluation system. (2) Each carrier that meets the criteria of Regulation .01B of this chapter is required to participate. (3) A carrier that chooses not to participate in the health benefit plan quality and performance evaluation system must present clear evidence to the Commission that shows that the carrier has no more than $1,000,000 in annual premium volume by category of health benefit plan and no more than 65 percent of its Maryland enrollees covered through the Medicaid and Medicare programs. B. Performance Measures. The Commission shall choose performance measures that are important, feasible, scientifically sound, and actionable, including performance measures that: (1) Are related to the quality and performance of medical services provided by a health benefit plan; (2) Allow for comparisons among health benefit plans; (3) Can be of interest to purchasers, consumers, providers, carriers, or health officials; (4) Can be used to affect changes in performance; and (5) Can be validated through an audit conducted by an independent party for validity, reliability, and comparability. C. Notice by the Commission. (1) Beginning in November 2011, and each November thereafter, the Commission shall provide a dated notice posted on the Commission’s website and a written notice to each carrier required to report under Regulation .01A. of this chapter regarding the following: (a) The required categories of health benefit plans for which HEDIS and other performance measures must be submitted for the upcoming measurement year; (b) The selected HEDIS and other performance measures for each category of health benefit plan to be included in the reporting period; and (c) Quality and performance measures that will be subject to audit. (2) Beginning in December 2011, and each December thereafter, the Commission shall provide a dated notice posted on the Commission’s website and a written notice to each carrier required to report under Regulation .01A of this chapter regarding the following: (a) The required categories of health benefit plans for which HEDIS and other performance measures must be submitted for the upcoming measurement year; (b) The selected HEDIS and other performance measures for each category of health benefit plan to be included in the reporting period; (c) Quality and performance measures that will be subject to audit; and (d) The HEDIS and other performance measures anticipated to be required in the measurement year occurring after the current measurement year. D. Performance Measures Collection. (1) Beginning in January of each reporting period, a carrier that is required to participate or elects to participate in the health benefit plan quality and performance evaluation system shall collect all required performance measures as follows: (a) Collecting HEDIS measures, a carrier shall follow the specifications contained in the latest version or technical update of HEDIS applicable to the measurement year; (b) Collecting other performance measures, a carrier shall follow specifications published by a nationally recognized organization involved in quality and performance measurement, and in accordance with the notice provided by the Commission in November for the measurement year; and (c) A carrier shall use the specifications, templates, and other documents provided by the Commission, which shall be consistent with those published by the National Committee for Quality Assurance for HEDIS measures and, for non-HEDIS performance measures, required by the Commission, consistent with specifications, templates, or documents published by nationally recognized organizations involved in quality of care and performance measurement. (2) A carrier is not required to submit HEDIS or other performance measures regarding proprietary information contained in descriptive information on health plan management and activities. (3) The Commission shall provide technical assistance and auditing services to a carrier required to report the HEDIS and other performance measures. E. Commission Publication of Health Benefit Plan Quality and Performance Evaluation Reports. On or before November 1 of each year, the Commission shall publish on its website one or more reports for use by consumers and purchasers who make health benefit plan enrollment and contracting decisions. The reports shall: (1) Compare quality and performance evaluation results of each health benefit plan on the various HEDIS and other performance measures required by the Commission; and (2) Include information on valid and reliable HEDIS and other performance measures that are comparable on a health benefit plan level, as determined by the Commission. #### Regulation .04 Audits. *COMAR 10.25.08.04* A. In order to verify the validity, reliability, and comparability of HEDIS and other performance measures required by the Commission, a carrier shall participate in certified audits as specified by the Commission, which may include: (1) A process audit; (2) One or more site visits; (3) Specification and source code review and verification; and (4) Medical records review. B. Each carrier that is required to participate or elects to participate in the health benefit plan quality and performance evaluation system shall submit audited HEDIS and other performance measures for each designated health benefit plan for the reporting period to the Commission or its contractor by June 1 of the reporting period. C. Within the time period specified by the Commission, a carrier shall correct inaccurate or incomplete data contained in its performance measures report that become apparent during the audit or other process. #### Regulation .05 Extension of Time. *COMAR 10.25.08.05* A. A carrier may request an extension of not more than 30 days for submission of the performance measures report. B. A request for an extension of time shall: (1) Be submitted to the Executive Director of the Commission not later than 30 days before the carrier’s performance measures report is due; (2) Explain the good cause for the requested extension; and (3) Propose a reasonable date certain, not to exceed 30 days after the original due date, for submission of the performance measures report. C. A carrier may seek Commission review of the Executive Director’s denial of a requested extension of time by filing a written petition for review within 7 days of receipt of the denial. D. The Commission shall provide the carrier with an opportunity to present its position to the Commission, and may affirm, reverse, or modify the decision of the Executive Director. #### Regulation .06 Penalty for Failure to File Reports. *COMAR 10.25.08.06* A carrier that is required to participate under Regulation .01B of this chapter and that does not timely file a performance measures report may be subject to the penalties provided in COMAR 10.25.12. ### Chapter 09 — Requirements for Payers to Designate Electronic Health Networks **Authority:** Health-General Article, §§4-302.1, 19-101, 19-103(c)(9) and (10), 19-109(a)(1), and 19-134(a) and (b), Annotated Code of Maryland **Administrative History:** Effective date: July 15, 1996 (23:14 Md. R. 1009) **Administrative History:** Regulation .02 amended effective July 23, 2001 (28:14 Md. R. 1322) **Administrative History:** Regulation .03 amended as an emergency provision effective May 1, 1997 (24:11 Md. R. 792); emergency status expired October 1, 1997; amended permanently effective October 20, 1997 (24:21 Md. R. 1450) **Administrative History:** Regulation .03 amended effective July 23, 2001 (28:14 Md. R. 1322) **Administrative History:** Regulation .05A amended effective July 23, 2001 (28:14 Md. R. 1322) **Administrative History:** Chapter revised effective July 5, 2004 (31:13 Md. R. 994) #### Regulation .01 Scope. *COMAR 10.25.09.01* A. This chapter applies to a third-party payer operating in the State of Maryland, as of July 1, 1997, whose premium volume exceeds $1,000,000 as reported in the most recent annual statement in the hands of the Maryland Insurance Administration as of December 1 of each calendar year. B. At the discretion of the Maryland Health Care Commission, this chapter may also apply to third party payers operating in the State of Maryland whose premium volume is $1,000,000 or less. #### Regulation .02 Definitions. *COMAR 10.25.09.02* A. In this chapter, the following terms have the meanings indicated. B. Terms Defined. (1) “Adjudication” means paid, resolved, or settled. (2) “Commission” or “MHCC” means the Maryland Health Care Commission. (3) “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, P.L. No. 104 — 191, 42 U.S.C. Title XI, Part C. (4) “Deputy Director” means the Deputy Director for Data Systems and Analysis at the Maryland Health Care Commission, or the Deputy Director's designee. (5) “Designate” means to select and to enter into a written agreement with. (6) “Designated EHNs” means MHCC-certified EHNs that have been selected by a payer to submit electronic health care transactions under a written service agreement with the payer on behalf of health care practitioners. (7) Electronic health care transactions" means health care transactions that are defined under HIPAA Transaction and Code Set Standards. (8) “Electronic health network (EHN)” means an entity that processes or facilitates processing of electronic transactions in standard or nonstandard formats, between two or more trading partners in the health care community. (9) “MHCC-certified electronic health network” means an entity that has received certifications from the Maryland Health Care Commission. (10) “Health insurance claim” means a submission of a claim to a third-party payer for payment for services rendered by a health care practitioner in Maryland. (11) “Third-party payer” or “payer” means a person that administers or provides reimbursement for health care benefits on an expense-incurred basis, including a: (a) Health maintenance organization issued a certificate of authority in accordance with Health-General Article, Title 19, Subtitle 7, Annotated Code of Maryland; (b) Health insurer or nonprofit health service plan authorized to offer health insurance policies or contracts in this State in accordance with Insurance Article, Title 14, Annotated Code of Maryland; (c) Third-party administrator registered under Insurance Article, Title 14, Annotated Code of Maryland; (d) Specialty payers, such as Pharmacy Benefit Managers (PBMs); or (e) Managed Care Organizations (MCOs) which contract with Maryland Medicaid to provide health services to Medicaid enrollees. #### Regulation .03 EHN Designation. *COMAR 10.25.09.03* A. Payers shall only contract with MHCC-certified EHNs for the exchange of electronic health care transactions that originate in Maryland. B. In the event that a designated EHN loses its MHCC-certified status, the Commission shall provide written notice to the payer of the event. C. Within 60 days from the date of the notice, the payer shall notify the Commission that it is no longer using that EHN for the exchange of electronic health care transactions. #### Regulation .04 Designation Requirements. *COMAR 10.25.09.04* The payer and its designated EHNs shall enter into a written agreement that shall address at minimum each of the following: A. Transaction format specifications; B. Transmission methods to be used; C. Schedules of events, such as transmission cutoffs, acknowledgment requirements, reporting requirements, and scheduled outages, etc; D. Editing requirements and schedules for changes or enhancements; E. Charges and terms of payment; and F. System access security requirements. #### Regulation .05 EDI Progress Report. *COMAR 10.25.09.05* A. On or before June 30 of each year, each payer shall submit to the Commission an EDI Progress Report Form, describing certain electronic health care transaction activity for the payer's previous calendar year as described in this regulation. B. This report shall include: (1) A certification of compliance with Health-General Article, §4-302.1, Annotated Code of Maryland; (2) Health care transactions as defined by HIPAA Transaction and Code Set Standards that are submitted or received by Maryland health care providers; (3) Electronic transaction activity between January 1 and December 31 of the previous year; and (4) The total number of HIPAA electronic transactions submitted or received by Maryland health care providers, as defined in the EDI Progress Report Form. #### Regulation .06 Waiver or Exception Request. *COMAR 10.25.09.06* A. A payer may submit a written request for waiver or exception of the reporting requirements. B. The payer shall: (1) Submit a written request for a waiver or exception to the Deputy Director not later than 30 days before the due date of meeting the reporting/designation requirements; and (2) Explain the reason for the waiver request. C. The Deputy Director shall grant a reasonable request for good cause shown. D. A payer may file a written petition for review of a denial of a waiver. E. The Commission shall review the decision of the Deputy Director. F. The Commission may affirm, reverse, or modify the decision of the Deputy Director after providing the payer with an opportunity to present its position to the Commission. #### Regulation .07 Extension of Time. *COMAR 10.25.09.07* A. A payer may request an extension of time of up to 60 days for submission of the EDI information. B. The payer shall: (1) Submit the request in writing to the Deputy Director for Data Systems and Analysis not later than 30 days before the reporting deadline; (2) Explain the reason for the extension request; and (3) Propose a reasonable date for submission. C. A payer may file a written petition for review of a denial of an extension of time. D. The Commission shall review the decision of the Deputy Director. E. After providing the payer with an opportunity to present its position to the Commission, the Commission may affirm, reverse, or modify the decision of the Deputy Director. #### Regulation .08 Penalties for Failure to File a Report. *COMAR 10.25.09.08* A. Unless the Deputy Director has granted an extension of time, a payer that does not timely file a report is liable for a monetary penalty of $1,000 per day for each day the filing of the report is delayed. B. A report that is substantially incomplete or inaccurate is not timely filed. C. The filing of a written petition for review of a denial of an extension of time stays the accrual of the monetary penalty under §A of these regulations. D. If the Commission affirms the action of the Deputy Director to deny a payer's request for an extension of time, the Commission may impose all penalties in full or in part which, absent the stay, would have accrued during the pendency of the review. E. For substantial reasons shown, the Commission may suspend, reduce, or waive any penalty imposed under this chapter. #### Regulation .09 Penalties for Failure to Contract with a MHCC-Certified EHN. *COMAR 10.25.09.09* A. Unless the Deputy Director has granted an extension of time, a payer that does not contract with an MHCC-Certified EHN within 60 days of notification by MHCC that the EHN is not certified, is liable for a monetary penalty of $1,000 per day. B. The filing of a written petition for an extension of time stays the accrual of the monetary penalty under §A of this regulation. C. If the Commission affirms the action of the Deputy Director to deny a payer's request for an extension of time, the Commission may impose all penalties in full or in part which, absent the stay, would have accrued during the pendency of the review. D. For substantial reasons shown, the Commission may suspend, reduce, or waive any penalty imposed under this chapter. ### Chapter 10 — Maryland Trauma Physician Services Fund **Authority:** Health-General Article, §§19-103(c), 19-130, and 19-207, Annotated Code of Maryland **Administrative History:** Effective date: **Administrative History:** Regulations .01 — .16 adopted as an emergency provision effective July 1, 2003 (30:19 Md. R. 1327); adopted permanently effective December 22, 2003 (30:25 Md. R. 1846) **Administrative History:** Regulations .01 — .16 repealed and new regulations .01 — .17 adopted as an emergency provision effective July 1, 2006 (33:21 Md. R. 1672); adopted permanently effective October 23, 2006 (33:21 Md. R. 1676) **Administrative History:** Regulations .01 — .17 repealed and new regulations .01—.19 adopted effective June 15, 2009 (36:12 Md. R. 837) **Administrative History:** Regulation .01 amended effective January 20, 2025 (52:1 Md. R. 18) **Administrative History:** Regulation .02B amended effective January 20, 2025 (52:1 Md. R. 18) **Administrative History:** Regulation .03B amended effective January 20, 2025 (52:1 Md. R. 18) **Administrative History:** Regulation .04 amended effective January 20, 2025 (52:1 Md. R. 18) **Administrative History:** Regulation .05 amended effective January 20, 2025 (52:1 Md. R. 18) **Administrative History:** Regulation .06 amended effective January 20, 2025 (52:1 Md. R. 18) **Administrative History:** Regulation .07 amended effective January 20, 2025 (52:1 Md. R. 18) **Administrative History:** Regulation .08 amended effective January 20, 2025 (52:1 Md. R. 18) **Administrative History:** Regulation .09 amended effective January 20, 2025 (52:1 Md. R. 18) **Administrative History:** Regulation .10 amended effective January 20, 2025 (52:1 Md. R. 18) **Administrative History:** Regulation .11B, C amended effective January 20, 2025 (52:1 Md. R. 18) **Administrative History:** Regulation .12 amended effective January 20, 2025 (52:1 Md. R. 18) **Administrative History:** Regulation .13 amended effective January 20, 2025 (52:1 Md. R. 18) **Administrative History:** Regulation .14A, C amended effective January 20, 2025 (52:1 Md. R. 18) **Administrative History:** Regulation .15 amended effective January 20, 2025 (52:1 Md. R. 18) **Administrative History:** Regulation .16B amended effective January 20, 2025 (52:1 Md. R. 18) **Administrative History:** Regulation .17 amended effective January 20, 2025 (52:1 Md. R. 18) **Administrative History:** Regulation .19 amended effective January 20, 2025 (52:1 Md. R. 18) #### Regulation .01 Scope. *COMAR 10.25.10.01* A. This chapter applies to trauma physicians, trauma health care practitioners, and Maryland Institute for Emergency Medical Services Systems designated trauma centers, Specialty Referral Centers, and rehabilitation hospitals that are affiliated with Maryland Institute for Emergency Medical Services Systems designated trauma centers by common ownership, as defined in Health-General Article, §19-130(a)(3) and (4), Annotated Code of Maryland, that provide trauma care. B. Reimbursement. (1) Trauma physicians or trauma health care practitioners seeking reimbursement for uncompensated care provided to trauma patients shall file a claim pursuant to this chapter to receive reimbursement from the Maryland Trauma Physician Services Fund. (2) Trauma physicians or trauma health care practitioners seeking reimbursement for trauma care provided to trauma patients enrolled in the Maryland Medical Assistance Program at the elevated rate shall comply with special billing requirements pursuant to this chapter. (3) Trauma centers seeking reimbursement for costs of maintaining trauma physicians on-call shall file a claim to receive reimbursement from this Fund. (4) Trauma centers seeking reimbursement for standby costs shall file a claim to receive reimbursement from this Fund. (5) Trauma centers seeking trauma grants shall file an application to receive a grant from this Fund in accordance with a process and guidelines developed by the Maryland Health Care Commission. #### Regulation .02 Definitions. *COMAR 10.25.10.02* A. In this chapter, the following terms have the meanings indicated. B. Terms Defined. (1) “Applicant” means a person or entity eligible to file a claim to receive reimbursement from the Fund. (2) “Commission” means the Maryland Health Care Commission. (3) “Faculty practice plan” means a professional services organization that: (a) Includes physicians; and (b) Is formed to carry out, improve, and supplement the medical education, research, and clinical services program of a medical school. (4) “Fraud” means knowingly and willfully making or causing to be made any false statement or representation of a material fact: (a) In a claim for payment; or (b) In determining eligibility for payments. (5) “Fund” means the Maryland Trauma Physician Services Fund. (6) “HSCRC” means the Health Services Cost Review Commission. (7) “Maryland Trauma Registry” means a clinical trauma registry maintained by MIEMSS that: (a) Monitors and provides information necessary to evaluate major trauma or specialty patient care, outcome, and cost; and (b) Assesses how designated trauma centers and other hospitals comply with the trauma standards, regulations, and protocols. (8) Medicaid. (a) “Medicaid” means the Maryland Medical Assistance Program under Title XIX of the Social Security Act, 42 U.S.C. §1396, et seq. and the Children and Families Health Care Program under Title XXI of §4901 of the Balanced Budget Act of 1997, that provide comprehensive medical and other health-related care for indigent and medically indigent persons. (b) “Medicaid” includes the services provided by a managed care organization under the State waiver program authorized under §1115 of the Social Security Act, 42 U.S.C. §1396n. (9) “Medicaid differential” means the difference in reimbursement between Medicare and Medicaid for trauma services provided by a trauma physician or trauma health care practitioner to a Medicaid trauma patient in a trauma center. (10) “Medicare economic index (MEI)” means the federal Centers for Medicare and Medicaid Services' measure of inflation in the inputs for providing physician services. (11) “MIEMSS” means the Maryland Institute for Emergency Medical Services Systems. (12) On-Call Physician. (a) “On-call physician” means a trauma physician who commits for a specific time period to be available and respond within a certain amount of time, as defined by MIEMSS, to provide care for a trauma patient in the trauma center. (b) “On-call physician” does not include a physician on standby in a trauma center. (13) On-Call Costs. (a) “On-call costs” means the costs to a trauma center to have trauma physicians available and ready to respond to trauma patients within a certain amount of time, as defined by MIEMSS. (b) “On-call costs” does not include standby costs. (14) “On-call services application” means the difference in reimbursement between Medicare and Medicaid for trauma services provided by a trauma physician or trauma health care practitioner to a Medicaid trauma patient in a trauma center. (15) “Reasonable compensation equivalent (RCE)”: (a) Is a methodology established by Medicare to set limits on what a hospital may claim per physician specialty standby hour; and (b) Has the meaning described in 68 FR 45458 (Aug. 1, 2003). (16) Service Period. (a) “Service period” means the time that trauma services are provided from entrance to the trauma center until dismissal or discharge from the trauma center. (b) “Service period” includes a subsequent readmission or outpatient visit to the trauma center, or trauma center-affiliated acute care general hospital, for services that are directly related to the initial trauma injury. (c) “Service period” includes a subsequent admission or outpatient visit to a trauma center-affiliated rehabilitation hospital, or rehabilitation unit of a trauma center. (17) “Specialty referral center” means: (a) The Curtis National Hand Center at Union Memorial Hospital; (b) The Eye Trauma Center at the Wilmer Eye Institute at The Johns Hopkins Hospital; and (c) The Johns Hopkins Health System Burn Program. (18) “Standby costs” means costs to a trauma center for paying physicians to be available on site at the trauma center to treat trauma patients. (19) Trauma Center. (a) “Trauma center” means a hospital designated by the Maryland Institute for Emergency Medical Services Systems (MIEMSS) as: (i) The State primary adult resource center; (ii) A Level I trauma center; (iii) A Level II trauma center; (iv) A Level III trauma center; (v) A pediatric trauma center; or (vi) A specialty referral center as defined in §B(17) of this regulation. (b) “Trauma center” includes a pediatric trauma center that has entered into an agreement with MIEMSS. (20) “Trauma health care practitioner” means a health care practitioner licensed under the Health Occupations Article who provides care in a trauma center-affiliated general acute care hospital or in a trauma center-affiliated rehabilitation hospital during the service period to trauma patients on the Maryland Trauma Registry as defined by the Maryland Institute for Emergency Medical Services Systems (MIEMSS). (21) “Trauma patient” means a patient whose trauma services are documented in the Maryland Trauma Registry. (22) “Trauma physician” means a physician who provides care in a trauma center, trauma center-affiliated general acute care hospital, or in a trauma center-affiliated rehabilitation hospital during the service period to a trauma patient on the Maryland Trauma Registry as defined by the Maryland Institute for Emergency Medical Services Systems (MIEMSS). (23) “Trauma services” means trauma care provided to a trauma patient in a trauma center, trauma center-affiliated general acute care hospital, trauma center-affiliated rehabilitation hospital, or rehabilitation unit of a trauma center. (24) “Uncompensated care” means trauma services provided by a trauma physician or trauma health care practitioner to a trauma patient on the Maryland Trauma Registry who: (a) Has no health insurance, including private health insurance, Medicare Part B coverage, VA health benefits, or CHAMPUS; (b) Is not covered by Workers' Compensation coverage; (c) Is not eligible for Medical Assistance coverage; and (d) Has not paid the full Medicare reimbursement for the trauma care received, even after documented attempts by the trauma physician or trauma health care practitioner to obtain payment. (25) “Uncompensated care shortfall” means the difference in reimbursement between what Medicare pays and what the trauma physician providing care collects from the uncompensated care trauma patient. (26) “Uncompensated services claim” means a CMS 1500 form or an ANSI 837 electronic transaction completed according to Commission specifications and submitted for reimbursement of uncompensated care services. #### Regulation .03 Fund Administration. *COMAR 10.25.10.03* A. The Fund is a special, nonlapsing interest bearing fund that is not subject to State Finance and Procurement Article, §7-302, Annotated Code of Maryland. B. The purpose of the Fund is to subsidize the documented costs: (1) Of uncompensated care incurred by a trauma physician or trauma health care practitioner in providing trauma services to a trauma patient on the Maryland Trauma Registry; (2) Of undercompensated care incurred by a trauma physician or trauma health care practitioner in providing trauma services to an enrollee of the Medicaid Program who is a trauma patient on the Maryland Trauma Registry; (3) Incurred by a trauma center to maintain trauma physicians on-call as required by MIEMSS; (4) Incurred by a trauma center to maintain patient education, equipment, services, systems, and training as required by MIEMSS, for trauma-related care and not otherwise reimbursed; and (5) Incurred by the Commission to administer the Fund and audit reimbursement requests and trauma grants to assure appropriate payments are made from the Fund. C. Administering Agencies. The Commission shall administer the disbursements from the Fund. D. Interest. The interest on the Fund shall be accounted for separately and credited to the Fund, and is not subject to State Finance and Procurement Article, §6-226(a), Annotated Code of Maryland. #### Regulation .04 Source of Fund Revenue. *COMAR 10.25.10.04* A. The Fund consists of motor vehicle registration surcharges paid into the Fund in accordance with Transportation Article, §§13-954(b), and 21-902, Annotated Code of Maryland, and regulations promulgated under that authority, and any other money transferred from the General Fund of the State. B. The Commission shall make reimbursement from the Fund for: (1) On-call costs; (2) Uncompensated care costs; (3) Medicaid differential payments; (4) Standby expenses to an out-of-State pediatric trauma center that has entered into an agreement with the Maryland Institute for Emergency Medical Services Systems; (5) Grants that may cover costs of trauma centers for trauma related expenses, including physician standby, patient education, equipment, services, systems, training, and other MIEMSS-required incremental trauma costs not otherwise reimbursed; and (6) The Commission's administrative expenses including: (a) The adjudication of uncompensated trauma claims; (b) The audit of providers receiving uncompensated care trauma payments, Medicaid trauma payments, and on-call payments; (c) The audit of managed care organizations payments to trauma physicians and trauma health care practitioners; (d) Enhancements of the MIEMSS Trauma Registry; and (e) Commission personnel costs associated with administering the Fund. #### Regulation .05 Who May Request Payment. *COMAR 10.25.10.05* A. A trauma physician or trauma health care practitioner as defined in Regulation .02 of this chapter may request payment under this chapter. B. Medicaid and Uncompensated Care Reimbursement. (1) Trauma Practitioner Services. A faculty practice plan, a physician practice, a trauma center on behalf of the trauma physician or trauma health care practitioner, or an individual trauma physician or individual health care practitioner allowed to bill Medicaid may submit requests for payment for trauma services provided to a Medicaid trauma patient or for uncompensated care trauma services if: (a) Those services are provided to a trauma patient during the service period as defined in this chapter; and (b) The practitioner meets the definition of a trauma physician or trauma health care practitioner under Regulation .02 of this chapter. (2) Emergency Physician Services. (a) The total reimbursement from the Fund to emergency physicians practicing at any one trauma center may not exceed $300,000 annually. (b) An emergency room physician: (i) Is eligible for uncompensated care shortfall payments only; and (ii) May not receive Medicaid differential payments or on-call payments from the Fund. C. On-Call Payments. The following trauma centers may apply for on-call payments: (1) A MIEMSS-designated Level I trauma center or pediatric trauma center; (2) Level II and Level III trauma centers; and (3) The Specialty Referral Centers. D. Standby Payments. An out-of-State pediatric trauma center that has entered into an agreement with MIEMSS may apply for an annual grant to subsidize standby costs. #### Regulation .06 Payments for Medicaid Trauma Patients. *COMAR 10.25.10.06* A. A trauma physician or trauma health care practitioner: (1) Is eligible for payment from the Fund for trauma services provided to a Medicaid trauma patient on the Maryland Trauma Registry on or after July 1, 2024; and (2) May seek reimbursement in accordance with this regulation. B. A trauma physician or trauma health care practitioner providing trauma services to a Medicaid trauma patient during the service period shall be reimbursed at the greater of: (1) The Medicaid routine payment rate; or (2) Up to 100 percent of the current Medicare facility-based payment in the Baltimore carrier locality area. C. To be eligible for the Medicaid differential payment described in §B of this regulation, diagnosis codes shall meet one of the following two conditions: (1) A diagnosis code shall fall between 800.00 — 959.9; or (2) If a diagnosis code does not fall between 800.0 — 959.9, a supplementary classification of external causes of injury and poisoning (E800 — E999) shall appear as a secondary diagnosis code. D. An organization billing on behalf of trauma physicians or trauma health care practitioners eligible for Medicaid differential payments shall designate a trauma service by using the appropriate code in the CPT Modifier field on the electronic claim or on the paper CMS 1500 in accordance with Medicaid claims submission requirements. E. To be eligible for the Medicaid differential payment described in §B of this regulation, the place of service code shall have one of the following values: (1) Appropriate code to indicate “acute care inpatient hospital”; (2) Appropriate code to indicate “outpatient hospital”; (3) Appropriate code to indicate “emergency room”; or (4) Appropriate code to indicate “inpatient rehabilitation hospital”. F. The Maryland Department of Health may apply Medicaid payment rules when adjudicating claims for trauma services to trauma patients. G. The Fund shall transfer to the Maryland Department of Health an amount sufficient to fully cover the State's share of expenditures for Medicaid differential payments for that fiscal year. #### Regulation .07 Payments for Uncompensated Care Patients. *COMAR 10.25.10.07* A. A trauma physician or trauma health care practitioner: (1) Is eligible for payment from the Fund for trauma services provided to uncompensated trauma care patients with an admission date on the Maryland Trauma Registry beginning on or after July 1, 2024; and (2) May seek reimbursement in accordance with this regulation. B. The cost of uncompensated care incurred by a trauma physician or trauma health care practitioner in providing trauma care to a trauma patient as defined in this chapter shall be reimbursed at a rate of up to 100 percent of the current Medicare facility-based payment for a service in the Baltimore carrier locality area, less any amount for trauma physician or trauma health care practitioner services paid by the patient or other third-party payors including, but not limited to, auto insurance, criminal injuries compensation fund, attorneys, or collection agencies, as reported to the Fund on the uncompensated services claim. C. An organization billing on behalf of trauma physicians or trauma health care practitioners eligible for uncompensated care payments shall: (1) Designate a trauma service by appropriate coding of the CPT Modifier on the electronic ANSI 837 transaction or paper CMS 1500 claim in accordance with claims submission requirements; and (2) Include the patient's trauma registry number on the electronic claim or on the CMS 1500. D. Diagnosis Code. (1) Except as provided in §D(2) of this regulation, a diagnosis code shall fall between 800.00 — 959.9. (2) If a diagnosis code does not fall between 800.0 — 959.9, a supplementary classification of external causes of injury and poisoning (E800 — E999) shall appear as a secondary diagnosis code. E. To be eligible for uncompensated care differential payment described in §B of this regulation, the place of service code shall have one of the following values: (1) Appropriate code for “acute care inpatient hospital”; (2) Appropriate code for “outpatient hospital”; (3) Appropriate code for “emergency room”; or (4) Appropriate code for “rehabilitation hospital”. F. The uncompensated services claim shall: (1) Document uncompensated care services not previously claimed under the Fund; (2) Exclude services for trauma patients who have applied for assistance through Medicaid, but who have not received a final eligibility determination; (3) Exclude noncovered services that the trauma physician or trauma health care practitioner provided to trauma patients covered by health insurance; (4) Exclude services for trauma patients covered by health insurance for which the trauma physician or trauma health care practitioner failed to comply with the insurer's coverage rules or claim filing requirements; and (5) Have a date of service on the claim not older than 5 years. G. Uncompensated care services are eligible for reimbursement from the Fund only after a faculty practice plan, a physician practice, a trauma center on behalf of a trauma physician or trauma health care practitioner, an individual trauma physician or an individual trauma health care practitioner has completed its collection efforts using the respective entity's documented policies and procedures. H. Order of Preference. (1) To minimize administrative costs in administering the Fund, the order of preference for the entity submitting an uncompensated services claim is as follows: (a) Faculty practice plan; (b) Physician practice; (c) Trauma physician; (d) Individual trauma health care practitioner. (2) The preference specified in §H(1) of this regulation refers to the submitting entity and not the preference for distributing payments. I. A trauma patient treated at an out-of-State pediatric trauma center that has entered into an agreement with MIEMSS shall be a Maryland resident in order for the trauma physician or trauma health care practitioner to file an uncompensated services application for an uncompensated care shortfall payment. The determination of whether a trauma patient is a Maryland resident shall be based on the trauma patient's demographic information as listed on the Maryland Trauma Registry. J. The uncompensated services claim shall contain the following information: (1) The name and federal tax identification number of the trauma physician or trauma health care practitioner rendering the care; (2) The date of the service; (3) Appropriate codes describing the service; (4) Any amount recovered for the service rendered; (5) The name of the trauma patient; (6) The trauma patient's Maryland Trauma Registry number; (7) Date of the original trauma injury; (8) The diagnosis codes that were treated; (9) The procedure and service codes performed; and (10) Other information requested in the claim. K. The Commission, in consultation with the Health Services Cost Review Commission, may establish a payment rate for uncompensated care incurred by a trauma physician or trauma health care practitioner in providing trauma care to trauma patients that is above the 100 percent of Medicare payment for the service if: (1) The Commission determines that increasing the payment rate above 100 percent of the Medicare payment for the service will address an unmet need in the State trauma system; (2) The source of revenue increases and the projected current uses of the Fund decline; (3) The Commission considers data analyses of trauma care rendered at Maryland trauma centers for CPT codes reimbursed as uncompensated care as reported to the Maryland Medical Care Data Base; and (4) The Commission reports on its intention to increase the payment rate to the Senate Finance Committee and the House Health and Government Operations Committee, at least 60 days before any adjustment to the rate. #### Regulation .08 On-Call Payment. *COMAR 10.25.10.08* A. Eligibility. The Fund will reimburse trauma centers' on-call costs to maintain surgeons on-call in conformance with MIEMSS' regulations at COMAR 30.08.05 — 30.08.14 for the minimum number of trauma physicians required to be on-call. Trauma centers are eligible for on-call payments as follows: (1) The Level I trauma center and pediatric trauma center are eligible for on-call payments for on-call hours provided by trauma specialties designated in §B of this regulation on or after July 1, 2024; (2) Level II trauma centers are eligible for on-call payments for on-call hours provided by trauma specialties designated in §C of this regulation; (3) Level III trauma centers are eligible for on-call payments for on-call hours provided by trauma specialties designated in §D of this regulation; and (4) Specialty Referral Centers are eligible for on-call payments for on-call hours provided by trauma specialties designated in §E of this regulation on or after July 1, 2024. B. To determine the amount of on-call payments to a Level I trauma center or pediatric trauma center from the Fund, the following apply: (1) The cost incurred by a Level I trauma center or pediatric trauma center to maintain trauma surgeons, pediatric trauma surgeons, neurosurgeons, and orthopedic surgeons on-call when a post-graduate resident, who meets MIEMMS’ requirements under COMAR 30.08.05.07, is attending shall be reimbursed at the lesser of a trauma center's actual on-call costs, or up to 60 percent of the reasonable compensation equivalent's hourly rate for the specialty, inflated to the current year by the physician compensation component of the Medicare Economic Index as designated by the Centers for Medicare and Medicaid Services; (2) A Level I trauma center shall be eligible for a maximum 4,380 on-call hours each fiscal year beginning July 1, 2024; and (3) A pediatric trauma center shall be eligible for a maximum 4,380 on-call hours each fiscal year beginning July 1, 2024. C. To determine the amount of on-call payments to a Level II trauma center from the Fund, the following apply: (1) The cost incurred by a Level II trauma center to maintain trauma surgeons, neurosurgeons, and orthopedic surgeons on-call shall be reimbursed at the lesser of a trauma center's actual on-call costs or up to 60 percent of the reasonable compensation equivalent's hourly rate for the specialty, inflated to the current year by the physician compensation component of the Medicare Economic Index as designated by the Centers for Medicare and Medicaid Services; and (2) A Level II trauma center shall be eligible for a maximum 26,280 on-call hours each fiscal year beginning July 1, 2024. D. To determine the amount of on-call payments to a Level III trauma center from the Fund, the following apply: (1) The cost incurred by a Level III trauma center to maintain anesthesiologists, neurosurgeons, orthopedic surgeons, and trauma surgeons on-call shall be reimbursed at the lesser of a trauma center's actual on-call costs or up to 60 percent of the reasonable compensation equivalents hourly rate for the specialty, inflated to the current year by the physician compensation component of the Medicare Economic Index as designated by the Centers for Medicare and Medicaid Services; (2) A Level III trauma center shall be eligible for a maximum 35,040 on-call hours each fiscal year beginning July 1, 2024. E. To determine the amount of on-call payments to a Specialty Referral Center from the Fund, the following apply: (1) The cost incurred by a Specialty Referral Center to maintain trauma surgeons on-call for the Johns Hopkins Health System Burn Program shall be reimbursed at the lesser of the trauma center's actual on-call costs or up to 60 percent of the reasonable compensation equivalent's hourly rate for the specialty, inflated to the current year by the physician compensation component of the Medicare Economic Index as designated by the Centers for Medicare and Medicaid Services; (2) The cost incurred by a Specialty Referral Center to maintain trauma surgeons on-call for the Eye Trauma Center at the Wilmer Eye Institute at The Johns Hopkins Hospital, the cost incurred to maintain ophthalmologists on-call shall be reimbursed at the lesser of the trauma center's actual on-call costs or up to 60 percent of the reasonable compensation equivalent's hourly rate for the specialty, inflated to the current year by the physician compensation component of the Medicare Economic Index as designated by the Centers for Medicare and Medicaid Services; (3) The cost incurred by a Specialty Referral Center to maintain trauma surgeons on-call for the Curtis National Hand Center at Union Memorial Hospital, shall be reimbursed at the lesser of the trauma center's actual on-call costs or up to 60 percent of the reasonable compensation equivalent's hourly rate for the specialty, inflated to the current year by the physician compensation component of the Medicare Economic Index as designated by the Centers for Medicare and Medicaid Services; and (4) A Specialty Referral Center trauma center shall be eligible for a maximum 2,190 hours of trauma on-call per fiscal year, beginning July 1, 2024. F. The trauma center shall apply for payment from the Fund by submitting a semiannual on-call services application within 30 days after the end of the reporting cycle. G. The on-call services application shall list on-call costs paid to trauma physicians at the trauma center during the reporting cycle. The on-call services application shall contain the following information: (1) The name and trauma level of the trauma center; (2) The name of each trauma physician providing on-call coverage; (3) The specialty of each trauma physician providing on-call coverage; (4) The amount of time available on-call for each physician; (5) The amount paid in on-call stipends to each physician; and (6) Any other information required by the Commission to validate the claim. H. The Commission may increase the hours and percent of RCE specified in this regulation in accordance with Health General § 19-130, Annotated Code of Maryland. #### Regulation .09 Payment for Costs at a Pediatric Center. *COMAR 10.25.10.09* A. The pediatric trauma centers listed below shall be eligible for an annual grant of up to $900,000 for documented expenses related to the provision of trauma care to Maryland residents: (1) Johns Hopkins Children’s Center; and (2) Children’s National Medical Center. B. Pediatric trauma centers shall submit an application for documented expenses incurred in the previous fiscal year using guidelines developed by the Health Services Cost Review Commission. C. The pediatric trauma center shall submit the application for its previous fiscal year to the Commission within 45 days after the end of that fiscal year. #### Regulation .10 Trauma Equipment Grants. *COMAR 10.25.10.10* A. Eligibility. (1) The Commission, in consultation with the Health Services Cost Review Commission and the Maryland Institute for Emergency Medical Services Systems, shall develop a process for the award of grants to Level I, Level II and Level III trauma centers to be used in the delivery of trauma care. (2) The process developed by the Commission for the award of grants shall include: (a) Grant applications and review and selection criteria for the award of grants; (b) Review by the Commission, if necessary, for any project that exceeds Certificate of Need thresholds; and (c) Any other procedure determined necessary by the Commission. B. The Commission may issue grants from any balance carried over to the Fund from prior fiscal years. C. The total amount of grants awarded in a fiscal year may not reduce the balance remaining in the Fund at the end of the fiscal year to less than 15 percent of the revenue collected in that fiscal year. D. Before awarding grants under this regulation in a fiscal year, the Commission shall report to the Senate Finance Committee and the House Health and Government Operations Committee on the process that the Commission has developed for awarding grants in that fiscal year. #### Regulation .11 Equitable Payment Under the Fund. *COMAR 10.25.10.11* A. Disbursement from the Fund is subject to the availability of funds. B. The Commission shall adjust reimbursement formulas used for Medicaid trauma services, uncompensated care trauma services, on-call payments, and standby payments to a pediatric trauma center to preserve the distribution of monies in the Fund. C. Revenue; Payments. (1) On or before May 1 of each year, the Commission shall determine appropriate levels of payment that can be sustained for the upcoming fiscal year beginning July 1, given the expected revenue in the Fund. (2) If expected revenue in the Fund is insufficient to meet expected payments, the Medicaid differential payments, uncompensated care shortfall payments, trauma center on-call payments, and standby payments to a pediatric trauma center shall be adjusted by the same rate to maintain solvency in the Fund. (3) The Commission shall maintain a sufficient balance in the Fund to assure equitable payments across a fiscal year. (4) If Fund payments require adjustment, the Commission shall report to the trauma centers and the trauma physicians listed on trauma center rosters the expected payment levels for the upcoming State fiscal year by June 30. D. If the Commission estimates that operating shortfalls will occur during a fiscal year and that those shortfalls will be sufficiently large that the annual update process cannot be used, the Commission shall use the following conventions: (1) On-call payments for the next semiannual reporting period shall be adjusted to preserve solvency in the Fund; (2) Priority for meeting the funding needs of Level III trauma centers to maintain physicians shall be maintained; (3) The Commission may not change Medicaid reimbursement during a fiscal year, unless a 4-month notice is provided to the Medicaid program and the uncompensated care and on-call payments have already been halted; and (4) The Commission shall adjust Medicaid reimbursements during subsequent annual update processes to adjust for any inequities that arise due to implementation of §D(3) of this regulation during the preceding fiscal year. #### Regulation .12 Filing of On-call Applications and Uncompensated Care Claims. *COMAR 10.25.10.12* A. In order to receive a payment from the Fund for uncompensated care, a faculty practice plan, a physician practice, a trauma physician, a trauma health care practitioner, or a trauma center on behalf of a trauma physician or trauma health care practitioner shall submit a timely and complete uncompensated services claim that includes the information required in this chapter on a form and in a manner approved by the Commission as indicated in the application. B. In order to receive a payment from the Fund for on-call costs, a faculty practice plan, a physician practice, a trauma physician, or a trauma center on behalf of a trauma physician, shall submit a timely and complete on-call services application that includes the information required in this chapter on a form and in a manner approved by the Commission as indicated in the application. C. A faculty practice plan, a physician practice plan, a trauma center, or a trauma physician that does not file an on-call services application within the time frame specified is not eligible for participation in the Fund for that time period. D. An on-call services application that is substantially incomplete or inaccurate may be considered not filed. #### Regulation .13 Audits. *COMAR 10.25.10.13* A. The Commission, or its designee, may audit to verify the information submitted by faculty practice plans, physician practices, trauma physicians, trauma health care practitioners, and trauma centers applying for grants or reimbursement from the Fund. B. The Commission, or its designee, may perform on-site audits. C. A person who has submitted an application for a grant or reimbursement from the Fund shall provide the Commission, or its designee, with access to all information, documents, and facilities requested by the Commission, or its designee, for purposes of auditing the person’s application. D. Information discovered by the audit process indicating that an application for payment from the Fund was improperly paid may result in remedial action being taken, including but not limited to, denial or partial denial of future payments from the Fund, referral to the State of Maryland, Central Collections Unit, or other appropriate action. #### Regulation .14 Appeals. *COMAR 10.25.10.14* A. The Commission's executive director, or designee, shall review any appeal from an audit finding, a denial, or partial denial, of an uncompensated care shortfall payment, an on-call payment or grant award. B. To secure review of an audit finding, denial, or partial denial, an applicant shall file a written appeal of the denial with the Commission, together with any supporting memoranda and documentation, within 15 days of the date of receipt of audit finding, the denial, or the partial denial, from the Fund. C. In reviewing an audit finding, a denial, or a partial denial, of an uncompensated care shortfall payment, on-call payment or grant award, the executive director, or designee, shall consider all relevant factors and render a decision upon the written information, without an oral hearing, in a timely fashion. The executive director, or designee, may seek and consider further information from the applicant or supplementation of the application, if necessary or appropriate. #### Regulation .15 Annual Reconciliation Reporting Requirements. *COMAR 10.25.10.15* A. On or before January 31 of each year, a trauma physician or trauma health care practitioner who has received uncompensated care reimbursement from the Fund during the prior calendar year shall file an annual reconciliation report with the Commission. B. The annual reconciliation report shall include: (1) The name, address, and telephone number of the practitioner, practice, or center; (2) The name, address, and telephone number of the practitioner, practice, or center's contact person for the report; (3) The name of the trauma center where care was provided; (4) The amount of money recovered from another payer source for claims that had been reimbursed by the Fund, including: (a) The practitioner's name providing the care; (b) The patient's name, Trauma Registry number, Social Security number, dates of service, and total amount paid by the Trauma Fund; (c) The source of the additional funds received; (d) The amount of the other payment received; and (e) The amount returned to the Trauma Fund; and (5) A certification by an authorized designee of the practitioner, practice, or center that the facts stated in the annual reconciliation report are true and accurate. #### Regulation .16 Prohibited Acts. *COMAR 10.25.10.16* A. An applicant for payment from the Fund may not: (1) Make, or cause to be made, a false statement or false claim; or (2) Engage in fraud in submitting a claim or application. B. Violation of §A of this regulation may result in: (1) Referral to the appropriate Medicaid fraud administrative and prosecutorial authorities, to the Office of the State's Attorney, or both; (2) Rescission of, or an action for recovery of, any prior reimbursement improperly made by the Fund; and (3) Any other appropriate referrals or administrative action. #### Regulation .17 Reporting Requirements to the General Assembly. *COMAR 10.25.10.17* On or before November 1 of each year, the Commission and the HSCRC shall report to the General Assembly in accordance with Health-General Article, §19-130(f) and State Government Article, §2-1246, Annotated Code of Maryland. #### Regulation .18 Expiration of Fund. *COMAR 10.25.10.18* A. This chapter remains in effect unless the Fund ceases to be funded or expires by operation of law. B. In the event the Fund ceases to operate, unless otherwise provided by law, the Fund shall make any final disbursements for the current reporting period based upon available funds. #### Regulation .19 Effective Date. *COMAR 10.25.10.19* Trauma services provided by a trauma health care practitioner to a trauma patient on or after July 1, 2024, are eligible for reimbursement pursuant to the provisions set forth in this chapter. ### Chapter 11 — Institutional Review Board **Authority:** Health-General Article, §§19-109(a)(1) and (7) and (b)(5), 19-103(c)(3), and 19-133(d), Annotated Code of Maryland **Administrative History:** Effective date: March 8, 1999 (26:5 Md. R. 391) **Administrative History:** Regulation .01 amended effective October 14, 2002 (29:20 Md. R. 1589) **Administrative History:** Regulation .01A amended effective August 22, 2011 (38:17 Md. R. 1013) #### Regulation .01 Scope. *COMAR 10.25.11.01* A. This chapter provides one method by which the Commission may consider requests for encounter level data from the Maryland medical care data base and any other Commission data base that contains data elements that qualify as “individually identifiable health information”, as defined in the Health Insurance Portability and Accountability Act of 1996, P.L. 104-191 (1996). The Commission may also use another recognized Institutional Review Board to consider requests for encounter level data from the Maryland medical care data base or any other requests for Commission information that require consideration by an Institutional Review Board. B. This chapter does not apply to: (1) Requests for information from the Maryland medical care data base or any other Commission data base considered public under applicable laws and regulations; or (2) Internal activities of the Commission that are required for it to conduct its lawful business of assembling the Maryland medical care data base, or any other data base that it is authorized to create, and performing research. #### Regulation .02 Definitions. *COMAR 10.25.11.02* A. In this chapter, the following terms have the meanings indicated. B. Terms Defined. (1) “Application” means a request for information made pursuant to this chapter. (2) “Commission” means the Maryland Health Care Access and Cost Commission. (3) “Data base” means the Maryland medical care data base established at Health-General Article, §19-1507, Annotated Code of Maryland. (4) “IRB” means the Institutional Review Board. (5) “Personal records” has the meaning set forth in State Government Article, §10-624, Annotated Code of Maryland. #### Regulation .03 IRB Membership. *COMAR 10.25.11.03* A. The Commission shall appoint the IRB. B. The IRB shall consist of at least nine members of which: (1) Each member shall have expertise in health services research and information security; and (2) At least one member's primary expertise is ethics. C. The IRB shall be sufficiently qualified through the experience and diversity of its members, including consideration of race, gender, and cultural backgrounds, and sensitivity to such issues as community attitudes to promote respect for its advice and counsel. D. Commission members and Commission staff may not serve on the IRB. Commission staff may provide staff support to the IRB. E. The Commission shall solicit recommendations for appointment to the IRB from organizations and institutions whose mission is related to IRB matters, as the Commission considers appropriate. F. Members shall serve on a volunteer basis for a term not to exceed 3 years. A member may be reappointed. G. The Commission may remove a member for: (1) Misconduct; or (2) Dereliction of duty. #### Regulation .04 IRB Review of Applications. *COMAR 10.25.11.04* A. The IRB shall review all applications submitted pursuant to this chapter. B. The IRB shall recommend: (1) Approval, disapproval, or termination; or (2) Modifications in research or security to secure approval. C. The IRB shall meet as necessary in order to provide timely responses to requests for information. D. Requests for information within the scope of this chapter shall include a description of the: (1) Research use to be made of the information; (2) Intent, if any, to present or publish the findings; (3) Nature of the requested information; (4) Safeguards and procedures that the applicant will take to protect the identity of the data; and (5) A description of any potential risks or benefits. E. Upon receipt of an application within the scope of this chapter, the Commission shall immediately forward the request and all supporting documentation to the IRB for a recommendation. F. The IRB shall require an applicant to provide any: (1) Documentation necessary to satisfy itself that the security of the released data will be preserved; and (2) Information necessary to assist the IRB in making a decision on an application. G. The IRB shall make a timely recommendation concerning release of the requested information. H. An IRB recommendation shall be made on the basis of a majority of the full IRB membership. I. If the IRB denies an application, the IRB shall inform the applicant promptly in writing of the reasons for denial. J. Deliberations. (1) In conducting its deliberations, the IRB shall be mindful of conflicts of interest and the appearance of conflict. (2) IRB members with an actual or apparent conflict concerning a particular application shall recuse themselves from deliberating and voting upon that application. #### Regulation .05 Criteria for Approval. *COMAR 10.25.11.05* The IRB shall recommend approval of an application only if: A. It is satisfied that: (1) The use proposed to be made of the requested information is in the public interest, (2) The risks of release of the requested information are reasonable in relation to the anticipated benefits, and (3) Safeguards adequate to prevent inappropriate disclosures will be implemented by the applicant; and B. The applicant agrees to comply with the requirements of Regulation .12 of this chapter. #### Regulation .06 Commission Review of IRB Recommendations. *COMAR 10.25.11.06* A. The Commission shall review: (1) All IRB recommendations for approval of applications; and (2) IRB denials of applications only for good cause shown by the applicant, which shall consist of evidence demonstrating that the IRB failed to follow the process set forth in this chapter. B. In order to secure Commission review of an IRB denial, an applicant shall file an appeal of the denial with the Commission, together with any supporting memoranda and documentation, within 15 days of the date of receipt of the IRB denial. C. In reviewing an IRB recommendation, the Commission shall consider all relevant factors and render its decision in a timely fashion. In reviewing an IRB recommendation to deny an application, the Commission shall affirm the IRB's decision or, if the evidence warrants, remand the case to the IRB for further consideration. In remanding the matter to the IRB, the Commission shall inform the IRB of the basis for its decision and instruct the IRB concerning any remedial measures which the IRB must take on remand. D. A request for data from the data base is not a contested case under the Administrative Procedure Act. #### Regulation .07 Expedited Review Procedures. *COMAR 10.25.11.07* A. The IRB may use an expedited review procedure to review applications relating to minor changes to already approved information requests. B. Under an expedited review procedure, the review shall be carried out by: (1) The chairperson of the IRB; or (2) An IRB member designated by the chairperson. C. In reviewing the application under an expedited process, the reviewer shall exercise all of the authority of the IRB, except that the reviewer may not disapprove an application. D. An application shall be disapproved only after review in accordance with the nonexpedited procedure set forth in Regulation .04 of this chapter. E. Under an expedited review, Commission approval of an IRB recommendation shall be made only by vote of a majority of the full Commission. #### Regulation .08 Suspension or Termination of IRB Approval. *COMAR 10.25.11.08* A. The Commission shall require an applicant to file periodic progress reports concerning any aspect of the use of data released under this chapter. B. The Commission may: (1) Investigate use made of data released under this chapter; and (2) Require an applicant to provide information necessary to assist the Commission in its investigation. C. The Commission may delegate the function listed in §B of this regulation to the IRB. D. If an applicant fails to make use of the data in accordance with IRB requirements, including IRB data security and confidentiality requirements, the Commission, at the recommendation of the IRB or on its own motion, may: (1) Immediately suspend or terminate its approval of the data release; and (2) Require the applicant to: (a) Return to the Commission, or (b) Destroy previously released data. E. The applicant is entitled to a post-suspension or termination hearing in front of the IRB to show cause why the suspension or termination should be rescinded. Following the hearing, the IRB shall make a recommendation to the Commission concerning reinstatement of the applicant's use of the information. #### Regulation .09 Cooperative Research Activities. *COMAR 10.25.11.09* Data release to a party with which the Commission has contracted pursuant to the State procurement process may not be referred to the IRB. However, other cooperative research activities involving data within the scope of this chapter shall be referred to the IRB for its opinion and recommendation. #### Regulation .10 IRB Records. *COMAR 10.25.11.10* A. The IRB shall maintain the following records: (1) Minutes of all IRB meetings describing: (a) Time and date of the meetings; (b) Members present; (c) Actions taken; (d) Votes on the actions including the number: (i) Voting for; (ii) Voting against; and (iii) Abstaining; (e) The basis for requiring changes in or disapproving research; and (f) A discussion of controverted issues and their resolution; (2) Minutes which shall include: (a) Copies of all applications, supporting documentation, related correspondence, and progress reports; (b) Records of continuing review activities; (c) A list of IRB members and current curriculum vitae sufficient to demonstrate the IRB members' areas of expertise and current employment or consultant relationships and board memberships; and (d) Any written procedures or bylaws adopted by the IRB. B. The IRB shall adhere to the record retention guidelines applicable to the Commission. #### Regulation .11 Completion of Research Activities. *COMAR 10.25.11.11* Upon completion of research conducted with data released under this chapter, the applicant, at the IRB's discretion, shall: A. Destroy or return to the Commission all data and copies of data obtained from the Commission; and B. Provide to the Commission and the IRB a copy of any report, article, paper, or other document prepared by the applicant with use of the released data. #### Regulation .12 Contract Provisions and Penalties. *COMAR 10.25.11.12* As a prerequisite for release of any information under this chapter, the applicant shall enter into an agreement with the Commission which: A. Defines the scope of the use to be made of the released information; B. Provides for safeguards for protecting the identity of data; C. States that a breach of any condition of the agreement is a breach of contract; D. Provides for the return or destruction of data upon a determination of breach of contract by the Commission; and E. Authorizes the Commission to seek all other appropriate remedies for breach of contract. ### Chapter 12 — Imposition of Fines **Authority:** Health-General Article, §§19-109(a)(1) and (7)and 19-116(b)(1) and (2), Annotated Code of Maryland **Administrative History:** Effective date: December 23, 2002 (29:25 Md. R. 1984) #### Regulation .01 Assessment of Fines. *COMAR 10.25.12.01* A. Except as provided in §B of this regulation and unless the Executive Director or the Executive Director's designee has granted an extension of time, a party that fails to timely file a report or other information required by the Commission may be liable for a monetary penalty, not to exceed $1,000 per day, for each day the filing of the report is past due. B. For information required by the Commission pursuant to Health-General Article, §19-116(b), Annotated Code of Maryland, and unless the Executive Director or the Executive Director's designee has granted an extension of time, a party that fails to timely file a report or other information required by the Commission may be liable for a monetary penalty, not to exceed $100 per day, for each day the filing of the report is past due. C. A data report that is substantially incomplete or inaccurate is not timely filed. D. The filing of a written petition for review of a denial of an extension of time stays the accrual of the monetary penalty levied under §§A and B of this regulation. #### Regulation .02 Process for Levying and Appealing an Assessment. *COMAR 10.25.12.02* A. The Executive Director shall determine the amount assessed pursuant to this chapter by considering the factors set forth in Regulation .03. B. The Executive Director shall issue a notice of assessment to a party found to have filed untimely or inaccurate information, explaining the basis for the assessment. C. A party assessed a fine has 10 business days from the date of receipt of the assessment to appeal the assessment to the Commission. D. Upon receipt of an appeal, the Chairman of the Commission may: (1) Schedule a date for hearing the appeal before the full Commission; or (2) Appoint a commissioner to act as a hearing officer. E. Commission staff may participate in the hearing. F. If the Chairman appoints a commissioner as a hearing officer, the hearing officer shall issue a proposed decision containing proposed findings of fact and conclusions of law. G. Parties may file exceptions to the hearing officer's proposed decision with the full Commission. H. Exceptions shall identify specific aspects of the proposed decision with which the excepting party disagrees and explain the basis of the disagreement with specific citation to the record or applicable law. I. The full Commission shall entertain oral argument on exceptions and issue a final decision. J. All hearings shall be conducted in accordance with the procedural requirements of State Government Article, Title 10, Subtitle 2, Annotated Code of Maryland. #### Regulation .03 Factors Considered in the Assessment of Penalties. *COMAR 10.25.12.03* A. The Commission shall consider the following factors in determining whether to impose a fine and the amount of any fine: (1) The willfulness of the improper conduct; (2) The extent of actual or potential public harm caused by the violation; (3) The cost of auditing or investigating the matter; and (4) The party's history of any previous violation. B. The Commission may suspend or waive any fine for reporting of inaccurate data if the party that filed the inaccurate data reports and corrects the inaccuracies in a timely manner. ### Chapter 13 — Health Information Technology Funding Applications **Authority:** Health-General Article, §19-103(c)(2), Annotated Code of Maryland **Administrative History:** Effective date: December 18, 2006 (33:25 Md. R. 1951) #### Regulation .01 Applicability. *COMAR 10.25.13.01* This chapter applies to the consideration, by the Maryland Health Care Commission, of an application seeking approval for funding that is responsive to an announcement posted by the Maryland Health Care Commission that it will accept applications regarding one or more specified areas of health information technology. #### Regulation .02 Definitions. *COMAR 10.25.13.02* A. In this chapter, the following terms have the meanings indicated. B. Terms Defined. (1) “Applicant” means a person, partnership, firm, association, institution, limited liability company, limited liability partnership, public or private corporation or agency, and shall include at least one rate-regulated hospital, or combination of them. (2) “Approval for funding” means a determination made by the Health Services Cost Review Commission that it will approve an adjustment to hospital rates based on review of an application and recommendation for funding made by the Maryland Health Care Commission for an activity or program proposed by an applicant. (3) “Maryland Health Care Commission (MHCC)” means the agency established by Health-General Article, Title 19, Subtitle 1, Annotated Code of Maryland. (4) “Health Services Cost Review Commission (HSCRC)” means the agency established by Health-General Article, Title 19, Subtitle 2, Annotated Code of Maryland. #### Regulation .03 Notice of Acceptance of Applications for Funding for Health Information Technology Initiative. *COMAR 10.25.13.03* The Maryland Health Care Commission shall inform potential applicants that it will accept applications seeking approval for funding regarding one or more specified areas of health information technology, by posting an announcement on the MHCC website that includes, but is not limited to, the following: A. Each specific topic to be addressed; B. Required elements; C. Application deadline; D. Application review criteria; E. Method of review; F. Available funding for each application; and G. The maximum number of applications for which funding will be recommended. #### Regulation .04 Review of Applications. *COMAR 10.25.13.04* A. The executive director of the Maryland Health Care Commission: (1) Shall review each application submitted pursuant to this chapter; and (2) May seek the assistance of others in the review. B. The executive director shall forward the results of the review to the Maryland Health Care Commission for its consideration. #### Regulation .05 MHCC Recommendation to the HSCRC; Action by the HSCRC. *COMAR 10.25.13.05* A. The Maryland Health Care Commission shall: (1) Determine which applications merit consideration of approval for funding by the Health Services Cost Review Commission; and (2) For each application recommended for consideration, send to the HSCRC appropriate information that may include the following: (a) A summary of the review criteria and scoring for each recommended application; and (b) A recommended priority order for funding. B. The Health Services Cost Review Commission shall make the final decision on each MHCC-recommended application approved for funding. C. Any funding approved by the HSCRC shall be implemented through reasonable rate adjustments as determined by the HSCRC. ### Chapter 14 — Health Care Data Collection from Maryland Health Care Practitioners **Authority:** Health-General Article, §19-133(b) and (d)(1), Annotated Code of Maryland **Administrative History:** Effective date: November 17, 2008 (35:23 Md. R. 2013) #### Regulation .01 Applicability. *COMAR 10.25.14.01* This chapter applies to the collection of health care data, by the Maryland Health Care Commission, from health care practitioners in the State. #### Regulation .02 Definitions. *COMAR 10.25.14.02* A. In this chapter, the following terms have the meanings indicated. B. Terms Defined. (1) “Health care” means any care treatment, or procedure by a healthcare practitioner: (a) To diagnose, evaluate, rehabilitate, manage, treat, or maintain the physical or mental condition of a patient; or (b) That affects the structure or any function of the human body. (2) “Health care practitioner” means an individual who is licensed or certified under the Health Occupations Article to provide health care in the State. #### Regulation .03 Information to be Collected. *COMAR 10.25.14.03* The Commission may collect the following data from a health care practitioner: A. Data that indicate the nature of the health care practice in which the health care practitioner is engaged; B. Data that indicate whether the health care practitioner is actively engaged in the practice of health care; C. Data that indicate whether the health care practitioner is currently engaged in direct patient care in the State; D. Data that indicate the health care practitioner's primary language, race, and ethnicity; E. Data that describe the health care practitioner's areas of specialty, including: (1) Specialty qualifications or training; (2) Specialty certification, licensure, or status; and (3) Current areas of concentration; F. Data that identify the number and location of a health care practitioner's practice locations; G. Data that indicate whether the health care practitioner provides primary or preventive care services, or both, in Maryland; H. Data that indicate the nature and extent of the practitioner's use of information technology in the diagnosis and treatment of patients; I. Data that indicate whether the health care practitioner accepts or treats patients who are covered by Maryland Medical Assistance or Medicare; and J. Data that indicate whether the health care practitioner provides care to low-income patients and, if so, the nature of the compensation received for that care. #### Regulation .04 Confidentiality of Information Collected. *COMAR 10.25.14.04* Information collected by the Commission that is required by law to be held confidential may not be disclosed by the Commission to other persons or entities. ### Chapter 15 — Management Service Organization State Designation **Authority:** Health-General Article, §§4-302, 19-103(c)(2)(i) and (ii), 19-109(a)(1), 19-135(a), (b), and (d), and 19-143(h), Annotated Code of Maryland **Administrative History:** Effective date: November 15, 2010 (37:23 Md. R. 1610) **Administrative History:** Regulations .01 — .11 repealed and new Regulations .01 — .08 adopted effective August 18, 2014 (41:16 Md. R. 946) #### Regulation .01 Scope. *COMAR 10.25.15.01* This chapter applies to the State designation of management service organizations. Only a management service organization that is awarded State Designation status by the Maryland Health Care Commission pursuant to this chapter may represent itself as a State-Designated management service organization. #### Regulation .02 Definitions. *COMAR 10.25.15.02* A. In this chapter, the following terms have the meanings indicated. B. Terms Defined. (1) “Commission” or “MHCC” means the Maryland Health Care Commission. (2) “Electronic health record” or “EHR” means a complete electronic record system that: (a) Contains health-related information on one or more individuals; and (b) Is certified by an authorized testing and certification body designated by the Office of the National Coordinator for Health Information Technology. (3) “Entity” means an individual, trust or estate, general or limited partnership, joint stock company, unincorporated association or society, municipal or other corporation, incorporated association, limited liability partnership, limited liability company, the State, an agency or political subdivision of the State, a court, and any other governmental body. (4) “Executive Director” means the Executive Director of the Commission. (5) “Management service organization” or “MSO” means an entity that provides technology and consultative services to health care providers, and makes available one or more hosted electronic health records systems and other health information technology solutions. (6) “MSO State Designation certificate” means a certificate provided to the MSO by the Commission that documents award of State Designation. (7) “MSO State Designation criteria” means the standards published by the Commission on its website and by notice in the Maryland Register that an MSO must meet to qualify for State Designation. (8) “State Designation” or “State-Designated” means the status awarded by the Commission to an MSO that has met the MSO State Designation criteria required under this chapter. #### Regulation .03 Procedure for Initial State Designation. *COMAR 10.25.15.03* A. Application. (1) An entity seeking MSO State Designation shall submit an application in a form and manner specified by the Commission. (2) The application shall be signed by an individual authorized by the entity submitting the application. B. Requirements for State Designation. An applicant for MSO State Designation shall: (1) Demonstrate that it meets all MSO State Designation criteria in effect at the date of application; (2) Affirm that the applicant, a related entity, or a person or entity that is a principal, owner, operator, or part of management of the entity has never: (a) Pleaded guilty to, been convicted of, or received probation before judgment or similar diversionary disposition for a crime related to the operation of an MSO or for a crime involving fraud, dishonesty, or false dealing; or (b) Been found in violation of State or federal laws or regulations governing the operation of an MSO; (3) Provide all required documentation; (4) Timely provide additional information requested by the Commission as needed to complete the application; and (5) Agree to comply with the requirements of this chapter. C. Review of Applications. (1) Commission staff shall review an application to determine compliance with the State Designation criteria. (2) The Executive Director may approve or deny an application for State Designation, as follows: (a) The Executive Director shall award State Designation to an MSO that meets the requirements set forth in this chapter; and (b) If the Executive Director determines that an application should be denied, the Executive Director shall, within 30 days of receipt of a complete application, notify the applicant in writing of the decision, and include the reasons for denial. D. Duration of State Designation. (1) State Designation is valid for 2 years from the date of issuance of an MSO State Designation certificate, unless suspended or revoked by the Commission. (2) An MSO awarded State Designation shall accept the designation in writing and agree to the comply with the requirements of this chapter. #### Regulation .04 Procedure for Renewal of State Designation. *COMAR 10.25.15.04* A. An application for renewal of State Designation shall: (1) Be made at least 30 days before the expiration of the State Designation in a form and manner specified by the Commission; and (2) Demonstrate compliance with the MSO State Designation criteria in effect at the date of application for renewal. B. Commission staff shall review a renewal application to determine compliance with the State Designation criteria. C. The Executive Director may approve or deny an application for renewal. D. The Executive Director shall renew the State Designation of each MSO that meets the requirements set forth in this chapter. E. If the Executive Director determines that a renewal application should be denied, the Executive Director shall, within 30 days of receipt of a complete application for renewal, notify the applicant in writing of the decision, supported by reasons for denial. #### Regulation .05 Denial of an Initial or Renewal Application. *COMAR 10.25.15.05* A. An MSO whose initial or renewal application was denied may seek Commission review of the denial. B. A written request for Commission review of the denial of an application shall:. (1) Be filed within 20 days of the receipt of the denial; (2) State with particularity the grounds and factual basis for the applicant’s disagreement with the denial; and (3) Be supported by relevant documentation and affidavits. C. The Commission may determine whether or not to affirm the denial of the application or approve the application: (1) After considering the written filing by the MSO and any response by Commission staff; or (2) After hearing oral arguments on the written filings by the MSO and staff. #### Regulation .06 Nontransferability of Designation. *COMAR 10.25.15.06* State Designation issued pursuant to this chapter may not be sold, assigned, leased, or transferred in any way. #### Regulation .07 Closure, Sale, or Transfer of All or Part of a State-Designated MSO. *COMAR 10.25.15.07* A. At least 60 days before the closure, sale, lease, assignment, or transfer of all or part of a State-Designated MSO to any person or entity that was not identified as an owner of the MSO at the time of the most recent certification by the Commission, the State-Designated MSO shall notify the Commission of the impending closure, sale, lease, assignment, or transfer of the State-Designated MSO and timely provide information required or requested by the Commission. B. If all or part of a State-Designated MSO is closed, sold, leased, assigned, or transferred in any person or entity that was not identified as an owner of the MSO at the time of the most recent certification by the Commission, the Commission shall review current State Designation status pursuant to the renewal requirements set forth in Regulation .04 of this chapter. #### Regulation .08 Commission Oversight of State-Designated MSOs. *COMAR 10.25.15.08* A. Commission staff may, on its own initiative or in response to information provided to the Commission, investigate any State-Designated MSO or applicant for State Designation. B. Following an investigation, the Executive Director may issue a notice of proposed action, which may include the following: (1) A time-limited opportunity to correct deficiencies identified by the investigation; (2) Suspension of the State Designation of an MSO for a definite period of time after which, depending upon the circumstances of the case and completion of appropriate corrective actions, the MSO may seek reinstatement of its State Designation; or (3) Revocation of State Designation. C. An MSO that receives a notice of proposed action from the Executive Director may request an opportunity to show cause why the proposed action should not be implemented. A written request to show cause shall be filed with the Commission within 20 days of the issuance of the notice of proposed action and shall: (1) State with particularity the grounds and factual basis for the applicant’s disagreement with the denial; (2) Include each fact upon which the person relies to show cause why the proposed action should not be taken; and (3) Be supported by relevant documentation and affidavits. D. The Commission may determine whether or not to impose the proposed action or a different action: (1) After considering the written show cause filing by the MSO and any response by Commission staff; or (2) After hearing oral arguments on the written filings by the MSO and staff. ### Chapter 16 — Electronic Health Record Incentives **Authority:** Health-General Article, §§19-103(c)(2)(i) and (ii), 19-109(a)(1), and 19-143(d)(1), (2), (3), and (4) and(i), Annotated Code of Maryland **Administrative History:** Effective date: May 16, 2011 (38:10 Md. R. 615) **Administrative History:** Regulation .01 amended as an emergency provision effective October 21, 2011 (38:24 Md. R. 1495); amended permanently effective January 9, 2012 (38:27 Md. R. 1764) **Administrative History:** Regulation .02B amended as an emergency provision effective October 21, 2011 (38:24 Md. R. 1495); amended permanently effective January 9, 2012 (38:27 Md. R. 1764) **Administrative History:** Regulation .03 amended as an emergency provision effective October 21, 2011 (38:24 Md. R. 1495); amended permanently effective January 9, 2012 (38:27 Md. R. 1764) **Administrative History:** Regulation .04 amended as an emergency provision effective October 21, 2011 (38:24 Md. R. 1495); amended permanently effective January 9, 2012 (38:27 Md. R. 1764) **Administrative History:** Regulation .05 amended as an emergency provision effective October 21, 2011 (38:24 Md. R. 1495); amended permanently effective January 9, 2012 (38:27 Md. R. 1764) **Administrative History:** Regulation .06 amended as an emergency provision effective October 21, 2011 (38:24 Md. R. 1495); amended permanently effective January 9, 2012 (38:27 Md. R. 1764) **Administrative History:** Regulation .07 amended as an emergency provision effective October 21, 2011 (38:24 Md. R. 1495); amended permanently effective January 9, 2012 (38:27 Md. R. 1764) **Administrative History:** Regulations .01 — .07 repealed and new Regulations .01 — .07 adopted effective June 9, 2014 (41:11 Md. R. 605) **Administrative History:** Regulation .01C amended effective November 24, 2016 (43:23 Md. R. 1279) **Administrative History:** Regulation .06A amended effective November 24, 2016 (43:23 Md. R. 1279) #### Regulation .01 Scope. *COMAR 10.25.16.01* A. This chapter applies to each payor that is required to provide an incentive payment to each primary care practice, including a practice owned by a hospital, that adopts and reaches an approved level of use of electronic health records. B. Only a primary care practice that meets the requirements established in this chapter may receive an adoption incentive for electronic health record adoption under this program. C. Adoption incentives under this chapter are available through December 31, 2018. #### Regulation .02 Definitions. *COMAR 10.25.16.02* A. In this chapter, the following terms have the meanings indicated. B. Terms Defined. (1) “Achieved NCQA level two recognition” means a primary care practice has received recognition from NCQA for meeting NCQA’s 2011 or later standards for a level two patient-centered medical home. (2) “Attested to meaningful use” means a physician or nurse practitioner within a primary care practice has achieved the meaningful use requirements under either the Medicaid or Medicare EHR Incentive Program and has received confirmation of the attestation from: (a) The Centers for Medicare and Medicaid Services; or (b) The Maryland Medical Assistance Program (Medicaid). (3) “EHR adoption incentive” means a payment that an eligible primary care practice can receive from a payor to assist the primary care practice in adopting an electronic health record and attaining a required use level that: (a) Consists of a one-time cash payment not to exceed $15,000 or an incentive of equivalent value agreed upon by the primary care practice and payor; and (b) Is based on a $25 per-patient payment applied to the total number of patients on the practice panel who are Maryland residents. (4) “Electronic health record” or “EHR” means a complete electronic record system that is certified by an authorized testing and certification body designated by the Office of the National Coordinator for Health Information Technology and that contains health-related information on an individual. (5) Fully Insured Health Benefit Plan. (a) “Fully insured health benefit plan” means a medical policy, contract, or certificate for which an: (i) Employer pays a per-employee premium to a payor and the payor assumes the risk of providing health coverage for insured events and incurred administrative costs; or (ii) Individual pays a premium to a payor. (b) “Fully insured health benefit plan” does not include a self-insured health plan or a health plan for which a payor is acting only as a third-party administrator. (6) Health Care Provider. (a) “Health care provider” means a person who is licensed, certified, or otherwise authorized under Health Occupations Article, Annotated Code of Maryland, to provide health care services in the ordinary course of business or practice of a profession or in an approved education or training program. (b) “Health care provider” includes a facility where health care is provided to patients or recipients, including: (i) A facility, as defined in Health-General Article, §10-101(e), Annotated Code of Maryland; (ii) A hospital, as defined in Health-General Article, §19-301, Annotated Code of Maryland; (iii) A related institution, as defined in Health-General Article, §19-301, Annotated Code of Maryland; (iv) An outpatient clinic; (v) A freestanding medical facility, as defined in Health-General Article, §19-3A-01, Annotated Code of Maryland; (vi) An ambulatory surgical facility, as defined in Health-General Article, §19-3B-01, Annotated Code of Maryland; and (vii) A nursing home, as defined in Health-General Article, §19-1401, Annotated Code of Maryland. (c) For purposes of this chapter, “health care provider” does not include a health maintenance organization as defined in Health-General Article, §19-701, Annotated Code of Maryland. (7) “Implementation period” means the first 120 days after the effective date of this chapter. (8) “Incentive of equivalent value” means: (a) Specific services; (b) A gain-sharing arrangement; (c) Rewards for quality and efficiency; (d) In-kind payment; or (e) Other items or services that can be assigned a specific monetary value. (9) “Meaningful use” means the criteria and requirements established by the Centers for Medicare and Medicaid Services as detailed under 42 CFR 142, 143, 422, et al. (2010) and subsequent regulations. (10) “Medicare and Medicaid EHR Incentive Programs” means the programs described at 42 CFR 412, 413, 422, and 495 (2010) and 42 CFR 412, 413, and 495 (2012), adopted by the Centers for Medicare and Medicaid Services (CMS) to implement provisions of the American Recovery and Reinvestment Act of 2009, the Medicare EHR Incentive Program as administered by CMS, and the Medicaid EHR Incentive Program as administered by Medicaid. (11) “MHCC” or “Commission” means the Maryland Health Care Commission. (12) “NCQA” means the National Committee for Quality Assurance, a health care quality accreditation, certification, and recognition body. (13) “NPI” or “national provider identifier” means the unique individual identification number issued by the National Provider System to a health care provider typically used in administrative and financial transactions. (14) Payor. (a) “Payor” means a State-regulated carrier that issues or delivers health benefit plans in the State and includes: (i) Aetna, Inc; (ii) CareFirst BlueCross BlueShield; (iii) CIGNA HealthCare Mid-Atlantic; (iv) Coventry Health Care; (v) Kaiser Permanente; and (vi) United Healthcare, Mid-Atlantic Region. (b) “Payor” does not include a managed care organization as defined in Health-General Article, Title 15, Subtitle 1, Annotated Code of Maryland. (15) “Practice panel” means: (a) The patients who are Maryland residents and enrolled in a fully insured health benefit plan assigned by a payor to a provider within a primary care practice at the time the primary care practice requests an EHR incentive payment; or (b) When a payor does not assign patients enrolled in a fully insured health benefit plan to a provider within a primary care practice, the patients who are Maryland residents and enrolled with that payor in a fully insured health benefit plan who have been treated by the primary care practice within the 24 months preceding a primary care practice’s request for an EHR adoption incentive payment. (16) “Primary care practice” means a medical practice located in the State that is composed of: (a) One or more physicians who provide health care in family practice, general practice, geriatric medicine, internal medicine, pediatric medicine, or gynecologic practice and that uses one of the following CMS specialty codes in claims submissions: (i) Family practice (08); (ii) General practice (01); (iii) Geriatric medicine (38); (iv) Internal medicine (11); (v) Pediatric medicine (37); or (vi) Obstetrics & Gynecology (16); or (b) One or more nurse practitioners who provide health care in family practice, general practice, geriatric medicine, internal medicine, pediatric medicine, or gynecologic practice and that uses CMS taxonomy code in claims submissions: (i) Adult Health (363LA2100X); (ii) Family (363LF0000X); (iii) Gerontology (363LG0600X ); (iv) Obstetrics & Gynecology (363LX0001X); (v) Pediatric (363LP0200X ); (vi) Primary Care (363LP2300X); or (vii) Women’s Health (363LW0102X). (17) “State” means the State of Maryland. (18) “Third-party administrator” means a person that is registered as an administrator under Insurance Article, Title 8, Subtitle 3, Annotated Code of Maryland. #### Regulation .03 Program Description. *COMAR 10.25.16.03* A. An EHR adoption incentive shall be available to a primary care practice that meets the requirements set forth in Regulation .04 of this chapter. B. A payor may exclude from a primary care practice’s EHR adoption incentive calculation the payor’s patient members who were previously included in another primary care practice’s EHR adoption incentive calculation. C. A payor may, upon notification to a primary care practice: (1) Request additional information from a primary care practice to validate the primary care practice’s EHR adoption incentive request; and (2) Reduce a remaining EHR adoption incentive to a primary care practice if the payor determines that a duplicate payment or an overpayment has been made under this chapter. D. The MHCC may conduct audits to determine compliance with this chapter as follows: (1) A payor shall cooperate with the MHCC’s audit process and file information required by the MHCC in a timely manner; (2) A primary care practice shall cooperate with the MHCC’s audit process and report requested information in a timely manner; and (3) If an audit reveals noncompliance with this chapter, the MHCC may require corrective action. E. This chapter shall also apply to an entity that self-insures its health benefit plans, if federal law is amended to allow state regulation of such EHR payments. #### Regulation .04 Participation Requirements. *COMAR 10.25.16.04* A. To be eligible for an EHR adoption incentive under this chapter, a primary care practice shall: (1) Adopt a certified EHR; (2) Complete and submit an EHR adoption incentive request to each appropriate payor from which the practice desires an incentive award; and (3) Demonstrate that the primary care practice has either: (a) Attested to the current meaningful use requirements under the Medicare or Medicaid EHR Incentive Program; or (b) Participates in any MHCC approved patient-centered medical home program and has achieved NCQA level two recognition. B. An EHR adoption incentive request shall include the following: (1) Practice specific information: (a) Name; (b) Address; (c) Specialty; (d) Organizational national provider identifier number; and (e) Tax identification number; (2) The individual NPIs of each provider within the primary care practice; (3) The estimated total number of patients on the practice panel, if available; (4) The name and version of the certified EHR system implemented by the primary care practice; (5) Documentation that the primary care practice meets the criteria for the EHR adoption incentive including: (a) A copy of the confirmation received from CMS or Medicaid of acceptance of attestation to meaningful use by at least one physician or nurse practitioner within the practice; or (b) A copy of the NCQA level two recognition letter; and (6) An attestation signed by an authorized member of the primary care practice that: (a) The information contained in the request is accurate; (b) If the practice is led by a physician, all the physicians within the primary care practice are using the certified EHR system; and (c) If the practice is led by a nurse practitioner, all the nurse practitioners within the primary care practice are using the certified EHR system C. A payor shall issue an EHR adoption incentive request acknowledgement letter as soon as is reasonably possible and no later than 45 days after receipt of an EHR adoption incentive request. D. The meaningful use attestation of a physician or nurse practitioner may only be included in a single EHR adoption incentive request to a payor. E. A payor may request additional information as necessary to determine the validity of an EHR adoption incentive request. F. A payor shall process and pay in full the adoption incentive within 75 days of receiving a complete EHR adoption incentive request. G. A payor shall provide each primary care practice requesting an EHR adoption incentive with a written notification regarding: (1) The amount of the EHR adoption incentive awarded to the primary care practice; (2) The method of distribution of the EHR adoption incentive; and (3) The time period over which the incentive will be distributed. H. A primary care practice that provided an attestation to meaningful use must give written notice within 90 days to each payor that awarded an EHR adoption incentive to the practice under the following circumstances in the event that the CMS, Medicaid, or its designated entity: (1) Conducted a prepayment or post-payment audit of compliance with the participation requirements of the Medicare or Medicaid EHR Incentive Program regarding the physician or nurse practitioner identified by the primary care practice as part of its EHR adoption incentive request; and (2) Determined that the physician or nurse practitioner had not met the requirements under the Medicare or Medicaid EHR Incentive Program. I. Payors may request reimbursement of the incentive payments made under this chapter to the primary care practice in the event of notice provided by the primary care practice under §H of this regulation. J. Nothing in this chapter shall require a group model health maintenance organization to provide an incentive to a health care provider who is employed by a multispecialty group of physicians or nurse practitioners under contract with the group model health maintenance organization. #### Regulation .05 Incentive Payment Calculation by Payor. *COMAR 10.25.16.05* A. An EHR adoption incentive is calculated at $25 per member, up to a maximum of $15,000, and limited to the payor’s patient members on the practice panel. B. Upon request by a primary care practice, a payor shall provide the practice, in a timely manner, with an accounting of its EHR adoption incentive including the names of each patient included in the EHR adoption incentive calculation. #### Regulation .06 Reporting. *COMAR 10.25.16.06* A. A payor shall submit: (1) An annual report to the MHCC for calendar years 2011 — 2018 no later than 90 days after the end of each calendar year; and (2) At the request of the MHCC, a payor shall submit an interim report within 30 days of the Commission’s request. B. The annual and interim reports shall include: (1) The number of EHR adoption incentive requests received by the payor for the requested calendar year or time period; (2) The number of EHR adoption incentive payment requests processed by the payor for the requested calendar year or time period; (3) The total value of incentives distributed for the calendar year or time period; and (4) Other information available to the payor and requested by the MHCC to determine the effectiveness of EHR adoption incentives programs. C. A payor shall submit a final report to the MHCC no later than May 31, 2017, that includes all information required in an annual report under this regulation. #### Regulation .07 Incentive Program Transition. *COMAR 10.25.16.07* A. A payor has until the end of the implementation period to implement this chapter’s requirements. B. Except as provided in §E of this regulation, a primary care practice that received an incentive under earlier incentive program requirements is not eligible to receive an incentive under the requirements of this replacement chapter. C. A primary care practice may be eligible to receive an incentive provided under the requirements of an earlier EHR adoption incentive regulation if the practice, under an earlier EHR adoption incentive regulation: (1) Did not receive an incentive payment; and (2) Prior to the effective date of this chapter: (a) Submitted an incentive application and payment request; or (b) Submitted an incentive application but not an incentive payment request. D. A primary care practice in §C(1) and (2)(b) of this regulation shall have 60 days after the effective date of this replacement chapter to submit a payment request to the payor for a base and additional incentive, as provided in earlier regulations. E. Within 90 days after the effective date of this replacement chapter, a primary care practice that received an additional incentive that was less than or equal to the base incentive under earlier incentive program requirements may request that the payor award the difference between the previously received incentive payment and the incentive payment calculated under this replacement chapter based on the practice’s eligible patient enrollment with the payor at the time of the original payment. F. A payor shall process a payment request within 75 days of receiving a complete EHR incentive request from a primary care practice submitted under §§C — E of this regulation. ### Chapter 17 — Benchmarks for Preauthorization of Health Care Services **Authority:** Health-General Article, §§19-101 and 19-108.2, Annotated Code of Maryland **Administrative History:** Effective date: February 18, 2013 (40:3 Md. R. 218) **Administrative History:** Regulation .01 amended effective January 9, 2023 (49:27 Md. R. 1110) **Administrative History:** Regulation .02B amended effective October 12, 2015 (42:20 Md. R. 1265); January 9, 2023 (49:27 Md. R. 1110) **Administrative History:** Regulation .03 amended effective October 12, 2015 (42:20 Md. R. 1265); January 9, 2023 (49:27 Md. R. 1110) **Administrative History:** Regulation .04 amended effective October 12, 2015 (42:20 Md. R. 1265); January 9, 2023 (49:27 Md. R. 1110) **Administrative History:** Regulation .05 amended effective October 12, 2015 (42:20 Md. R. 1265); January 9, 2023 (49:27 Md. R. 1110) #### Regulation .01 Scope. *COMAR 10.25.17.01* A. This chapter applies to a payor that: (1) Requires preauthorization for health care services; and (2) Is required to report to the Maryland Health Care Commission on its attainment and plans for attainment of certain preauthorization benchmarks. B. This chapter does not apply to a pharmacy benefits manager that only provides services for: (1) Workers’ compensation claims pursuant to Labor and Employment Article, Title 9, Annotated Code of Maryland; or (2) Personal injury protection claims pursuant to Insurance Article, Title 19, Annotated Code of Maryland.. #### Regulation .02 Definitions. *COMAR 10.25.17.02* A. In this chapter, the following terms have the meanings indicated. B. Terms Defined. (1) “Commission” means the Maryland Health Care Commission. (2) “Executive Director” means the Executive Director of the Commission or the Executive Director’s designee. (3) “Health Care Service” has the meaning stated in Insurance Article, §15-10A-01, Annotated Code of Maryland. (4) “Payor” means one of the following State-regulated entities that require preauthorization for a health care service: (a) An insurer or nonprofit health service plan that provides hospital, medical, or surgical benefits to individuals or groups on an expense-incurred basis under health insurance policies or contracts that are issued or delivered in the State; (b) A health maintenance organization that provides hospital, medical, or surgical benefits to individuals or groups under contracts that are issued or delivered in the State; or (c) A pharmacy benefits manager that is registered with the Maryland Insurance Commissioner, except for a pharmacy benefits manager that only provides services for: (i) Workers’ compensation claims pursuant to Labor and Employment Article, Title 9, Annotated Code of Maryland; or (ii) Personal injury protection claims pursuant to Insurance Article, Title 19, Annotated Code of Maryland. (5) “Preauthorization” means the process of obtaining approval from a payor by meeting certain criteria before a certain health care service can be rendered by the health care provider. (6) “Prescriber” means a health care practitioner who has the required license and, if necessary, scope of practice or delegation agreement that permits the health care practitioner to prescribe drugs to treat medical conditions or diseases. (7) Step therapy or fail-first protocol" is a protocol established by an insurer, a nonprofit health service plan, a health maintenance organization, or a pharmacy benefits manager that requires a certain prescription drug or sequence of prescription drugs to be used by an insured individual or an enrollee before another specific prescription drug ordered by a prescriber is covered. (8) “Supporting medical information” means: (a) A paid claim from a payor that requires a step therapy or fail-first protocol for an insured or an enrollee; (b) A pharmacy record that documents that a prescription has been filled and delivered to an insured or enrollee, or to a representative of an insured or enrollee; or (c) Other information mutually agreed to that constitutes sufficient supporting medical information by an insured's or enrollee’s prescriber and a payor that requires a step therapy or fail-first protocol. #### Regulation .03 Benchmarks. *COMAR 10.25.17.03* A. Each payor shall establish and maintain online access for a provider to the following: (1) A list of each health care service that requires preauthorization by the payor; and (2) Key criteria used by the payor for making a determination on a preauthorization request. B. Each payor shall establish and maintain an online process for: (1) Accepting electronically a preauthorization request from a provider; and (2) Assigning to a preauthorization request a unique electronic identification number that a provider may use to track the request during the preauthorization process, whether the request is tracked electronically, through a call center, or by fax. C. Each payor shall establish and maintain an online preauthorization system that meets the requirements of Health-General Article, §19-108.2(e), Annotated Code of Maryland, to: (1) Approve in real time, electronic preauthorization requests for pharmaceutical services: (a) For which no additional information is needed by the payor to process the preauthorization request; and (b) That meet the payor’s criteria for approval; (2) Render a determination within 1 business day after receiving all pertinent information on requests not approved in real time, electronic preauthorization requests for pharmaceutical services that: (a) Are not urgent; and (b) Do not meet the standards for real-time approval under §C(1) of this regulation; and (3) Render a determination within 2 business days after receiving all pertinent information, electronic preauthorization requests for health care services, except pharmaceutical services, that are not urgent. D. Each payor that requires a step therapy or fail-first protocol shall: (1) Establish and maintain an online process to allow a prescriber to override the step therapy or fail-first protocol if: (a) The step therapy drug has not been approved by the United States Food and Drug Administration for the medical condition being treated; or (b) A prescriber provides supporting medical information to the payor that a prescription drug covered by the payor: (i) Was ordered by the prescriber for the insured or enrollee within the past 180 days; and (ii) Based on the professional judgment of the prescriber, was effective in treating the insured's or enrollee's disease or medical condition; (2) Provide notice to prescribers regarding the availability of its online process; and (3) Provide information to insureds or enrollees on the availability of the step therapy or fail-first protocol within its network. E. A payor that becomes authorized to provide benefits or services within the State of Maryland after October 1, 2012, shall meet each benchmark within this chapter within 3 months of the payor's offering of services or benefits within the State and shall thereafter maintain the processes or actions required by each benchmark. #### Regulation .04 Reporting. *COMAR 10.25.17.04* A. A payor that becomes authorized to provide benefits or services within the State of Maryland after October 1, 2012, shall report to the Commission in a form and manner specified by the Commission on its attainment of each benchmark in Regulation .03 of this chapter within 3 months of the payor’s offering of services or benefits within the State. B. If requested by the Commission, a payor shall demonstrate continued compliance with the benchmarks in Regulation .03 of this chapter. C. A payor that has been granted a waiver under Regulation .05 of this chapter shall notify the Executive Director if it can no longer demonstrate the extenuating circumstances for which the waiver was granted within 30 days after a payor can no longer demonstrate extenuating circumstances. #### Regulation .05 Waiver from Benchmark Requirement. *COMAR 10.25.17.05* A. A payor may request that the Commission issue or renew a waiver from the requirement to meet a benchmark in Regulation .03 of this chapter by the demonstration of the following extenuating circumstances: (1) For an insurer or nonprofit health service plan, a premium volume that is less than $1,000,000 annually in the State; (2) For a group model health maintenance organization, as defined in Health-General Article, §19-713.6, Annotated Code of Maryland, preauthorizations of health care services requested by providers not employed by the group model health maintenance organization; or (3) Other circumstances determined by the Executive Director to be extenuating. B. Submission of Request for Waiver or Renewal of Waiver. (1) A request for a waiver or renewal of waiver shall be in writing and shall include: (a) An identification of each preauthorization benchmark for which a waiver is requested; and (b) A detailed explanation of the extenuating circumstances necessitating the waiver. (2) A request for a waiver shall be filed with the Commission in accordance with the following: (a) For renewal of a waiver, no later than 30 days prior to its expiration; or (b) For a payor that becomes authorized to provide benefits or services within the State of Maryland after October 1, 2012, within 3 months after the date the payor is authorized to provide benefits or services within the State. C. Issuance of Waiver. (1) The Executive Director may issue a waiver from a preauthorization benchmark to a payor that demonstrates extenuating circumstances within this chapter. (2) The Executive Director will review and provide a decision to approve or deny all waiver requests within a reasonable time frame. (3) A waiver or renewal of a waiver shall be valid for 2 years, unless withdrawn by the Executive Director. D. Withdrawal of Waiver. (1) The Executive Director may withdraw a waiver or renewal of a waiver if the Executive Director determines that the payor can no longer demonstrate extenuating circumstances. (2) If the Executive Director withdraws a waiver or renewal of waiver, the Executive Director shall notify the payor, setting forth in writing the reasons for withdrawal. (3) After a waiver or a renewal of a waiver is withdrawn, a payor shall submit a plan to the Executive Director within 30 days that includes a timeline for attaining each benchmark in Regulation .03 of this chapter in a format approved by the Commission. E. Review of Denial or Withdrawal of Waiver. (1) If the Executive Director has denied or withdrawn a waiver, a payor may seek Commission review of the denial or withdrawal by filing a written request for review with the Commission within 20 days of receipt of the Executive Director’s notice of denial or withdrawal of a waiver, which shall: (a) State with particularity the grounds and factual basis for a payor’s disagreement with the denial or withdrawal decision; (b) Specify the remedy requested; and (c) If desired, include a written request to orally address the Commission, which shall be scheduled if requested. (2) The full Commission may review the written request for review of a denial or withdrawal of a waiver directly or, at the discretion of the Chair of the Commission, appoint a Commissioner to review the request submitted under §E(1) of this regulation, who will make a recommendation to the full Commission. (3) If a written request was submitted under §E(1)(c) of this regulation, a payor may orally address the Commission before a determination is made by the Commission as to whether or not to issue or withdraw a waiver. (4) After reviewing and considering a payor’s written request for review of the denial or withdrawal decision and any oral argument, if applicable, the full Commission shall issue a written decision affirming, reversing, or modifying the decision reviewed. F. A waiver or renewal of waiver from the requirements of this chapter may not be sold, assigned, leased, or transferred. #### Regulation .06 Fines. *COMAR 10.25.17.06* A payor that does not meet the reporting requirements of this chapter may be assessed a fine in accordance with COMAR 10.25.12.01, et seq. ### Chapter 18 — Health Information Exchanges: Privacy and Security of Protected Health Information **Authority:** Health-General Article, §§4-301, 4-302.2, 4-302.3, 4-302.5, 4-304, 19-103, 19-109(a)(1) and (8), 19-133, 19-143, and 19-145, Annotated Code of Maryland **Administrative History:** Effective date: March 17, 2014 (41:5 Md. R. 344) **Administrative History:** Regulation .01 amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440) **Administrative History:** Regulation .01A,B amended effective June 20, 2016 (43:12 Md. R. 666) **Administrative History:** Regulation .01B amended effective August 13, 2018 (45:16 Md. R. 775) **Administrative History:** Regulation .01B, E amended effective April 14, 2025 (52:7 Md. R. 322) **Administrative History:** Regulation .01F adopted effective April 14, 2025 (52:7 Md. R. 322) **Administrative History:** Regulation .02B amended effective June 20, 2016 (43:12 Md. R. 666); June 19, 2017 (44:12 Md. R. 588); August 13, 2018 (45:16 Md. R. 775); April 14, 2025 (52:7 Md. R. 322) **Administrative History:** Regulation .02B amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440) **Administrative History:** Regulation .03 amended effective June 20, 2016 (43:12 Md. R. 666); June 19, 2017 (44:12 Md. R. 588); April 14, 2025 (52:7 Md. R. 322) **Administrative History:** Regulation .03B, G amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440) **Administrative History:** Regulation .03D amended effective August 13, 2018 (45:16 Md. R. 775) **Administrative History:** Regulation .04 amended effective August 13, 2018 (45:16 Md. R. 775); April 14, 2025 (52:7 Md. R. 322) **Administrative History:** Regulation .04 amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440) **Administrative History:** Regulation .05 amended effective June 20, 2016 (43:12 Md. R. 666) **Administrative History:** Regulation .06 amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440) **Administrative History:** Regulation .06A, F amended effective June 20, 2016 (43:12 Md. R. 666) **Administrative History:** Regulation .07 amended effective June 20, 2016 (43:12 Md. R. 666) **Administrative History:** Regulation .07C amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440) **Administrative History:** Regulation .08 amended effective June 19, 2017 (44:12 Md. R. 588) **Administrative History:** Regulation .08C amended effective June 20, 2016 (43:12 Md. R. 666); April 14, 2025 (52:7 Md. R. 322) **Administrative History:** Regulation .09 amended effective June 20, 2016 (43:12 Md. R. 666) **Administrative History:** Regulation .09 amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440) **Administrative History:** Regulation .09G adopted effective June 19, 2017 (44:12 Md. R. 588) **Administrative History:** Regulation .10 adopted effective June 20, 2016 (43:12 Md. R. 666) **Administrative History:** Regulation .10 amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440) **Administrative History:** Regulation .10A, B amended effective August 13, 2018 (45:16 Md. R. 775) **Administrative History:** Regulation .10B amended effective April 14, 2025 (52:7 Md. R. 322) **Administrative History:** Regulation .11 adopted effective June 20, 2016 (43:12 Md. R. 666) **Administrative History:** Regulation .11B amended effective August 13, 2018 (45:16 Md. R. 775) **Administrative History:** Regulation .11B amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440) **Administrative History:** Regulation .12 adopted effective June 19, 2017 (44:12 Md. R. 588) **Administrative History:** Regulation .12A amended effective August 13, 2018 (45:16 Md. R. 775) **Administrative History:** Regulation .13 adopted effective April 14, 2025 (52:7 Md. R. 322) **Administrative History:** Regulation .14 adopted effective April 14, 2025 (52:7 Md. R. 322) #### Regulation .01 Scope and Purpose. *COMAR 10.25.18.01* A. This chapter addresses the privacy and security of protected health information maintained by a health information exchange, or obtained or released by any person through a health information exchange by adopting specific requirements: (1) To assure the privacy and security of protected health information accessed, used, or disclosed through a health information exchange, including protections for the secondary use of protected health information obtained, accessed, or released through a health information exchange; (2) To govern the access, use, maintenance, and disclosure of protected health information through or by a health information exchange; (3) To improve access to clinical records by treating clinicians; and (4) To promote uses of a State-designated HIE that will assist public health agencies in reaching public health goals. B. This chapter applies to: (1) An HIE, as defined in Regulation .02B(38) of this chapter, including: (a) An individual or entity that determines, controls, or has discretion to administer any requirement, policy, or agreement that allows, enables, or requires the use of any technology or services for access, exchange, or use of electronic protected health information: (i) Among more than two unaffiliated individuals or entities that are enabled to exchange electronic protected health information with each other; and (ii) That is for a treatment, payment, or health care operations purpose, as those terms are defined in 45 CFR §164.501, regardless of whether the individuals or entities are subject to the requirements of 45 CFR Parts 160 and 164; and (b) A health information technology developer of certified health information technology as that term is defined in Regulation .02B(39) of this chapter; (2) A person who accesses, uses, or discloses protected health information through an HIE; (3) Electronic health information stored in, or maintained by, an HIE; and (4) A dispenser authorized by law to dispense noncontrolled prescription drugs to a patient or the patient’s agent in the State. C. This chapter does not apply to: (1) Protected health information exchanged, accessed, used, or disclosed: (a) Between a hospital and a credentialed professional; (b) Among credentialed professionals of a hospital’s medical staff; (c) Between a hospital and its affiliated ancillary clinical service provider who is affiliated with the hospital and who, if required by HIPAA, has entered into a business associate agreement with the hospital; (d) Among entities under common ownership as defined at Health-General Article, §4-301, Annotated Code of Maryland, for health care treatment, payment, or health care operations purposes, as those terms are defined in 45 CFR §164.501; (e) By a carrier, as defined in Insurance Article, §15-301, Annotated Code of Maryland, exchanging information as required by 45 CFR §156.221; or (f) Between a carrier and its business associate, as defined in 45 CFR §160.103, if the organizational and technical processes provided or governed by the business associate are transactions, as defined in 45 CFR §160.103; or (2) The use, access, or disclosure of protected health information using point-to-point transmission unless an HIE is involved in the transmission of the data. D. In the event that an HIE is unable to meet a requirement of this chapter independently, it may do so by the execution of a written agreement or by requesting an exemption in accordance with Regulation .09G or H of this chapter. E. The requirements in this chapter are in addition to those set forth below: (1) The Health Insurance Portability and Accountability Act of 1996, and the pertinent regulations at 45 CFR Parts 160 and 164; (2) The Maryland Consumer Protection Act, Commercial Law Article, Title 13, Annotated Code of Maryland; (3) The Maryland Personal Information Protection Act, Commercial Law Article, Title 14, Subtitle 35, Annotated Code of Maryland; (4) The Maryland Confidentiality of Medical Records Act, Health-General Article, Title 4, Subtitle 3, Annotated Code of Maryland; (5) Health General Article, §4-307, Annotated Code of Maryland, Confidentiality of Mental Health Records; (6) 16 CFR Part 318, Health Breach Notification Rule, adopted by the Federal Trade Commission pursuant to the HITECH Act; (7) 42 CFR Part 2, Confidentiality of Substance Use Disorder Patient Records; (8) Titles IV and XI of the 21st Century Cures Act and the pertinent regulations, 45 CFR Part 171, and as defined at Regulation .02B(78) of this chapter; and (9) All other applicable State and federal laws and regulations governing the use, access, maintenance, and disclosure of health information. F. Nothing in this chapter shall prohibit: (1) The Maryland Department of Health, the Commission, or the Health Services Cost Review Commission from using electronic health information, subject to federal and State law, for health regulatory and public health functions; (2) The sharing or disclosing of information that is required to be exchanged under Health-General Article, Title 21, Subtitle 2A, Annotated Code of Maryland; or (3) The sharing or disclosing of information that is required to be exchanged under federal law, including for the purposes of payment, as defined in 45 CFR § 164.501. #### Regulation .02 Definitions. *COMAR 10.25.18.02* A. In this chapter, the following terms have the meanings indicated. B. Terms Defined. (1) “Adjudication of claims” means the activities necessary for the adjudication or subrogation of a health benefit claim that has been filed or may be filed by a patient, or with the authorization of a patient on the patient’s behalf, including: (a) Determinations of eligibility or coverage, including coordination of benefits or the determination of cost-sharing amounts; (b) Reasonable prospective, concurrent, or retrospective utilization review or predetermination of benefit coverage; (c) Review, audit, and investigation of a specific claim for payment of benefits with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges; (d) Billing, claims management, collection activities, obtaining payment under a contract for reinsurance, and related health care data processing; and (e) Risk adjustments based on enrollee health status and demographic characteristics. (2) “Ancillary clinical service provider” means a health care provider who has a direct contractual agreement with the hospital to provide therapeutic, diagnostic, or custodial ancillary services for the hospital as part of its affiliation. Ancillary services may include skilled nursing, home care, outpatient rehabilitation and therapy, transportation, ambulatory surgery, dialysis, laboratory, radiology, pharmacy, and chemotherapy. (3) “Application Programming Interface” or “API” has the same meaning as ‘Certified API Technology’ as stated at 45 CFR § 170.404. (4) “Appropriate notice to one or more health care consumers” means notice, related to a request for individually identifiable health information for secondary use, that meets the following requirements: (a) The notice: (i) Must include educational information pertaining to the requesting entity's secondary use of data obtained through an HIE, including why the entity is requesting the data and how it intends to use the data; (ii) May describe an ongoing scenario such as care coordination or other ongoing care management activities against which subsequent data may be requested by the care management organization from the HIE; in such cases, the potential need for and nature of such requests shall be included in the description of the initial request to the external review board and shall be plainly documented in the notice to health care consumers; (iii) Must include a clear and detailed description of the steps a health care consumer must take in order to grant authorization for the use of their information or to deny authorization; (iv) Must provide clear, detailed notice that the health care consumer's failure to respond could result in their information being disclosed without their authorization, if an independent external review committee waives authorization; and (v) Must have characteristics detailed in Regulation .03B(2)(b)—(g) of this chapter. (b) The care management organization, or its third party, has provided to each health care consumer whose identifiable information is being requested: (i) Notice as described above, using varied methods, where possible, to reach the health care consumer; (ii) The opportunity to submit authorization or denial of authorization through various methods such as email, online, mail, and phone; and (iii) At least 30 calendar days from the time of the first notice to respond to the notice. (5) “Authentication” means the process of establishing confidence in user identities electronically presented to an information system. (6) “Authorization” has the meaning provided in 45 CFR §164.508. (7) “Authorized purpose” means the specific reason consistent with this chapter and State and federal law for which an authorized user may use, access, or disclose protected health information through or from an HIE. The authorized purpose may include daily operations and maintenance of the HIE for: (a) The staff of the HIE who has signed a confidentiality and nondisclosure agreement; and (b) The staff of the HIE's contractor if the contractor: (i) Has entered into a business associate agreement with the HIE; and (ii) Has contractually agreed to limit access to the HIE only to its employees, agents, and independent contractors with a need-to-know; and who are under a confidentiality restriction, which may include a binding work force policy and procedure. (8) “Authorized user” means an individual identified by a participating organization or a health information exchange, including a health care consumer, who may use, access, or disclose protected health information through or from a health information exchange for a specific authorized purpose and whose HIE access is not currently suspended or terminated under Regulation .05, .07, or .09 of this chapter. (9) “Breach” has the meaning provided in 45 CFR §164.402. (10) “Business associate” has the meaning provided in 45 CFR §160.103. (11) “Business day” means any day except Saturday, Sunday, or a holiday on which State offices are closed. (12) “Care management organization”, in the context of secondary use, means any entity that: (a) Has a financial or specific care-related responsibilities for individuals with whom they may not have a treatment, payment, or health care operations relationship under 45 CFR §164.501(1); and (b) Has the legal or regulatory authority to exercise the responsibilities stated in §B(12)(a) of this regulation; or (c) Is operating in accordance with Maryland's All-Payer Model or successor agreement between the Centers for Medicare and Medicaid Services and the State of Maryland; (d) Does not include a third-party entity engaged by a participating organization to provide care management services on behalf of such participating organization for a primary use. (13) “Commission” means the Maryland Health Care Commission. (14) “Consent management application” means a software tool or platform designed to request, receive, store, and manage a person in interest’s consent preferences regarding the sharing of the patient’s electronic health information through an HIE. (15) “Control” means providing a method by which the health care consumer can electronically provide instructions to an HIE regarding the disclosure of the patient's information being made available through the HIE, which may include specifying: (a) The individuals and organizations to whom the HIE may disclose the patient's health information; (b) The circumstances (e.g., all, emergency only, inpatient, etc.) under which the patient's health information may be disclosed through the HIE; and (c) What type of health information may be disclosed, such as prescription history, laboratory reports, hospital encounters, and to whom. (16) “Core elements of the Master Patient Index (MPI)” are the minimum elements that are required for an HIE to identify a particular patient across separate clinical, financial, and administrative systems, as needed for exchanging health information electronically. (17) “Core HIE education content” means the educational information developed and approved by the Maryland Health Care Commission, after consultation with interested parties, and includes a general overview of: (a) The fundamentals of health information technology, including electronic health records and the exchange of electronic health information; (b) Health information privacy and security laws; and (c) The benefits and risks to patients of exchanging health information through an HIE as compared to opting-out and exchanging health information through a paper-based system. (18) “Covered entity"” has the meaning provided in 45 CFR §160.103. (19) “Credentialed professional” means an individual who has been credentialed by a hospital to provide clinical services to patients of the hospital. Credentialing includes the formal evaluation and verification of an individual's necessary qualifications, education, training, and professional license if applicable, through the collection, verification, and evaluation of data relevant to the individual's professional performance. (20) “Data use agreement” means an agreement that: (a) Is entered into by an HIE and an entity receiving data for secondary data use purposes, regardless of whether or not the entity is a covered entity as defined by HIPAA; and (b) Requires: (i) The receiving entity to accept and comply with the requirements in this chapter and, to the extent the receiving entity meets the definition of a business associate under HIPAA, current State and federal laws pertaining to business associates and business associate agreements; (ii) Both parties to access, transmit, and protect the PHI in accordance with current legal requirements and industry standards and practices; (iii) The receiving entity to destroy the PHI, including back-up and archived copies of the PHI, in accordance with industry standards and practices, when the purposes for which it has been requested are completed, unless retention of the PHI is otherwise required by law; and (iv) The receiving entity not to reuse or disclose the PHI to any person or organization, except as required or permitted by law; or if disclosed to a third party, which will act on behalf of the receiving entity, the third party and the receiving entity enter a contractual agreement that requires the third party to be bound by the provisions of the data use agreement that applies to the receiving entity. (21) “De-identified data” means health information that neither identifies nor provides a reasonable basis to identify an individual and that meets the standards and specifications provided in 45 CFR §164.514(a)—(b). (22) “Disclose” or “disclosure” means the release, redisclosure, transfer, provision, access, transmission, communication, or divulgence in any other manner of health information, including an acknowledgment that a health record on a particular patient or recipient exists, outside the entity holding the information. (23) “Dispense” has the meaning stated in Health Occupations Article, §12–101, Annotated Code of Maryland, but does not include giving a patient prescription drug samples in accordance with Health Occupations Article, §12-102(d), Annotated Code of Maryland. (24) Dispenser. (a) “Dispenser” means a person authorized by law to dispense a noncontrolled prescription drug to a patient or a patient’s agent in the State, including a nonresident pharmacy so authorized. (b) “Dispenser” does not include: (i) A licensed hospital pharmacy that only dispenses a monitored prescription drug for direct administration to an inpatient of the hospital; (ii) An opioid treatment services program, as defined by COMAR 10.47.07.02; (iii) A veterinarian licensed under Agriculture Article, Title 2, Subtitle 3, Annotated Code of Maryland; (iv) A pharmacy issued a waiver permit under COMAR 10.34.17.03 that provides pharmaceutical specialty services exclusively to persons living in assisted living facilities, comprehensive care facilities, and developmental disabilities facilities; or (v) A pharmacy issued a waiver by the Department under COMAR 10.47.07.03G from reporting dispensing to hospice patients. (25) “Download” means providing a method by which the health care consumer can obtain an electronic copy of the patient's information that: (a) Is in a readily available industry standard format; and (b) Allows the health care consumer to save, maintain, use, or transmit the patient's information. (26) “Electronic health care transactions” means transactions, as defined by 45 CFR § 160.103, that meet the specifications of 45 CFR § 162.920. (27) “Electronic health information” means health information that is in an electronic form. (28) “Electronic health record” or “EHR” means an electronic record of health-related information on an individual that includes patient demographic and clinical health information that may be used for clinical diagnosis, treatment, improvement of health care quality, and patient care. (29) “Electronic health record system” means technology that electronically captures, manages, and organizes health records and may have the capacity to: (a) Provide clinical decision support; (b) Support physician order entry; (c) Capture and query information relevant to health care quality; and (d) Exchange electronic health information with and integrate the information from other sources. (30) “Emergency” has the meaning provided in Health-General Article, §4-301(d), Annotated Code of Maryland. (31) “External and independent review committee” means a group of individuals that: (a) Is responsible for reviewing and making a determination regarding a request for a waiver of authorization related to population health management; and (b) Shall be minimally composed of: (i) At least three health care consumer members, three health care provider members, one member representing the scientific community, one member with privacy and legal expertise, and one member with HIE expertise; (ii) Members who have appropriate professional competencies necessary to review the request; and (iii) More than half of the members are not affiliated with or related to any person affiliated with the requesting entity and are free from any conflicts of interest with the requesting entity. (32) “Federalwide assurance” or “FWA” means an agreement between an entity and the United States Department of Health and Human Services under which the entity agrees to comply with: (a) Federal regulations concerning research involving human subjects; (b) Department of Health and Human Services regulations found at 45 CFR Part 46; (c) A statement of principles governing the entity in the discharge of its responsibilities for protecting the rights and welfare of human subjects of research conducted at or sponsored by the entity; and (d) Other requirements of the agreement. (33) “Granular patient consent” means expressed preferences made by a health care consumer regarding the disclosure, access, and use of the patient's protected health information according to the type of information, type of provider, purpose, or circumstance communicated by the health care consumer to the HIE through reasonable means specified by the HIE, which shall include paper and electronic means. (34) “Health care” has the meaning provided in Health-General Article, §4-301(g), Annotated Code of Maryland. (35) “Health care consumer” or “consumer” means a recipient, a patient, or a person in interest, as defined in this regulation. (36) “Health care provider” has the meaning provided in Health-General Article, §4-301(h), Annotated Code of Maryland. (37) “Health Data Utility” means an HIE that operates for the following purposes: (a) The collection, aggregation, and analysis of clinical information, public health data, and electronic administrative health care transactions; (b) The communication of data between public health officials and health care providers to advance disease control and health equity; and (c) The enhancement and acceleration of interoperability of health information. (38) “Health information” means any information, whether oral or recorded in any form or medium, including electronic health information, that: (a) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (b) Relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual. (39) “Health information exchange” or “HIE” has the meaning provided in Health-General Article §4-301(i), Annotated Code of Maryland. (40) “Health information technology developer of certified health information technology” or “developer” means an entity that develops, sells, licenses, provides, or offers health information technology, as defined in 42 U.S.C. 300jj(5), to persons in the State and has one or more health information technology modules certified under a program that is kept or recognized by the National Coordinator in accordance with 42 U.S.C. 300jj-11(c)(5). (41) Health Record. (a) “Health record” means any health information, in any form or medium, created or transmitted by a participating organization or health care consumer that: (i) Is entered in the record of a patient or recipient; and (ii) Identifies or can readily be associated with the identity of a patient or a recipient. (b) “Health record” includes a medical record as defined in Health-General §4-301(k), Annotated Code of Maryland. (42) “HIE access matrix” means a document that is used by a participating organization to assign access to each authorized user and describes the type of protected health information (including, but not limited to, lab reports, prescription drug information, prior admissions to hospitals), that each authorized user is allowed to retrieve from an HIE. An HIE access matrix may specify a use case (including but not limited to electronic eligibility, clinical lab ordering/results delivery, electronic prescribing, medication history, clinical summary exchange, and other items) and corresponding associated data, including identified sensitive health information. (43) “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, P.L.104191, as amended, and the implementing regulations at 45 CFR Parts 160 and 164, as amended, and including as amended by the HITECH Act. (44) “HITECH Act” mean the Health Information Technology for Economic and Clinical Health Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (Pub. L. 111-5), as amended. (45) “Hospital” has the meaning provided in Health-General Article, §19-301(f), Annotated Code of Maryland. (46) “Improvement of patient safety” means actions, strategies, or protocols to prevent health care errors, enhance the quality of care, and ensure a safe health care environment. (47) “Individually identifiable health information” has the meaning provided in 45 CFR §160.103 and includes any health information that contains personal identifiers, as detailed in 45 CFR §164.514(b). (48) “Institutional Review Board” or “IRB” means a committee or other group designated by an institution or affiliated with a State agency that performs a review of proposed research that has: (a) Registered with the Office of Human Research Protections Electronic Submission System; and (b) Obtained FWA approval from the Office of Human Research Protections. (49) “Interoperability” has the meaning provided in 45 CFR §170.102. (50) “Legally protected health information” means the health information with a date of service after May 31, 2022, that is subject to restrictions under Health-General Article, §4-302.5, Annotated Code of Maryland, and COMAR 10.11.08, including: (a) Mifepristone data, as defined by the Secretary; and (b) As specified by the Secretary, the diagnosis, procedure, medication, and other codes related to: (i) Abortion care; and (ii) Sensitive health services, as defined by Health-General, §4-301, Annotated Code of Maryland. (51) “Master patient index” or “MPI” means a database that maintains a unique index identifier for each patient whose protected health information may be accessible through an HIE and is used to cross reference patient identifiers across multiple participating organizations to allow for patient search, patient matching, and consolidation of duplicate records. (52) “MHCC” or the “Commission” means the Maryland Health Care Commission. (53) “Nationally recognized standards” means technical standards for the exchange, integration, sharing, or retrieval of electronic health information considered reliable by the health IT industry nationally. (54) “Noncontrolled Prescription Drugs” means a prescription drug, as defined in the Health Occupations Article § 21 201, that is not a controlled dangerous substance designated under Criminal Law Article, Title 5, Subtitle 4, Annotated Code of Maryland. (55) “Non-HIPAA violation” means an inappropriate use, access, maintenance, or disclosure of health information that is not a HIPAA violation, but is inconsistent with State or federal law or this chapter, including a violation of 42 CFR Part 2. (56) “Notice” (or “notify” or “notification”) means an action that is required to be taken in writing or by written request under this chapter by a person, including an HIE, a health care consumer, a participating organization, or the Commission, in order to provide information to another that: (a) Is sent by letter delivered to the person's address of record; (b) Uses one of the following electronic or digital mechanisms where the delivery is acknowledged or confirmed: (i) An email, when the receiving person has provided an email address; (ii) By a health care consumer using the receiver's website; or (iii) By a health care consumer using a patient portal; (c) By a health care consumer using telephonic or similar method, provided that a written confirmation of the conversation is provided to the health care consumer by the person receiving the notification or request by the following means: (i) An email, when the health care consumer has provided an email address and delivery is acknowledged or confirmed; or (ii) A letter delivered to the health care consumer's address of record; and (d) Complies with HIPAA and all other applicable federal and State laws and regulations. (57) “Opt out” means the explicit written notice by a health care consumer to an HIE or through the consent management application that the patient has elected not to participate in the HIE, so that the HIE shall not disclose such patient's protected health information, or data derived from such patient's health information, except as consistent with this chapter. (58) “Part 2” means the federal Confidentiality of Substance Use Disorder Patient Records regulations found in 42 CFR Part 2 and supplemented by the final rule 82 FR 6052. (59) “Part 2 information” means any information subject to the regulations under 42 CFR Part 2. (60) “Participating organization” means a covered entity that enters into an agreement with an HIE that governs the terms and conditions under which its authorized users may use, access, or disclose protected health information through the HIE. (61) “Patient” means an individual who receives health care and on whom a medical record is maintained. (62) “Payor” means: (a) An insurer that holds a certificate of authority in the State and provides health benefit plans in the State; (b) A health maintenance organization that holds a certificate of authority in the State; (c) A managed care organization authorized to receive Medicaid prepaid capitation payments under Health-General Article, Title 15, Subtitle 1, Annotated Code of Maryland; or (d) A nonprofit health service plan that holds a certificate of authority in the State. (63) “Person” means an individual, trust or estate, general or limited partnership, joint stock company, unincorporated association or society, municipal or other corporation, incorporated association, limited liability partnership, limited liability company, the State, an agency or political subdivision of the State, a court, and any other governmental entity. (64) “Person in interest” means any of the following, but does not include a participating organization: (a) An adult on whom a health care provider maintains a medical record; (b) A person authorized to consent to health care for an adult consistent with the authority granted, including without limitation, a guardian, surrogate, or person with a medical power of attorney; (c) A duly appointed personal representative of a deceased person; (d) Either: (i) A minor, if the medical record concerns treatment to which the minor has the right to consent and has consented under Title 20, Subtitle 1 of the Health-General Article, Annotated Code of Maryland; or (ii) A parent, guardian, custodian, or a representative of the minor designated by a court, in the discretion of the attending physician who provided the treatment to the minor, as provided in Health-General Article, §§20 -102 and 20-104, Annotated Code of Maryland; or (e) If §B(55)(d) of this regulation does not apply to a minor: (i) A parent of the minor, except if the parent's authority to consent to health care for the minor has been specifically limited by a court order or a valid separation agreement entered into by the parents of the minor; or (ii) A person authorized to consent to health care for the minor consistent with the authority granted; or (f) An attorney appointed in writing by a person listed in this definition regarding matters subject to this chapter. (65) “Point-to-point transmission” means a secure electronic transmission of PHI, including, but not limited to, records sent via facsimile or secure clinical messaging service, sent by a single entity that can be read only by the single receiving entity designated by the sender. A point-to-point transmission may be facilitated by an HIE and mirrors a paper-based exchange, such as a referral to a specialist, a discharge summary sent to where the patient is transferred, lab results sent to the practitioner who ordered them, or clinical information sent from a hospital to the patient's health plan for quality improvement or care management/coordination activities for such patient. (66) “Population health management purpose” means the use of data, for secondary use, available from or through an HIE for population-based activities relating to the improvement of patient and population health or the reduction of health care costs, including but not limited to: (a) Patient outreach activities that involve care management; (b) Development or assessment of, quality indicators, patient patterns or outcomes, or support of quality reporting; (c) Development and evaluation of innovative care delivery models and programs; and (d) Risk assessment. (67) “Primary use of HIE data” or “primary use” means use and disclosure of data accessed, used, or disclosed through an HIE for purposes of: (a) Treatment as defined by HIPAA; (b) Payment as defined by HIPAA; (c) Reporting to public health authorities in compliance with reporting required or permitted by law; (d) Other uses or disclosures required or permitted by law and in accordance with this chapter, including those set forth in Health-General Article, §4-305(b), Annotated Code of Maryland; or (e) Health care operations, as defined by HIPAA, for conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities. (68) “Privacy board” means a group of individuals that: (a) Is responsible for reviewing and making a determination on a request for secondary data for research purposes; (b) Has the authority consistent with 45 CFR §164.512, including approval of a waiver or alteration of authorization requirement; (c) Is designated or convened by the HIE, which may establish guidelines concerning a quorum; (d) Shall meet the member composition requirements detailed in 45 CFR §164.512(i)(1)(i)(B)(1) and (3); and (e) Shall assure that less than half of its members considering a request are affiliated with or related to any person affiliated with the requesting entity. (69) “Protected health information” or “PHI” a subset of health information, means: (a) Protected health information as defined in 45 CFR §160.103; or (b) A medical record as defined in the Health-General Article, §4-301(i); and (c) Includes sensitive health information. (70) “Public health authority” has the meaning provided in 45 CFR §164.501. (71) “Qualified research organization” means an entity that: (a) Has entered into a data use agreement with the HIE from which data is being requested; (b) Is determined, by an IRB or privacy board, to have expertise to carry out research specific to its request; (c) Is determined, by an IRB or privacy board, to have a legitimate and credible reason or obligation to carry out research specific to its request; and (d) Is a participating organization, public health authority, or is engaged in joint research with a participating organization or public health authority. (72) “Query” means to electronically search for information available through an HIE using the services provided by the HIE. (73) “Research” means the use of secondary data available from or through an HIE for the systematic investigation, including research development, testing, preparation, and evaluation, designed to develop or contribute to generalizable knowledge as defined in 45 CFR §164.501 and 45 CFR §46.102, including the use of de-identified data and limited data sets. (74) “Secondary use of HIE data” or “secondary use” means any use or disclosure of data accessed, used or disclosed through an HIE that is not a primary use. Examples of secondary use include, but are not limited to, use of HIE data for conducting research, improving patient safety, marketing, or the sale of HIE data. (75) “Secretary” means the Secretary of Health. (76) “Sensitive health information” means a subset of PHI, which consists of: (a) Part 2 information; (b) Legally protected health information; or (c) Any other information that has specific legal protections in addition to those required under HIPAA or the Maryland Confidentiality of Medical Records Act. (77) “State-designated HIE” means an HIE designated by the Maryland Health Care Commission and the Health Services Cost Review Commission pursuant to the statutory authority set forth under Health-General Article, §19-143, Annotated Code of Maryland. (78) “State health improvement program” means a State initiative designed to enhance public health through strategic planning, targeted interventions, and collaboration with stakeholders and the federal government, including State efforts in support of the Total Cost of Care model and successor models agreed to by the federal government and the State. (79) “Submit”, when used in reference to consumer-submitted data, means providing a method by which the health care consumer can electronically upload information to the HIE to then be made available to authorized users of the HIE. (80) “System administrator” means an individual employee within a participating organization (or an individual employed by a contractor to the participating organization) who is designated by the participating organization to manage the user accounts of specified individuals within the participating organization in coordination with an HIE. (81) “Third party system” means hardware or software provided by an external entity to a participating organization, which interoperates with an HIE to allow an authorized user access to information through the HIE and may include an electronic health record system. (82) “21st Century Cures Act” means the 21st Century Cures Act, P.L. 114-255, as amended, and the pertinent regulations at 45 CFR Parts 156, 170, and 171 and 42 CFR Parts 422, 431, 438, 457, 482, and 485. (83) “Unusual finding” means an irregularity in the manner in which use, access, maintenance, disclosure, or modification of health information or sensitive health information transmitted to or through an HIE should occur that could give rise to a breach, a violation under this chapter or a violation of other applicable privacy or security laws. (84) “Use” has the meaning provided in 45 CFR §160.103. (85) “User accounts” mean the records associated with an authorized user's credentials and activities with an HIE or a third party system. #### Regulation .03 Rights of a Health Care Consumer Concerning Information Accessed, Used, or Disclosed Through an HIE. *COMAR 10.25.18.03* A. A health care consumer has the following rights in accordance with the requirements specified in this section: (1) The right to have information regarding the health care consumer's rights under these regulations readily available to assist the health care consumer in making an informed decision concerning: (a) The accessibility of a patient's protected health information electronically through an HIE; and (b) The risks and benefits of participating in the HIE. (2) The right to opt out of an HIE. (a) A health care consumer has the right to opt out of an HIE at any time and refuse access to the patient's PHI through an HIE, except when a disclosure is limited to: (i) Core elements of the MPI; (ii) A disclosure that a person is required to make under federal or State law requirements; (iii) Results of a diagnostic procedure sent to the health care provider who ordered the procedure or another provider as designated by the ordering provider as part of the care delivery of a patient; (iv) Information regarding prescription medications dispensed or filled by a pharmacy, sent to the health care provider who ordered the prescriptions or another health care provider as designated by the ordering health care provider; (v) Public health authorities for reporting purposes required, authorized, or otherwise compliant with applicable law; or (vi) Communications permitted under HIPAA or State law without a health care consumer's consent or authorization when using point-to-point. (b) Provided, however, that §A(2)(a)(iii), (iv), and (vi) of this regulation shall not apply to disclosures of sensitive health information, which receive additional protections consistent with Regulation .04 of this chapter. (c) A health care consumer shall be advised in writing by the HIE receiving the opt-out notice or request that opting out does not preclude any participating organization that has received or accessed PHI via the HIE prior to such opt-out, and incorporated such PHI into its records, from retaining such information in its records. (3) An HIE shall make a good faith effort to facilitate a health care consumer's amendment of the patient's health information available through the HIE by informing the health care consumer how to seek amendment of the information. (a) An HIE shall send information regarding the process for amending health information being made available through the HIE within 20 days of receiving notice from a health care consumer of a desire to amend the patient's health information available through the HIE and shall include the contact information of relevant participating organizations that provided the information; and (b) This process shall be in accordance with the requirements specified in Health-General Article, §4-304(b), Annotated Code of Maryland and HIPAA, including 45 CFR §164.526. (c) An HIE shall make a good faith effort to notify the participating organization of each authorized user who has accessed, used, or disclosed the health information that has subsequently been amended. (4) The right to resume participation in an HIE after previously opting out in accordance with these regulations. Any such resumption of participation shall be upon written notice or request by the health care consumer. B. An HIE shall provide needed information about the HIE to a health care consumer whose protected health information is maintained by a health information exchange, or may be accessed, used, or disclosed through the HIE. (1) An HIE shall develop, adopt, implement, and keep current a health care consumer education plan that considers stakeholder input. (a) The health care consumer education plan shall include the core HIE education content as defined in Regulation .02 of this chapter. (b) The health care consumer education plan shall outline how the HIE will make available the following information to health care consumers: (i) A description of each type of patient health information that may be used, accessed or disclosed through the HIE; (ii) The health information maintained by the HIE; (iii) The specific details concerning who may access, use, or disclose a patient's health information and for what purpose; (iv) The privacy and security measures that the HIE has implemented to protect health information, and a detailed explanation of what happens if there is a breach that results in unauthorized access to protected health information; (v) A health care consumer's rights regarding the HIE and the control over, protection of, use of, and correction of each type of health information; (vi) The process provided for a health care consumer to exercise the health care consumer's rights, including a detailed description of the steps a health care consumer needs to take in order to opt out from participation in the HIE; (vii) The implications of a health care consumer's decision to opt out of participation in an HIE and not permit the disclosure of that consumer's PHI to authorized users, except as otherwise permitted under applicable law; and (viii) The HIE's policies and procedures, including without limitation, policies and procedures consistent with these regulations regarding how the health care consumer may gain access to the patient's health information. (2) An HIE shall develop and implement health care consumer education materials as provided in §B(1) of this regulation. Such education materials shall have the following characteristics: (a) Provide a balanced perspective, outlining the various points of view concerning each subject matter, including the risks and benefits associated with sharing protected health information electronically through the HIE; (b) Are not inaccurate or misleading; (c) Minimize the use of technical terms and, when such terms are necessary, clearly define the technical terms; (d) Use plain language that is easily understandable to each health care consumer population served, taking into account the various levels of education, understanding, and interest across that population; (e) Use text and illustrations that are culturally sensitive, language appropriate, and that recognize user diversity including ethnicity, age, race, and gender; (f) Update material to include and incorporate new information; and (g) Specify the time sensitivity of any material included. (3) An HIE shall cooperate with applicable State agencies to educate health care consumers consistent with a statewide education plan approved by such applicable State agency. (4) An HIE shall make health care consumer educational materials readily available, at no charge, to participating organizations and the participating organizations’ users through distribution channels such as websites, postal mail, email, secure third-party smart phone applications, and any other reasonable media or distribution channel commonly used and generally available to the HIE and health care consumer. (5) In addition to the foregoing requirements, with regard to sensitive health information, the health care consumer educational content shall include: (a) The scope of sensitive health information; (b) The health care consumer’s right to control sensitive health information; (c) The method by which to engage in the granular patient consent process; (d) The method or methods by which the health care consumer can access the patient’s own sensitive health information; (e) The circumstances under which an HIE must restrict or may disclose legally protected health information; and (f) The method by which a health care consumer can request that a patient’s legally protected health information be disclosed to a specific health care provider. (6) When an HIE updates its health care consumer educational content, the HIE shall timely make the updated materials available to health care consumers. C. An HIE shall comply with the following requirements to allow a health care consumer to obtain information concerning a patient's PHI that may be available through the HIE. (1) An HIE shall provide the following information to the health care consumer, upon written notice or request by the health care consumer, describing what PHI is available through the HIE concerning the specified patient: (a) The participating organization that disclosed the PHI to the HIE; (b) The date the PHI was disclosed to the HIE; and (c) The type of PHI disclosed to the HIE, if known by the HIE. (2) An HIE shall provide written information, in accordance with this Regulation, to health care consumers concerning the methods available to such health care consumers to access a patient's PHI that is available through the HIE. (a) If the patient's PHI is directly available electronically to the health care consumer through the HIE, the HIE shall advise the health care consumer how to obtain the PHI electronically. (b) If the patient's PHI is not directly available electronically to the health care consumer through the HIE, the HIE shall, within 7 days from receipt of such health care consumer's written notice or request, provide the health care consumer with the contact information for each participating organization that has disclosed information to the HIE and received information from the HIE concerning the patient, so that the health care consumer may gain access to the patient's health information directly from each participating organization. (3) An HIE shall make a good faith effort to facilitate a health care consumer's amendment of the patient's health information available through the HIE by informing the health care consumer how to seek amendment of the information. (a) An HIE shall send information regarding the process for amending health information being made available through the HIE within 20 days of receiving notice from a health care consumer of a desire to amend the patient's health information available through the HIE and shall include the contact information of relevant participating organizations that provided the information; and (b) This process shall be in accordance with the requirements specified in Health-General Article, §4-304(b), Annotated Code of Maryland and HIPAA, including 45 CFR §164.526. (c) An HIE shall make a good faith effort to notify the participating organization of each authorized user who has accessed, used, or disclosed the health information that has subsequently been amended. (4) Upon receipt of written notice or request, an HIE shall provide each health care consumer with a report detailing any disclosure through the HIE for a time period specified by the health care consumer, of the patient's PHI. In the case of recurring disclosures to the same entity for the same purpose, a summary report may be provided by the HIE. However, if the health care consumer requests the details of the summary report, the HIE shall promptly provide them. (a) The time period specified by the health care consumer shall not exceed the data retention period as specified in the HIPAA Privacy Rule, 45 CFR §164.528. (b) The report shall specify the following for each instance that the patient's PHI was disclosed during the time frame reflected in the report: (i) The name of each authorized user; (ii) The name of the participating organization to which the authorized user is affiliated, if such information is kept by the HIE in the ordinary course of business; (iii) The date and time of the disclosure; (iv) The type of PHI disclosed, if known by the HIE; and (v) The name of the participating organization that made the protected health information available to the HIE. (c) An HIE shall acknowledge a health care consumer's written notice or request for the report within 10 business days of receipt of the request. (d) An HIE shall respond to a health care consumer's written notice or request with either the requested report or with a written explanation why such report is unavailable, when it will be available, or where the health care consumer may obtain the requested information, in accordance with 45 CFR §164.528(a)(2)(D)(3). The HIE shall respond within a reasonable time frame, but not later than 30 days of the initial written notice or request by the health care consumer. (i) An HIE shall provide up to two copies annually of the report at no cost to the health care consumer, upon written notice or request by the consumer. If the report is available in an electronic format, it shall be provided to the consumer in a generally available electronic format such as PDF, if so requested, at no additional charge. (ii) For any additional report, the HIE may charge a reasonable fee not to exceed the cost to provide the additional report, but no more than the allowable amount in accordance with Health-General Article, §4-304, Annotated Code of Maryland, and 45 CFR §164.524(c)(4). D. Consent Management Application. (1) The State-designated HIE shall implement a consent management application that: (a) Allows a person in interest to opt out of or opt in to having a patient’s electronic health information shared or disclosed by an HIE; (b) Allows a person in interest to view the interested patient’s opt-out status. (c) Informs the person in interest of the types of electronic health information that may be shared or disclosed by the State-designated HIE in accordance with §A(2)(a) of this regulation notwithstanding the choice to opt out;; (d) Enables HIEs to readily identify information as to whether a person in interest has opted out of sharing the patient’s electronic health information; and (e) At least includes: (i) Personal identifiers consisting of the full name, date of birth, mailing address, telephone number, medical record number, and other unique identifiers of the patient and person in interest, if not the patient; (ii) The person in interest’s communication contact preferences; (iii) The relationship of the person in interest to the patient; and (iv) The date the patient’s consent preferences were last updated. (2) Within 12 months of the effective date of this regulation, the State-designated HIE shall make the consent management application it develops available to registered HIEs. (3) The State-designated HIE shall implement the consent management application with a secure electronic interface that supports standardized interoperability between various recipient HIE systems. (4) HIE Connection to the Consent Management Application. (a) Exception. Section D(4)(b) of this regulation does not apply to an HIE that solely exchanges electronic health information with other HIEs and does not have any health care providers as a participating organization. (b) An HIE shall: (i) Establish bi-directional connectivity with the consent management application within 12 months of receiving notification from the State-designated HIE that the application is operational; (ii) Update the HIE's system with the most recent version of the consent management application data at least every 5 business days; (iii) Update the consent management application with any opt-out or opt-in requests it has received from an HIE or directly from a person in interest within 5 business days; (iv) Withhold sharing or disclosure of the electronic health information of a patient to the extent the consent management application indicates that the patient has opted out of having electronic health information shared or disclosed by an HIE, except to the extent permitted by §A(2) of this regulation; and (v) Electronically notify authorized users when a patient has restricted data sharing. (5) An HIE shall implement the consent management application in a manner that is consistent with this chapter, its existing policies and procedures regarding use and disclosure of PHI and other personal identifiable information, and its technological capabilities. (6) An HIE shall place a link on its website directing a person in interest to the State-designated HIE’s website to globally opt out or opt in to having a patient’s electronic health information shared or disclosed by an HIE. (7) An HIE shall continue to accept opt-out and opt-in requests from health care consumers directly. (8) The State-designated HIE shall promptly notify the Commission and all HIEs any time the consumer management application is not operational and when services are resumed. (9) An HIE is not required to comply with §D(4)(b) of this regulation when: (a) An emergency exists and all requirements under Regulation .11 of this chapter have been met; or (b) The consent management application is not operational. (10) Section D of this regulation shall be in addition to any restrictions on the disclosure of sensitive health information, consistent with Regulation .04 of this chapter. E. An HIE shall: (1) Establish and maintain an online process that allows health care consumers to obtain an electronic report detailing any disclosures of their information through the HIE in accordance with §C(4)(b) of this regulation; and (2) Implement and maintain compliance with the provisions detailed in Regulation .12A(1)(7), B(1)(2), and C(4)(b)(d) of this chapter in implementing §E(1) of this regulation. F. An HIE shall take affirmative steps to protect a patient's protected health information, including sensitive health information, that is accessible to or through the HIE from a breach or a non-HIPAA violation. (1) An HIE shall have an easily accessible and convenient method by which a person may notify the HIE concerning a potential or an actual breach or a non-HIPAA violation. (2) When an HIE is notified in writing of a potential or an actual breach or a non-HIPAA violation, the HIE shall: (a) Acknowledge receipt of the notification within 1 business day; (b) Begin an investigation concerning the matter upon receipt of the notification in compliance with Regulation .07 of this chapter and; (c) In accordance with Regulation .08 of this chapter, provide the person filing the notification and each health care consumer whose protected health information was breached with information concerning the determination and resolution of the matter by the HIE. (3) An HIE shall implement robust technical measures consistent with generally accepted industry best practices to assure valid patient identification and minimize patient record mismatches. G. An HIE shall implement a process to allow a health care consumer to make an educated decision regarding the patient's participation in an HIE, opting out from such participation, or opting to resume participation in the HIE system, in accordance with this regulation. (1) An HIE shall maintain a log that records each patient's participation status over time; and (a) The HIE shall retain the log for the duration required by State or federal law, whichever requires a longer retention; and (b) The HIE shall keep the log in a retrievable storage medium. (2) An HIE may not disclose a patient's PHI if the health care consumer has submitted a written notice or request to opt out of the HIE in accordance with §(A)(2) of this regulation except as otherwise permitted under applicable law and in accordance with this chapter. (3) An HIE may not disclose information derived from a patient's PHI, including for secondary use, if the health care consumer has submitted a written notice or request to opt-out of the HIE, except as otherwise permitted under applicable law. (4) An HIE may not unreasonably deny a health care consumer’s expressed preferences. H. The following requirements shall apply to all communications between an HIE and a health care consumer: (1) An HIE shall implement a process to allow a health care consumer to communicate with the HIE about the patient's participation status through an appropriate medium of the health care consumer's choice, including the following: (a) By telephone, via a toll-free number; (b) By mail, via a standardized form; (c) By fax, via a standardized form; (d) Online, via a secure website; and (e) In person at the HIE's offices during business hours. (2) A health care consumer’s communication opting out or opting in to an HIE shall be made: (a) In writing; (b) Online; or (c) By telephone, if the HIE confirms the action with a written communication to the health care consumer in accordance with §H(5)(a) and (b) of this regulation. (3) An HIE shall take appropriate measures to assure that a health care consumer who communicates with the HIE is authorized to act on behalf of the patient. (4) An HIE shall implement the health care consumer's requested action within 5 business days of receipt of the health care consumer's written or online request concerning: (a) Opting out of the HIE; and (b) Resuming participation in the HIE after previously opting out. (5) An HIE shall provide to each health care consumer the option to receive confirmation of any change in the patient's participation status. If a health care consumer requests such confirmation in writing, the HIE shall: (a) Send the confirmation of participation status change within 3 business days of the effective date of change of such patient's participation status; and (b) If consistent with all applicable privacy and security law and regulations, including HIPAA and applicable State law and regulations, send the confirmation of status change through one of the following methods as specified by the health care consumer: (i) An email sent to the email address specified by the health care consumer; (ii) A letter to an address specified by the health care consumer; (iii) A letter by fax to a fax number specified by the health care consumer; (iv) A letter given to the health care consumer at the HIE during normal business hours; or (v) A text message sent to the number specified by the health care consumer. (6) When a health care consumer changes the patient's participation status, the HIE shall provide the following to the health care consumer and, unless the patient is a minor or subject to a power of attorney or otherwise unable to handle his or her own affairs, to the patient: (a) Information concerning when the status change will become effective; and (b) Information concerning what information will be excluded from the HIE regarding a health care consumer who opts out. I. A participating organization shall comply with the following requirements to assure patient and health care consumer rights. (1) A participating organization shall inform each health care consumer no later than the first medical encounter following enrollment of the organization in an HIE, by written and oral notice, of: (a) Such organization's participation in an HIE, including in such organization's Notice of Privacy Practices under HIPAA; and (b) Information concerning the health care consumer's right to opt out from participation in the HIE and the process to opt out; and (c) The types of information the participating organization will disclose to the HIE and for what purposes information accessed through the HIE may be used for treatment, payment, health care operations, and secondary use as described in this chapter. (2) In addition to applicable HIPAA notification requirements, a participating organization shall notify each health care consumer whose protected health information, including sensitive health information, is breached or is maintained, accessed, used, or disclosed in a manner that constitutes a non-HIPAA violation in accordance with Regulation .08 of this chapter. #### Regulation .04 Access, Use, or Disclosure of Sensitive Health Information. *COMAR 10.25.18.04* A. Consistency with Disclosure Requirements Under Federal and State Law. (1) A person shall comply with all relevant State and federal laws, including 42 CFR Part 2, and Health-General Article, §4-302.5, Annotated Code of Maryland, concerning the access, use, or disclosure of sensitive health information through an HIE and maintenance of such information by an HIE. (2) If federal or State law requires written consent or authorization for access, use, or disclosure of sensitive health information, a person shall obtain consent or authorization consistent with the applicable law prior to the access, use, or disclosure of sensitive health information to and through an HIE to an authorized recipient. (3) If federal or State law does not require written consent or authorization for access, use, or disclosure of sensitive health information, a person may not require consent or authorization prior to the access, use, or disclosure of the sensitive health information through an HIE. (4) An HIE shall use only point-to-point transmission to allow access, use, or disclosure of the sensitive health information through an HIE, unless the HIE implements: (a) Nationally recognized standards that support control by the health care consumer over the electronic exchange of the patient's sensitive health information consistent with the privacy and consent directives made by the health care consumer; (b) Electronic exchange controls and processes that: (i) Support granular patient consent for the electronic transmission of sensitive health information consistent with applicable State and federal laws concerning the access, use, or disclosure of sensitive health information, including applicable standards and technical requirements in accordance with Part 2; and (ii) Assure that the health care consumer's granular consent controls remain associated with the sensitive health information and are adhered to as the information is transmitted through, maintained, or disclosed by the HIE; and (c) Health care consumer educational content: (i) That is developed and established in coordination with the Commission and stakeholders; (ii) That is kept current; and (iii) The receipt of which shall be acknowledged by the health care consumer as part of the granular consent process. (5) In the case of the improper access, use, maintenance, or disclosure of sensitive health information, including an inadvertent release through an HIE, a participating organization shall take the following actions in addition to any other requirement imposed under federal or State law: (a) Take all steps necessary to immediately stop any further improper access, use, disclosure, or release of the patient's sensitive health information through the HIE and the improper maintenance of such information by the HIE; and (b) In accordance with Regulation .08 of this chapter, notify each health care consumer whose sensitive health information has been accessed, used, maintained, or disclosed in violation of applicable State or federal laws, including a non-HIPAA violation. B. Procedure for Disclosing or Re-disclosing of Part 2 Health Information. (1) An HIE shall be in compliance with Part 2 (2) A participating organization that is a Part 2 program, as that term is defined by Part 2, shall identify itself as such and clearly indicate with all of its patient records any limits on use or disclosure required by Part 2. (3) An HIE or participating organization that receives Part 2 information may not re-disclose such information without appropriate patient consent or authorization except as permitted by applicable federal and State laws and regulations. C. Procedures for Disclosing or Re-Disclosing Legally Protected Health Information. (1) An HIE shall be in compliance with Health-General Article, §4-302.5, Annotated Code of Maryland, and COMAR 10.11.08. (2) By January 8, 2024, an HIE shall submit to the Commission: (a) An affirmation that it: (i) Possesses the technological capability to filter and restrict from disclosure legally protected health information to the extent required by law; (ii) Is parsing restricted codes and conveying all other information in the health record that is not prohibited by law to exchange; and (iii) Possesses the technological capacity to allow a consumer to request and consent to the exchange of legally protected health information to a specific treating provider; or (b) An implementation plan that includes: (i) An affirmation that, despite its best efforts, the HIE lacks the technological capability to fully comply with §C(1) of this regulation as of January 8, 2024, including a detailed explanation of the HIE’s limitations; (ii) A detailed description of the steps the HIE is taking to ensure compliance with §C(1) of this regulation by June 1, 2024; (iii) A timeline to implement the requirements of Health-General Article §4-302.5, Annotated Code of Maryland, by June 1, 2024; and (iv) A description of the extent legally protected health information and other health information will be restricted through the HIE during the implementation of its plan. (3) If an HIE submits an implementation plan in accordance with §C(2)(b) of this regulation, the HIE shall: (a) Notify all participating organizations by January 8, 2024, that the HIE is unable to comply with §C(1) of this regulation with a written notice that describes the extent legally protected health information and other health information will be restricted through the HIE during the implementation of its plan; (b) Provide a status report to the Commission by April 1, 2024, detailing the progress the HIE has made under its implementation plan; and (c) Submit validation to the Commission by June 1, 2024, that it possesses the technological capability to filter and restrict from disclosure legally protected health information to the extent required by law. (4) The Commission shall consider an HIE’s implementation plan and reported progress when assessing penalties for a violation of this section. #### Regulation .05 Requirements for Accessing, Using, or Disclosing Health Information Through an HIE. *COMAR 10.25.18.05* A. As a requirement of participation in an HIE, the HIE shall require each participating organization to enter into a binding participation agreement that: (1) Requires the participating organization and each authorized user to comply with this chapter; (2) Requires the participating organization and each authorized user to comply with all applicable federal and State privacy and security laws; and (3) Includes a business associate agreement: (a) In compliance with 45 CFR §164.504; and (b) If the participating organization will maintain Part 2 information, the business associate agreement shall comply with the additional requirements that apply to a qualified service organization under 42 C.F.R. §2.11. (4) Permits PHI disclosed through the HIE to the authorized user of a participating organization to be incorporated into the patient’s medical record kept by such participating organization, and requires compliance with all applicable federal and State laws. B. An HIE shall only disclose PHI through an HIE for a primary use consistent with the following: (1) The disclosure shall be only to an authorized user for the specific purpose for which that authorized user is given access to the PHI; and (2) All disclosures shall be in full compliance with these regulations. C. The Commission may suspend the registration, in accordance with Regulation .09 of this chapter, of a registered HIE that inappropriately discloses to any person any PHI, or health information derived from PHI, that is available through the HIE’s infrastructure, except as consistent with or otherwise permitted by this chapter and applicable federal or State law. D. To assure that only an authorized user accesses, uses, or discloses PHI through or from an HIE, an HIE shall: (1) Develop and maintain an HIE access matrix that includes the defined HIE access levels available to each authorized user. (a) The HIE access matrix shall be used for the following purposes: (i) To assign an HIE access level to each staff member of the HIE or its contractor that allows only the minimum necessary access to PHI to perform that staff member’s authorized purpose; and (ii) To assist each participating organization and its system administrator in assigning the appropriate HIE access level to each authorized user of that participating organization. (b) The HIE shall review its HIE access matrix annually and revise it as necessary to reflect relevant changes in technology, standards, or law; and (c) The HIE shall have the necessary technological capabilities in its core infrastructure to limit an authorized user’s access to the HIE according to the then currently assigned access level of its access matrix. (2) Provide technical assistance and guidance to the system administrator of each participating organization in assigning the appropriate HIE access level to each of its authorized users; (3) Comply, at a minimum, with the most recent Level 2 requirements set by the National Institute of Standards and Technology (NIST), as set forth in April 2006 in Special Publication 800-63 (Version 1.0.2): Electronic Authentication Guideline for both Registrations and for Registration Record Retention; and (4) Adopt and implement an authentication process that: (a) Requires the authentication of an authorized user at each “log in” prior to allowing that individual access to the HIE; (b) Requires a single factor authentication with two characteristics that include a user name and a password, along with an additional security precaution, which may include a security question or a device registration. (c) Ensures that the data stored in the HIE that is used to authenticate an authorized user is encrypted to the level set by industry best practices; and (5) Accept as valid a third party system’s authentication of an authorized user accessing the HIE through that third party system, as long as such access and third party system: (a) Permits the HIE to audit and monitor the user’s HIE activities; and (b) The HIE has received written assurances from the third party system that it is compliant with these regulations and all applicable federal and State privacy and security regulations. (6) If an HIE learns or has reason to believe that the third party system is not compliant, then it shall immediately cease acceptance of such third party system’s authentication of authorized users until the third party system demonstrates compliance to the reasonable satisfaction of the HIE. E. To assure that only an authorized user accesses, uses, or discloses PHI through or from an HIE, a participating organization shall comply with each of the following. (1) A participating organization shall designate a system administrator who is capable of carrying out the requirements set forth in §F of this regulation on behalf of the participating organization prior to exchanging any PHI through the HIE. (2) A participating organization shall promptly inform its system administrator of any circumstances that require any of the actions described under §F of this regulation; (3) A participating organization shall ensure that any third party system it uses appropriately authenticates an authorized user prior to allowing that individual access to the HIE through the third party system. (a) The third party system shall authenticate an authorized user at each “log in.” (b) The third party system shall ensure that the data stored in the system which is used to authenticate an authorized user is encrypted to the level set by industry best practices. (c) A participating organization shall adopt and implement a protocol to be followed by a third party system that requires a user name, a password, and an additional security precaution which may include a security question or a device registration. (4) A participating organization shall inform the HIE concerning the following: (a) The designation of the system administrator, or any change in such designation, within 5 business days of any such designation or change; (b) A breach or non-HIPAA violation by a person who had or has access to the HIE through the participating organization; or (c) An act or event that it has a reasonable basis to believe is or may be a significant violation of this chapter. F. The system administrator of a participating organization shall carry out each of the following measures on behalf of the participating organization. (1) The system administrator shall identify each authorized user within the participating organization and shall note the individual’s assigned unique user name in accordance with the most recent applicable standards issued by NIST, or other comparable standards generally adopted by the health care and HIE industry. (2) The system administrator and HIE shall coordinate with the Commission to determine a methodology for assigning each authorized user with a unique user name and password and to assure that all HIEs use a commonly accepted protocol to avoid the possibility of duplicate user names and passwords. (3) The system administrator, in coordination with the HIE, shall assign to each authorized user an access level that appropriately corresponds to that individual’s role within the participating organization and the permitted access to PHI available through the HIE on behalf of the participating organization. (4) The system administrator shall modify in a timely manner an authorized user’s access level as appropriate to reflect any change in that individual’s role within the participating organization; and (5) The system administrator shall immediately terminate access through an HIE in accordance with Regulation .07 of this chapter for any authorized user: (a) Who is suspended by the participating organization; (b) Who is no longer associated with the participating organization; or (c) Who no longer requires access to the HIE. (6) The system administrator shall attest to the HIE regarding the appropriateness of a staff member to be an authorized user and that the HIE access level assigned to that staff member corresponds to the authorized user’s role within the participating organization. #### Regulation .06 Auditing Requirements. *COMAR 10.25.18.06* A. In order to ensure that only an authorized user who is appropriately authenticated is granted access to HIE information, an HIE shall: (1) Develop and implement protocols, methodologies, and a monitoring approach designed to discover any unusual finding, which may be identified within an audit of the user access logs, including conducting ongoing electronic monitoring of user access logs and investigate any unusual findings in accordance with this chapter; (2) Conduct each audit under this regulation in accordance with best practices using industry accepted standards and methodologies; (3) Conduct random audits of the user access logs to identify any unusual finding; and, if the HIE has been notified about an unusual finding or has reason to believe that inappropriate access has occurred, conduct random audits at least every other week until the unusual finding or inappropriate access has been mitigated; (4) At least quarterly, conduct random audits of security measures and any other forms of data security in place to determine if they are still sufficient and compliant with applicable standards; (5) Investigate each unusual finding identified in the access log audit to determine if there has been a violation of Regulation .05 of this chapter; (6) Resolve an unusual finding by: (a) Taking actions necessary to correct each identified technical control deficiency; or (b) Taking remedial action under Regulation .07 of this chapter; (7) Report any unusual finding to each participating organization involved in the unusual finding, as follows: (a) If the unusual finding involves fewer than 10 patients, within 5 business days after the unusual finding is discovered; (b) If the unusual finding involves between 10 and 50 patients, within 2 business days after the unusual finding is discovered; and (c) If the unusual finding involves more than 50 patients, within 1 business day after the unusual finding is discovered; and (8) Maintain an audit trail of user access logs in a retrievable storage medium, as follows: (a) The HIE shall perform periodic testing to ensure that the storage medium being used will allow the data to be recovered. (b) The HIE shall perform periodic testing and implement upgrades and updates to ensure that the storage medium is secure and has not been improperly accessed. (c) The data shall be kept for the longest duration of time identified in applicable State and federal requirements. B. When an HIE has identified a potential breach or non-HIPAA violation, the HIE shall conduct an unscheduled audit within 30 days that: (1) Gathers relevant information to determine if there is a violation; (2) Reflects the size and scope of the potential violation; and (3) Complies with Regulation .08 of this chapter. C. An HIE shall at least annually enlist a qualified independent auditing firm to audit its privacy, security, and legal compliance in accordance with the following provisions: (1) The audit shall: (a) Assess potential risks to protect the confidentiality, integrity, and security of PHI; (b) Assess operational compliance with State and federal law, including the requirements of this chapter; (c) Be designed to determine the adequacy of business and technology-related controls, policies, and procedures and other safeguards employed by third-party service organizations based on industry standards and best practices; and (d) Include an assessment of cybersecurity posture and compliance with this chapter, applicable provisions in HIPAA and HITECH, and recognized security practices by way of accreditation or certification from a nationally recognized entity. (2) An HIE shall develop auditing policies and procedures for the independent auditor to conduct such an audit, which shall include, at a minimum: (a) The scope of the audit; (b) A description of all third-party organizations and processes to review and assess related privacy and security controls and audit reports; (c) Interviews with relevant staff, including those from third-party service organizations, as appropriate; (d) Names and contact information of all persons responsible for reviewing and maintaining privacy and security to include the implementation of corrective actions to address apparent gaps; and (e) Time frames for completing audits and related activities. (3) An HIE shall provide the audit findings to the Commission in accordance with Regulation .09 of this chapter. (4) If an audit detects unusual findings, an HIE shall investigate and resolve the matter in accordance with this regulation. D. Upon the request of the Commission and consistent with the specifications in such request, an HIE shall: (1) Provide a summary of the results of any audit that is required by this chapter, and any corrective action plans identified by the audit, to the Commission; and (2) Conduct an additional unscheduled audit within 180 days of the request and provide the results of such an audit to the Commission within the time frame specified by the Commission. E. If an HIE’s audit reveals information that demonstrates a pattern of inappropriate access, use, maintenance, or disclosure of information that constitutes a breach or non-HIPAA violation, or if the health information of more than ten patients was improperly used, accessed, maintained, or disclosed during the 12 months prior to the audit, then: (1) The HIE shall use the findings from the audit to: (a) Educate and train all impacted persons, which may include its workforce, participating organizations, and authorized users on proper access, use, and disclosure of information through or from the HIE; and (b) Evaluate and implement new control measures, including policies, procedures, or technology, to ensure proper use and access of the HIE; and (2) The HIE shall take the appropriate measures specified in Regulation .07 of this chapter. F. If an HIE’s audit reveals information that demonstrates a pattern of noncompliance with State and federal law, then: (1) The HIE shall use the findings from the audit to: (a) Educate and train all impacted persons, which may include its workforce, participating organizations, and authorized users on proper access, use, and disclosure of information through or from the HIE; and (b) Evaluate and implement new control measures, including policies, procedures, or technology, to ensure compliance; and (2) The HIE shall take the appropriate measures specified in the Regulation. 07 of this chapter. G. An HIE and its participating organizations shall adopt an access and auditing plan that requires the HIE and each participating organization, as applicable, to conduct a random audit of the HIE access logs on a monthly basis. (1) The random audit included in the plan shall be assigned to the HIE or the participating organizations according to their respective system's technological capabilities. (2) The access and auditing plan shall include: (a) The manner used to identify a non-HIPAA violation of this chapter or a breach; (b) The method to be used to report a non-HIPAA violation of this chapter or a breach; (c) The reasonable steps that will be taken to promptly mitigate a non-HIPAA violation of this chapter or a breach; and (d) A review of access logs to ensure that only an authorized user who is appropriately authenticated is granted access to HIE information through a participating organization's third party system. (3) If a participating organization does not conduct its own audit, it shall review the HIE access logs relating to the participating organization within 10 days of receipt from the HIE. An HIE shall send HIE access logs to each participating organization no less than quarterly. (a) The purpose of the review is to: (i) Detect patterns of inappropriate access, use, maintenance, or disclosure; and (ii) Compare the PHI accessed by the authorized user with the health care provided to assure that the authorized user's use of the HIE is appropriate. (b) In order to conduct the quarterly review, the HIE shall provide a participating organization with audit record information concerning the participating organization's authorized users access of the HIE that shall include: (i) The name and access level of each user; (ii) The name of the patient whose PHI was accessed; (iii) The date and time of access; and (iv) The type of PHI that was accessed. #### Regulation .07 Remedial Actions to Be Taken by an HIE. *COMAR 10.25.18.07* A. An HIE shall immediately suspend a person's access to the HIE when it is necessary to avoid serious harm to the privacy or security of health information accessed, used, or disclosed through or from the HIE. (1) An HIE may, in its sole discretion, suspend a person's access to the HIE pursuant to this section before an investigation under Regulation .07B of this chapter is completed. In addition, if the HIE determines that serious harm to the privacy or security of health information or an ongoing risk of improper use, access, maintenance, or disclosure of PHI may occur prior to conclusion of an investigation, it shall suspend a person’s access to the HIE pursuant to this section before an investigation is complete. (2) Such suspension shall continue until the underlying threat to the privacy or security of health information is contained. B. An HIE shall conduct an investigation if there is reason to believe that a breach or non-HIPAA violation has occurred. (1) The HIE shall begin the investigation upon learning of the allegations giving rise to a potential breach or violation. (2) The HIE shall conduct the investigation in a thorough, timely, professional manner and take all necessary actions to gather information concerning the potential breach or violation that reflects the size and scope of such potential breach or violation. (3) If appropriate, an investigation shall include an audit under Regulation .06 of this chapter. (4) Upon the completion of an investigation, which shall not exceed 14 business days, an HIE shall: (a) Make a written finding describing the results of an investigation and provide a copy to the Commission; and (b) Maintain records of each investigation (audits, complaints, breaches, non-HIPAA violations) for at least 5 years from the date of completion of such investigation or 5 years from the date a minor patient becomes an adult, whichever is longer. C. If an HIE has a reasonable belief that a breach or non-HIPAA violation has occurred, either as a result of an investigation or otherwise, the HIE shall: (1) For a breach, follow Regulation .08 of this chapter and federal breach notification requirements and timelines; (2) For non-HIPAA violations, submit a corrective action plan to the Commission within 10 business days of conclusion of its investigation, which shall include: (a) Any remedial action necessary to address the breach or violation as soon as practicable; (b) Any steps necessary to correct the underlying problem, such as a change in processes or procedures, new technology, and training; and (c) An appropriate and reasonable time frame for implementing the remedial action; (3) Within a reasonable time frame, but in no event more than 10 business days following the investigation, provide the following to the Commission, and to the participating organizations: (a) A copy of the findings of the investigation, excluding any PHI or sensitive health information; (b) Each remedial action to be taken by each person and the associated time frame of the remedial action; (c) Any action necessary to mitigate the harm that may be caused by the breach or the non-HIPAA violation; (d) The identity of the person that is responsible for carrying out each action to mitigate harm; and (e) Any future action that the HIE may take, including suspension of access or progressive discipline, if a person does not comply with the remedial action; (4) Immediately suspend access of a person when one of the following occurs: (a) Available information demonstrates a significant breach by the person; (b) Available information demonstrates a significant non-HIPAA violation by the person; (c) Available information demonstrates a violation of State or federal law relevant to privacy or security by the person; (d) The person has sold health information accessed through the HIE in violation of these regulations; (e) The person has failed to carry out the remedial actions identified by the HIE; or (f) The Commission issues a request for suspension of the person as provided in Regulation .09 of this chapter; and (5) Notify the health care consumer pursuant to Regulation .08 of this chapter, if such notification is required under applicable law, including HIPAA, or if so directed by the Commission. D. After verifying that each remedial action is complete, an HIE may reinstate a person's authorization to access information through the HIE provided that: (1) The Commission has not revoked the person's access to the HIE as provided in Regulation .09 of this chapter; and (2) The HIE modifies the person's access as needed to ensure compliance with this chapter. E. A person may file a written notice or request with the Commission that the Commission review an HIEs action under Regulation .07 of this chapter when the person has reason to believe that the HIE has acted inappropriately. (1) A request for review shall be filed within 30 days after the person knew or had reason to know of the HIEs action in question; (2) The request for review shall set forth each reason why the person believes that the HIE's action is inappropriate. (3) The Commission may determine that no investigation is necessary or may take action under Regulation .09C. F. An HIE shall provide notice of each suspension and each reinstatement of a person's authorization to access information through an HIE in the following manner: (1) The HIE shall send an electronic notice to the person who is the subject of the action within 24 hours of the suspension or the reinstatement and to the Commission on a monthly basis. (2) The notice shall include: (a) The name of the person who is the subject of the action; (b) The name of any affected participating organization; (c) The basis for the suspension or reinstatement; and (d) The effective date of the suspension or reinstatement. (3) The notice shall not include PHI. (4) The notice shall not be considered confidential. #### Regulation .08 Notice of Breach and non-HIPAA Violation. *COMAR 10.25.18.08* A. Notification of a breach shall be required consistent with notification requirements of applicable federal and State laws, including HIPAA and the HITECH Act. B. When federal or State law does not require an HIE or other entity to provide notification to a participating organization or to an effected health care consumer, or when Part 2 does not mandate other notification requirements, the HIE shall provide notification of breach and, if applicable, non-HIPAA violations pursuant to this chapter. (1) If the investigation under Regulation .07 of this chapter concluded that there was a breach or non-HIPAA violation, in addition to applicable HIPAA notification requirements, the HIE shall notify: (a) The person who notified the HIE of the potential breach or non-HIPAA violation, if applicable, and to the extent permitted by HIPAA and other federal and State privacy laws; (b) Any participating organization that has provided health information regarding the health care consumer involved; and (c) Each patient or person in interest acting on behalf of each patient whose PHI or sensitive health information was inappropriately accessed or disclosed due to a breach or non-HIPAA violation. (2) In addition to other requirements specified in this section, the HIE shall include in its notification, the contact information for the HIE, including the address and toll-free telephone number where the health care consumer can learn more information. C. Notification to a Health Care Consumer. (1) If the entity providing the notification under this Regulation has knowledge that another person is acting as the health care consumer for the patient, the entity shall provide the notification to that person instead of the patient. (2) A notification to the health care consumer required under this Regulation shall be: (a) In writing by first-class mail to the health care consumer, at the last known address of the health care consumer, if no prior election as to notice has been made; or (b) As specified as a preference by the health care consumer under Regulation .03H of this chapter. (3) If there is insufficient or out-of-date contact information that precludes notice consistent with this chapter, a substitute form of notice shall be provided. A substitute form of notice may include publishing the notice on the home page of the entity's website to the extent permitted by HIPAA and other federal and State privacy laws. (4) When notice about a breach or non-HIPAA violation is required pursuant to this chapter, a participating organization or an HIE, as required, shall notify a health care consumer in writing within a reasonable time frame, but not later than 60 days from the discovery of the breach or from the date that the HIE should have reasonably discovered the breach. (5) The written notification shall include: (a) A description of the breach or non-HIPAA violation that occurred and the remedial actions taken by the participating organization, provided that the notification shall not contain any sensitive health information; (b) Information about the patient's right to notify credit reporting agencies of the potential for identity theft or medical identity theft; (c) Contact information for the HIE, including the address and toll-free telephone number where the health care consumer can learn more information; (d) Contact information for at least one credit reporting agency; (e) Information concerning the patient's right to opt out of the HIE; and (f) The toll-free numbers, addresses, and websites for: (i) The Office of the Attorney General, Consumer Protection Division; and (ii) The U.S. Department of Health and Human Services, Office of Civil Rights. (6) If the entity providing the notification keeps a medical record on the patient, the notification shall be placed within the patient's medical record. D. Notification to Appropriate Authorities. (1) Each participating organization and each HIE shall report all violations of federal or State privacy or security law to: (a) Those federal or State authorities to which reporting such violation is required by applicable law, whether or not such laws are specifically set forth in this chapter; and (b) Shall promptly send a copy of such report to the Commission. (2) If the Commission is notified of a breach under this regulation, it shall forward such notification to the Office of the Attorney General, Consumer Protection Division, within 30 days after receipt of the notification. #### Regulation .09 Registration and Enforcement. *COMAR 10.25.18.09* A. To operate an HIE in the State, a person shall be recognized by the Commission as having met requirements for registration. (1) A person shall complete an application for registration in a form and manner specified by the Commission that shall include: (a) The HIE's definition of what constitutes an unusual finding within Regulation .06 of this chapter; (b) The HIE's current audited financial statement that demonstrates the financial viability of the HIE; (c) The identity of the HIE's registered resident agent who shall accept service in Maryland on behalf of the HIE; (d) Documentation showing its technical capabilities, which may include accreditation or candidacy status by a nationally recognized accrediting body; and (e) Provisions for reasonable notice to participating organizations and the Commission if the HIE ceases to operate in Maryland; and (f) Other information as required by the Commission. (2) Financial Integrity. (a) Following review of the financial statement provided by the HIE under §A(1)(b) of this regulation, the Commission may require a bond, letter of guarantee, or other financial instrument from the HIE, its parent company, or other responsible person. (b) The amount of a bond, letter of guarantee, or other financial instrument required under this regulation shall be established by the Commission and be based on an HIE's financial statement. (c) If a bond is required under §A(2)(a) of this regulation, it shall at a minimum: (i) Identify the Commission as the sole beneficiary; (ii) Be continuous and subject to cancellation only after 60 days' notice to the Commission; (iii) Contain the following language or similar language acceptable to the Commission: “Payment under this bond shall be due in the event the Commission determines that the HIE is financially insolvent or unable to meet its obligations as a registered HIE in Maryland”; and (iv) Permit the Commission to direct that the proceeds of the bond be paid or disbursed as necessary to maintain or repair the privacy and security of PHI that was or is available through the HIE. (d) If a bond is required under §A(2)(a) of this regulation, it shall be obtained from a company licensed in the State to write surety types of insurance. (e) If a letter of guarantee or other financial instrument is required under §A(2)(a) of this regulation, the guarantor shall submit a current balance sheet and income statement to the Commission. (3) Within 45 days after receipt of complete information from an applicant seeking to register as an HIE in the State, the Commission shall take one of the following actions: (a) Recognize the HIE as registered in the State; or (b) Deny the registration for reasons enumerated to the applicant. B. The Commission shall annually renew the registration of an HIE registered in the State that demonstrates its continued compliance with this chapter and provides the following information in a form and manner specified by the Commission, within 120 days of the close of its fiscal year: (1) Updated information that reflects each change regarding the items in §A(1) of this regulation; (2) Results of an audit performed in compliance with Regulation .06 of this chapter; (3) As deemed appropriate by the Commission, additional requirements set forth in §A(2) of this regulation; and (4) Other information as requested by the Commission. C. The Commission may take an enforcement action against a person when there is reasonable basis to believe that the person has violated a provision of this chapter. (1) The Commission may conduct any investigation into a potential violation. (a) A person shall cooperate in an investigation conducted by Commission staff into a potential violation. (b) A person shall provide information sought by Commission staff within 10 business days of its request for such information, unless an extension of time is sought for good cause shown and granted by the Commission. (2) After an investigation under §C(1) of this regulation, the Commission staff may issue a notice of proposed action that includes: (a) The details regarding each violation or potential violation; (b) A request for a person to submit a corrective action plan in order to achieve compliance with this chapter, which may include: (i) An action aimed at correcting the underlying issue; and (ii) Any other action that is appropriate under the circumstances. (c) A recommended resolution of the potential violation, which may include: (i) Non-public reprimand; (ii) Public reprimand; or (iii) Limitations on HIE registration or a person's access to information through an HIE; (iv) Suspension of HIE registration or a person’s access to information through an HIE; (v) Revocation of HIE registration or a person’s access to information through an HIE; (vi) Financial penalties in accordance with §C(3) of this regulation; or (vii) Referral to another State or federal agency for civil or criminal enforcement. (3) Civil and Criminal Penalties. (a) Civil Penalties. A person who knowingly fails to comply with this chapter shall be subject to a civil penalty imposed by the Commission not exceeding $10,000 per day based on: (i) The extent of actual or potential public harm caused by the violation; (ii) The cost of the investigation; and (iii) The person’s prior record of compliance. (b) Criminal Penalties. Beginning June 1, 2024, a person who knowingly violates Health-General Article, §4-302.5, Annotated Code of Maryland, shall be guilty of a misdemeanor and on conviction is subject to a fine not to exceed $10,000 per day based on: (i) The extent of actual or potential public harm caused by the violation; (ii) The cost of the investigation; and (iii) The person’s prior record of compliance. (4) When the Commission staff determines that a notice of proposed action is not appropriate given the lack of available evidence or other circumstances, it may issue one of the following: (a) A letter advising that no action is recommended at that time; or (b) A letter finding that no action is warranted. D. A person who receives a notice of proposed action from the Commission staff may request an opportunity to show cause why the proposed action should not be taken. (1) A written request to show cause shall be filed with the Commission and shall comply with the following: (a) It shall be filed within 20 days of the issuance of the notice of proposed action; and (b) It shall include each fact upon which the person relies to show cause why the proposed action should not be taken. (2) Upon receipt of a request to show cause, the Commission staff may meet with the person to attempt to resolve the matter in a manner that protects the public and is in the public interest. (3) If a notice of proposed action is not resolved within 45 days of the filing of a request to show cause, a hearing officer shall be designated by the executive director of the Commission. (a) The hearing officer shall hear evidence as needed; (b) The hearing shall be conducted in accordance with the Maryland Administrative Procedure Act, State Government Article, Title 10, Annotated Code of Maryland, and these regulations. (c) The hearing officer shall issue a recommended decision that contains proposed findings of fact and conclusions of law and may recommend that the Commission take one of the following actions: (i) Adopt the action proposed by Commission staff; (ii) Adopt a proposed action recommended by the hearing officer; or (iii) Find that no action is warranted. E. A request that the Commission not adopt the recommended decision may be made by either Commission staff or a person who is the subject of an enforcement action. (1) Written exceptions to the recommended decision shall be filed within 20 days of receipt of the hearing officer's recommended decision. (2) Exceptions shall specifically identify in writing each finding and conclusion to which exception is taken, citing those portions of the record on which each exception is based. (3) A written response to exceptions to the recommended decision may be filed by an opposing party within 15 days of receipt of exceptions. (4) Each person taking or responding to exceptions may present oral argument to the Commission, not to exceed 10 minutes per party, unless extended by the Chair of the Commission. (5) The decision of the Commission shall be by a majority of the quorum present and voting. F. The Commission may coordinate with the Office of Attorney General concerning any potential violation involving a matter within the Attorney General’s authority pursuant to State or federal law. G. If an HIE has reasonably determined that it is unable to independently meet any requirements of this chapter, then the HIE shall develop and implement policies to ensure the HIE’s compliance through the execution of a written agreement with a participating organization or a business associate that will bring the HIE into compliance with this chapter. Every year as a part of the registration renewal process, the HIE shall submit a written attestation by an independent third-party auditor to the Commission, attesting that the HIE has been in full compliance with the requirements of this chapter for the 12-month period prior to the audit. H. Exemptions. (1) An HIE may request a 1-year exemption from certain requirements of this chapter. (2) An exemption request must: (a) Be in writing; (b) Identify each specific requirement of this chapter from which the HIE is requesting an exemption; (c) Identify the time period of the exemption, if any; (d) State the reason for each exemption request; and (e) Include information that justifies the exemption request. (3) Within 45 days after receipt of complete information from an HIE requesting an exemption, the Commission shall take one of the following actions: (a) Grant the exemption by providing written notification; or (b) Deny the exemption request by providing written notification that enumerates the reasons for the denial to the HIE. (4) An exemption may not be made for any requirement within this chapter that is otherwise required of the HIE by federal or other State law. (5) An exemption may be made on the following grounds: (a) The absence of certain functionality in the infrastructure of the HIE that does not allow the HIE to maintain compliance with the requirement; (b) The requirement would hinder the ability of the HIE to comply with other requirements of this chapter or federal or other State laws; or (c) The requirement would cause an undue burden or hardship on the HIE, such that the HIE would no longer be able to provide HIE services in the State. (6) For good cause shown, the Commission may renew a 1-year exemption for an additional 1-year period. #### Regulation .10 Requirements for Accessing, Using, or Disclosing of Data Through an HIE for Secondary Use. *COMAR 10.25.18.10* A. An HIE may not use or disclose a patient’s sensitive health information for secondary use unless permitted by applicable federal or State laws and regulations. B. Population Health Management. (1) An HIE may disclose de-identified data or a limited data set, as defined at 45 CFR §164.514(e), to a care management organization for purposes related to population health management, if approval is obtained from an internal review committee designated by the care management organization, which has: (a) Entered into a data use agreement with the HIE; and (b) Attested that the request is: (i) For population health management purposes; and (ii) Limited to the minimum necessary to complete the function. (2) An HIE may disclose individually identifiable health information to a care management organization for purposes related to population health management, if: (a) The requirements of §B(1) of this regulation are met; (b) Appropriate notice has been provided to health care consumers whose information is being requested, and either: (i) The health care consumers have authorized the release of their information to the requesting entity; or (ii) An external and independent review committee has waived the need for the requesting entity to obtain authorization from those health care consumers who were provided appropriate notice, in accordance with Regulation .02B(4) of this chapter; and (c) The disclosure is consistent with the authorization. (3) Any external and independent review committee identified by the care management organization may approve an authorization waiver request where the requesting care management organization has demonstrated that: (a) Appropriate notice to each health care consumer was provided and no authorization or denial of authorization was received from each health care consumer within the 30-day time frame; (b) The objectives for which the data was requested could not be met without access to the requested data; and (c) The requested use or disclosure involves no more than minimal risk to the privacy of those health care consumers whose authorization will be waived based on the presence of attributes that include, at a minimum: (i) An adequate plan presented to the external and independent review committee to protect PHI from improper use, storage, and disclosure in accordance with current legal requirements and industry standards and practices as determined by the external and independent review committee; (ii) An adequate plan to destroy the PHI when the purposes for which it has been requested are completed, unless such retention is authorized under the waiver or otherwise required by law; and (iii) Adequate written assurances that the PHI will not be reused or disclosed to any person or entity, except as authorized under the waiver, as required or permitted by law, or for authorized oversight of the use. (4) An HIE may not disclose a patient’s sensitive health information for population health management purposes unless permitted by applicable federal and State laws and regulations. C. Research. (1) An HIE may disclose de-identified data to a qualified research organization for research purposes if a privacy board has evaluated and confirmed that the: (a) Requesting entity is a qualified research organization; and (b) Requested data to be disclosed: (i) Is for purposes related to research; (ii) Is limited to the minimum necessary to complete the research purpose; (iii) Will be used to serve a legitimate purpose consistent with the interest of the subject individuals; and (iv) Meets the de-identification standard and specifications in accordance with 45 CFR §164.514(a)—(c). (2) An HIE may disclose individually identifiable health information to a qualified research organization for research purposes if: (a) Approval is obtained from an IRB or privacy board in accordance with 45 CFR §164.512, including documentation of waiver approval as detailed in 45 CFR §164.512(i)(2); and (b) The IRB or privacy board has evaluated the request and confirmed that the requirements of §C(1)(a) and (b)(i)—(iii) of this regulation are met. (3) If an IRB or privacy board does not waive or alter the requirement of authorization from health care consumers whose individually identifiable health information is to be disclosed, an HIE may only disclose individually identifiable health information of health care consumers who have provided authorization, which must meet the requirements as set forth in 45 CFR §164.508. (4) If an IRB or privacy board declines jurisdiction, then the disclosure of individually identifiable health information may only be made if health care consumer authorization is obtained. (5) As part of an HIE’s data use agreement with an entity to which it disclosed individually identifiable health information for secondary use, there shall be oversight by an IRB or privacy board for the duration of the research use. (6) If an IRB or privacy board determines that the qualified research organization has failed to use or protect the data in accordance with the approved secondary use, the IRB or privacy board must report its findings to the HIE and the HIE must: (a) Report the findings to federal and State agencies with jurisdiction over the violation, as deemed appropriate; (b) Immediately terminate the data use agreement; and (c) Direct the qualified research organization to destroy the data previously released by the HIE and attest that the data has been destroyed. (7) The qualified research organization receiving data from an HIE for research purposes: (a) Must contractually agree not to attempt to link de-identified data received from the HIE with other data sources in an effort to re-identify the data, or otherwise attempt in any other way to re-identify the data; and (b) May disclose data to a third party acting on behalf of the qualified research organization only if the qualified research organization and third party enter into a data use agreement that requires the third party to be bound by the same provisions in the data use agreement between the HIE and qualified research organization. (8) An HIE may charge a reasonable fee to a qualified research organization to which it discloses data for research, which fee must reflect the effort and be no greater than the actual direct and indirect costs required to prepare and release the data specific to the purpose authorized. (9) An HIE may not disclose a patient’s sensitive health information for research purposes unless permitted by applicable federal or State laws and regulations. D. Enforcement and Reporting. (1) An HIE is not required to take legal or equitable action to enforce the requirements of the data use agreement or of any other contractual assurance provided for in Regulation .05C of this chapter. (2) An HIE shall make summary reports available to the public quarterly that provide specific information about requests for data for secondary use and the release of data for secondary purposes. (3) An HIE shall report at least annually to the Commission and more frequently, if requested by the Commission, regarding the release of information for population health management. The Commission may: (a) Require a care management organization to provide additional information for review by the Commission or the Commission’s designated third party regarding the care management organization’s use of data from an HIE for population health management; (b) Require the HIE to conduct an audit of the disclosure and use of the data utilizing a third-party auditor at the expense of either the recipient of the data or the HIE, as determined by Commission; (c) Require the receiving entity to destroy the data received and cease any further use of the data; or (d) Prohibit an HIE from releasing data for all or certain secondary data use purposes. (4) An HIE shall, upon the request by a health care consumer, provide an accounting of any disclosures made to a receiving entity for secondary data use purposes, in accordance with Regulation .03C(4) of this chapter. #### Regulation .11 Requirements for Accessing, Using, or Disclosing of Data Through an HIE in an Emergency. *COMAR 10.25.18.11* A. An HIE shall develop and implement emergency access policies and procedures that satisfy the following requirements: (1) The policies and procedures shall be included in the HIEs health care consumer education materials required by Regulation .03B(1) of this chapter; and (2) Clearly communicate the following: (a) The extent to which the HIE has the capability to disclose the patient's information in an emergency and how this compares to disclosure for routine access; and (b) The circumstances under which the HIE would disclose the patient's information in an emergency, including how opting in or out of participation would impact access to the patient's information during an emergency. B. If an HIEs emergency access policy allows the disclosure of information during an emergency, the HIE shall: (1) Only disclose information to the requesting health care provider if the following conditions are met: (a) The requesting health care provider: (i) Advises the HIE that it is the health care provider's professional opinion that an emergency exists; and (ii) Attests that all conditions of the participating organization's policy have been met; (b) The patient's condition preclude the participating organization from obtaining the consent of the health care consumer; (c) Information available through the HIE may be relevant to the treatment needed by the patient in the specific emergency; (d) The participating organization has an established policy that describes the requirements and attestation process for emergency access; and (e) Disclosure of information available through the HIE is not in violation of applicable federal and State laws and regulations related to sensitive health information. (2) Establish technical procedures for documenting an attestation by the requesting health care provider that the conditions in §B(1) of this regulation, were met prior to accessing information through the HIE; (3) Review the emergency access logs at least monthly, in coordination with the participating organization, to identify any unusual finding; (4) Take action in accordance with Regulation .06 of this chapter, in the event the emergency access log reveals an unusual finding; (5) Maintain an audit trail of user emergency access logs in accordance with Regulation .06A(8) of this chapter; and (6) Require a participating organization to: (a) Access only the minimum necessary information needed to care for the patient during the emergency encounter; (b) Discontinue querying of the patient's record upon the completion of the emergency encounter; (c) Allow emergency access only to authorized users with the appropriate access designation consistent with the policy of the participating organization; and (d) Notify the health care consumer, as soon as reasonably possible, and no later than ten business days from the initial access, when the HIE has granted access to the health care consumer's information during an emergency. #### Regulation .12 Requirements for Providing Health Care Consumers Electronic Access to Their Health Information. *COMAR 10.25.18.12* A. An HIE or its third party that offers health care consumers electronic access to view, download, transmit, submit, or control their health information shall: (1) Appropriately verify the identity of the health care consumer requesting electronic access or proposing an addition or change to the patient’s information available through the HIE prior to disclosing or accepting changes to the information; (2) Follow, at a minimum, the National Institute of Standards and Technology (NIST) Level 2 registration and identity proofing requirements as outlined in the most recent version of Special Publication 800-63: Electronic Authentication Guideline or its comparable industry best practices and may perform remote identity proofing; (3) Implement the health care consumer’s authorization for access within a maximum of 5 business days of receipt of all necessary information for identity proofing; (4) Adopt and implement authentication processes for health care consumer electronic access that is in accordance with Regulation .05D(3) and (4) of this chapter; (5) Establish individual unique user names and passwords in accordance with the most recent applicable standards issued by NIST, or other comparable standards generally adopted by the health care and HIE industry; (6) Implement processes for auditing health care consumer access that are in compliance with applicable requirements of Regulation .06 of this chapter; (7) Implement a process for suspending and reinstating a health care consumer’s access in compliance with applicable requirements in Regulation .07 of this chapter; (8) Establish processes and procedures to allow a patient to authorize an individual to have electronic access to their information; (9) Establish processes and procedures that allow an individual to electronically access health information for a patient or patients: (a) For whom the individual has legal authorization for such access (e.g., guardian, person with a medical power of attorney, etc.); or (b) For whom the patient has authorized such access; (10) Establish processes and procedures to confirm the authority of a person in interest, if not directly authorized by a patient, which must be satisfied as a condition to providing access to that person in interest; and (11) Comply with applicable federal and State laws and regulations related to sensitive health information when disclosing such information to a health care consumer. B. An HIE or its third party that offers health care consumers electronic access to view, download, transmit, submit, or control their information may: (1) Charge a reasonable cost-based published fee for healthcare consumer electronic access consistent with applicable federal and State laws; and (2) Deny a health care consumer’s electronic access in accordance with: (a) Applicable law or regulation, including 45 CFR §164.524, in coordination with applicable participating organizations; or (b) The HIE’s reasonable policies, procedures, or agreements with a participating organization and shall provide notice to the health care consumer of their right to request access to the patient’s health information from the covered entity. C. An HIE or its third party that offers health care consumer electronic access to view the patient’s health information available through the HIE shall, in accordance with federal and State law: (1) Provide the patient’s health information that is equivalent to what is made available to authorized users that are health care providers, which may include: (a) Demographic information, such as name, address, and date of birth; (b) Provider encounters or procedures performed (e.g., hospital, ambulatory, post-acute care, etc.); (c) Immunizations; (d) Visit summaries; (e) Care plan(s); (f) Clinical test results; and (g) Prescriptions; (2) At a minimum, and if made available through the HIE, make the following data attributes for the patient’s health information electronically available to the health care consumer: (a) Date of the encounter, procedure, test, prescription, or immunization; (b) Results or summary of the encounter, procedure, test, prescription, or immunization; and (c) Source of the health information, including provider name and organization name; (3) Inform health care consumers regarding: (a) Contacting their health care provider to discuss the health information they may be viewing if they have any concerns or questions; and (b) Translation services and resources that may be available, through the HIE or another entity, to help assist the health care consumer in understanding their health information; and (4) Allow the health care consumer to view the patient’s health information in an electronic format that meets the following criteria: (a) The information is presented in substantially the same form and format as presented to an authorized user that is a health care provider; (b) The form and format presented to a health care consumer is easy for the health care consumer to navigate; (c) The information can be easily printed; and (d) If supplemental information is made available along with the patient’s health information, such as educational resources, the supplemental information meets the criteria specified in Regulation .03B(2)(c)—(e) of this chapter. D. An HIE or its third party that offers health care consumers the ability to electronically control the patient’s health information being made available through the HIE shall: (1) Implement technology processes that meet industry standards and best practices and are in compliance with State and federal privacy and security laws; and (2) Provide an electronic process by which a health care consumer can control the patient’s health information that is in accordance with §C(4)(b)—(d) of this regulation. E. An HIE or its third party that offers health care consumers the ability to download the patient’s health information being made available through the HIE shall provide the patient’s health information that is: (1) In accordance with §C(3) and (4)(b)—(d) of this regulation; (2) Requested by the health care consumer; and (3) In a readily available industry standard format. F. An HIE or its third party that offers health care consumers the ability to submit information to the HIE: (1) Shall identify the source of the information, such as patient, payor, or health care provider, when presented to an authorized user of the HIE; and (2) May not use patient submitted health information to override or replace health information submitted from other sources. G. An HIE or its third party that offers health care consumers the ability to transmit the patients’ health information being made available through the HIE to a third party of the health care consumer’s designation shall comply with the requirements as detailed in: (1) §C(3) of this regulation; (2) §C(4)(b) and (d) of this regulation; and (3) §E(2) of this regulation. H. Health Care Consumer Education About Electronic Access. (1) An HIE shall provide needed information, as part of its health care consumer education plan (as detailed in .03B(1) of this chapter and meeting the characteristics as detailed in Regulation .03B(2) of this chapter), about the services or features offered by the HIE or its third party that allows the health care consumer to electronically view, download, submit, or control the patient’s information that is available through the HIE. (2) The health care consumer education plan shall outline the process which, if available, allows a health care consumer to electronically view, download, transmit, submit, or control the patient’s information that is available through the HIE, including: (a) The information the health care consumer must provide as part of patient identity proofing; (b) The patient’s rights to: (i) Authorize a person in interest or individual to also have access to the patient’s health information; and (ii) Request a review of a denial of access; (c) The extent to which the health care consumer has control of the patient’s health information being made available through the HIE; and (d) The need to safeguard information obtained from the HIE to the same extent they safeguard other sensitive personal information. #### Regulation .13 Noncontrolled Prescription Drugs Dispenser Reporting. *COMAR 10.25.18.13* A. For each noncontrolled prescription drug dispensed, the dispenser shall report drug information to the State-designated HIE in accordance with this regulation. B. MHCC Noncontrolled Prescription Drugs Dispenser Data Submission Manual. (1) The Commission shall develop a MHCC Noncontrolled Prescription Drugs Dispenser Data Submission Manual. (2) The Commission shall approve a MHCC Noncontrolled Prescription Drugs Dispenser Data Submission Manual by June 1 of each year to be used for reporting by the last business day of September of the same calendar year. (3) The MHCC Noncontrolled Prescription Drugs Dispenser Data Submission Manual shall minimally: (a) Specify the data and prescription drug information that must be submitted by dispensers to the State-designated HIE in accordance with this regulation, including specifying the American Society for Automation in Pharmacy (ASAP) standard; (b) Specify the timeframe and frequency of data submissions to the State-designated HIE; (c) Require a dispenser to report data elements consistent with the ASAP standard identified in MHCC Noncontrolled Prescription Drugs Dispenser Data Submission Manual; (d) Include electronic reporting specifications, encryption algorithms, file layout, and the process for dispensers who are unable to submit data due to mechanical, electrical, or other technical failure; and (e) Align, to the extent possible, with the Maryland Prescription Drug Monitoring Program Data Submitter User Guide. (4) The Commission shall publish a draft Noncontrolled Prescription Drugs Dispenser Data Submission Manual on the Commission’s website and in the Maryland Register at least 30 days before the public meeting at which the Commission shall consider the manual for final approval and provide at least 20 days for the submission of public comment. (5) The Commission shall consider all comments received before final approval of the Noncontrolled Prescription Drugs Dispenser Data Submission Manual. (6) The Commission shall publish the final MHCC Noncontrolled Prescription Drugs Dispenser Data Submission Manual on its website within 5 days of its approval. (7) The State-designated HIE shall post a link to MHCC’s Noncontrolled Prescription Drugs Dispenser Data Submission Manual prominently on its website. (8) The Commission may correct incomplete or erroneous information in the MHCC Noncontrolled Prescription Drugs Dispenser Data Submission Manual as necessary and shall provide notice of each correction: (a) On its website; and (b) By email to the designated dispenser contact person. C. Means of Data Submission and Data Format. A dispenser shall transmit noncontrolled prescription drug information to the State-designated HIE: (1) Consistent with the requirements detailed in the most recent version of the MHCC Noncontrolled Prescription Drugs Dispenser Data Submission Manual; (2) By use of an encrypted electronic transmission method or a secure electronic reporting form; and (3) In a format or utilizing data standards approved by the Commission. D. Reporting Deadline. (1) Unless granted a waiver under §F of this regulation, a dispenser shall report to the State-designated HIE: (a) The noncontrolled prescription drug information required by the MHCC Noncontrolled Prescription Drugs Dispenser Data Submission Manual no later than the end of the next day of operation after the prescription is dispensed; or (b) A zero report no later than the end of the next day of operation after a day without dispenses of noncontrolled prescription drugs. (2) A dispenser that suffers a mechanical, electrical, or other technical failure that, as a direct consequence, precludes the dispenser’s ability to report non-controlled prescription data electronically shall: (a) Notify the State-designated HIE by a communication method approved by the State-designated HIE within 24 hours of discovery of the technical failure; and (b) Submit a report for each noncontrolled prescription drug dispensed during the period of technical failure as soon as possible, but no later than 24 hours following reestablishment of the means of electronic reporting. E. Acceptance and Disclosure of Noncontrolled Prescription Drug Information by the State-designated HIE. (1) The State-designated HIE shall: (a) Electronically collect noncontrolled prescription drug information from dispensers; (b) Not impose any fees or other assessments on dispensers to support its operation; (c) Make information technology available for dispensers to report noncontrolled prescription drug information to the State-designated HIE; and (d) Retain noncontrolled prescription drug information collected pursuant to this section for at least 5 years from the date of receipt, except for the PHI of patients who opt-out of an HIE consistent with Regulation.03 of this chapter. (2) The State-designated HIE may reject data submitted by dispensers that does not comply with the requirements of the MHCC Noncontrolled Prescription Drugs Dispenser Data Submission Manual. (3) If the State-designated HIE rejects the data submitted by a dispenser, the dispenser shall correct and resubmit the data no later than 7 business days after receiving notification from the State-designated HIE of receipt of incomplete or inaccurate data. (4) Beginning January 1, 2026, the State-designated HIE shall make patient-specific prescription information submitted by dispensers under this section available for purposes allowed under applicable law. (5) Upon written request for public health purposes and as allowed by applicable law, the State-designated HIE shall provide data collected under this regulation within 5 days to the Maryland Department of Health, local health departments, the Commission, or the Health Services Cost Review Commission. F. Dispenser Waiver Request Process. (1) Prior to September 1, 2025, dispensers of noncontrolled prescription drug information are exempt from reporting dispensed information to the State-designated HIE. (2) A dispenser that dispenses noncontrolled prescription drugs may seek a waiver from the Commission of the requirements in this regulation based on: (a) Economic hardship; (b) Technology limitations that are not reasonably within the dispenser’s control; (c) Dispensing less than 100 noncontrolled prescription drugs annually; or (d) Other circumstances determined by the Commission to be extenuating. (3) A request for a waiver shall be in writing and shall include: (a) A detailed explanation of the need for the waiver; (b) An attestation as to the accuracy of the information in the waiver request; and (c) An attestation that the dispenser shall immediately inform the Commission if the circumstances necessitating a waiver no longer exist. (4) Within 45 days after receipt of complete information from a dispenser requesting a waiver, the Commission shall: (a) Grant a time-limited waiver request; or (b) Deny the waiver request, with an explanation that enumerates the reasons for the denial. (5) A dispenser shall inform the Commission and immediately begin reporting in compliance with this regulation if the dispenser no longer meets the conditions of a waiver request. #### Regulation .14 Operation of the State-designated HIE as a Health Data Utility. *COMAR 10.25.18.14* A. The State-designated HIE shall operate as a health data utility for the State. B. The State-designated HIE shall implement a consent management application in accordance with Regulation .03D of this chapter. C. Disclosures by the State-designated HIE. (1) Except as otherwise prohibited under this chapter or State or federal law, the State-designated HIE shall transmit clinical information or electronic health care transactions to the Maryland Department of Health, the Commission, or the Health Services Cost Review Commission for public health purposes upon written request. (2) The State-designated HIE may not redisclose financial information in electronic health care transactions it receives in accordance with COMAR 10.25.07.09 to any person other than the Commission. (3) Maryland Medical Care Data Base. (a) The State-designated HIE shall be designated as a reporting entity to the Maryland Medical Care Data Base. (b) The State-designated HIE shall report the electronic health care transactions information it receives pursuant to COMAR 10.25.07.09 to the Medicare Care Data Base in accordance with the reporting requirements found in COMAR 10.25.06. (4) The State-designated HIE shall: (a) Develop a process in which requests for data are submitted and data are shared, and post this information on its website; and (b) Provide a written explanation for a denial of a request which shall include an appeal process. D. The State-designated HIE shall consult with the Maryland Department of Health, the Commission, and Health Services Cost Review Commission before identifying any specific purposes, type of data exchanged, and rules for interaction between users and the State-designated HIE pertaining to: (1) A State health improvement program; (2) Mitigation of a public health emergency; (3) Improvement of patient safety; and (4) Any other public health priorities identified by the Secretary. E. Consumer Advisory Council. (1) The State-designated HIE shall establish a Consumer Advisory Council in accordance with Health-General Article, §19-145, Annotated Code of Maryland. (2) The State-designated HIE shall: (a) Appoint two consumer representatives identified by the Commission who have significant experience in public health and patient privacy as council members; (b) Post advance notice of council meetings on its website, including an expected agenda; and (c) Require the Consumer Advisory Council to comply with the requirements of the Maryland Open Meetings Act as if it were a public body. ### Chapter 19 — State Recognition of an Electronic Advance Directives Service **Authority:** Health-General Article, §§4-302.2, 5-602, 5-622, 19-103(c)(2)(i) and (ii), and 19-144, Annotated Code of Maryland **Administrative History:** Effective date: March 12, 2018 (45:5 Md. R. 285) **Administrative History:** Regulation .02B amended effective January 9, 2023 (49:27 Md. R. 1110) **Administrative History:** Regulation .03 amended effective January 9, 2023 (49:27 Md. R. 1110) **Administrative History:** Regulation .04B, d amended effective January 9, 2023 (49:27 Md. R. 1110) **Administrative History:** Regulation .07 amended effective January 9, 2023 (49:27 Md. R. 1110) **Administrative History:** Regulation .08 amended effective January 9, 2023 (49:27 Md. R. 1110) #### Regulation .01 Scope. *COMAR 10.25.19.01* This chapter applies to the State Recognition of an electronic advance directives service. Only an electronic advance directives service that is awarded State Recognition status by the Maryland Health Care Commission pursuant to this chapter may represent itself as a State-Recognized electronic advance directives service that is authorized to connect to the State-Designated Health Information Exchange. #### Regulation .02 Definitions. *COMAR 10.25.19.02* A. In this chapter, the following terms have the meanings indicated. B. Terms Defined. (1) “Advance Care Planning” means a process through which an individual considers and documents in a formal manner the individual’s preferences for the receipt of health care, including through the use of an advance directive. (2) “Advance directive” has the meaning stated in Health-General Article, Title 5 Subtitle 6, Annotated Code of Maryland. (3) “Commission” means the Maryland Health Care Commission. (4) “Declarant” means a competent individual who makes an advance directive while capable of making and communicating an informed decision. (5) “Electronic advance directives service” or “service” means a corporation, firm, association, or other entity that offers electronic advance directives services by way of a web-based application using cloud-based technology. (6) “Executive Director” means the Executive Director of the Commission. (7) “Health care agent” means an individual appointed by a declarant under an advance directive to make health care decisions on behalf of a declarant. (8) “State-Designated HIE” means an entity designated by the Maryland Health Care Commission and the Health Services Cost Review Commission pursuant to the statutory authority set forth under Health-General Article, §19-143, Annotated Code of Maryland. (9) “State Recognition” or “State-Recognized” means the status awarded by the Commission to an approved electronic advance directives service that has met State Recognition criteria. (10) “State Recognition criteria” or “criteria” means technology, security, privacy, and other standards established by the Commission in accordance with Regulation .03 of this chapter. (11) “Vendor” means an electronic advance directive service.. #### Regulation .03 Criteria for State Recognition of an Electronic Advance Directives Service. *COMAR 10.25.19.03* A. The Commission will assess the application of an electronic advance directives service for State Recognition in accordance with criteria approved by the Commission in accordance with the process set forth in this Regulation. B. Commission staff shall publish in the Maryland Register and on the Commission’s website a notice and draft criteria by which the Commission may consider an application of an electronic advance directives service for State Recognition. (1) The notice shall specify the date by which public comments are due. (2) Commission staff shall analyze public comments received and recommend criteria for use by the Commission in determining whether the Commission will award State Recognition to an electronic advance directives service. C. The Commission will consider the public comments and Commission staff’s recommendation in establishing the applicable criteria. D. The criteria approved by the Commission shall be published in the Maryland Register and in a dated posting on the Commission’s website. #### Regulation .04 Procedure for Initial State Recognition. *COMAR 10.25.19.04* A. Application. (1) An electronic advance directives service seeking State Recognition shall submit an application in the form and manner specified by the Commission. (2) The application, and all information supplementing the application, shall be signed by at least one person authorized by the applicant, who shall sign a statement as follows: “I solemnly affirm under penalties of perjury that the contents of this application (or the supplementary information) are true to the best of my knowledge, information, and belief.” B. An electronic advance directives service seeking State Recognition shall: (1) Demonstrate that it meets all State Recognition criteria in effect at the date of the Commission's receipt of the initial application; (2) Affirm under penalties of perjury that, within the last 10 years, no current or former owner or senior manager of the service or a current or former owner or senior manager of any related or affiliated service has: (a) Been convicted of a felony or pleaded guilty, nolo contendere, entered a best interest plea of guilty, or received a diversionary disposition regarding a felony; (b) Received a determination of exclusion from participation in Medicare or State health care programs under 42 U.S.C. §1320a-7 in any case with respect to a criminal or civil charge of Medicare or Medicaid fraud or abuse; or (c) Been found in violation of State or federal laws or regulations that govern the operation of, or relate in any way to, an electronic advance directives service; (3) Affirm under penalties of perjury that the service or any related or affiliated service: (a) Has no pending complaints, judgments, liens, or any final judgment or liens; or (b) Has not been the subject of an investigation by or order of any local, State, or federal governmental agency; (4) Provide all required documentation; (5) Timely provide additional information requested by Commission staff as needed to complete analysis of the application and make a recommendation to the Commission; (6) Send written notice to the Commission of any change in information submitted in the initial application within ten business days after the change is effective; and (7) Agree to comply with the requirements of this chapter. C. Review of Applications. (1) Commission staff shall: (a) Review an application to determine its compliance with State Recognition criteria; and (b) Prepare a recommendation to the Commission on the application, detailing the reasons for the recommendation. (2) If Commission staff recommends denial of an application for State Recognition: (a) An applicant has ten days after electronic delivery of the Commission staff's recommended denial in which to make a written filing taking exceptions to the staff's recommendation; and (b) Each applicant that timely submits a written filing may present oral argument on its written exceptions to the Commission, not to exceed 10 minutes per applicant unless time is extended by the Chair of the Commission. (3) The Commission may award State Recognition to each electronic advance directives service that meets all State Recognition criteria unless the Commission: (a) Determines that it is in the public interest to award State Recognition to fewer than all the electronic advance directives services that meet the qualifications for State Recognition; and (b) Details the bases for its decision. D. Duration of State Recognition. (1) State Recognition is valid for three years from its issuance, unless suspended or revoked by the Commission. (2) An electronic advance directives service to which the Commission grants State Recognition shall acknowledge the status in writing and agree to comply with the terms and conditions of the award of State Recognition status. #### Regulation .05 Procedure for Renewal of State Recognition. *COMAR 10.25.19.05* A. An electronic advance directives service seeking renewal of its State Recognition status shall: (1) At least 45 days prior to the expiration of State Recognition status, file a complete application for renewal in a form and manner specified by the Commission; and (2) Demonstrate compliance with the State Recognition criteria in effect at the date of the Commission’s receipt of the application for renewal. B. Commission staff shall review a renewal application and make a recommendation to the Commission regarding: (1) The applicant’s compliance with the State Recognition criteria; (2) The applicant’s compliance with terms and conditions of the prior recognition; and (3) Its assessment of the quality of the service provided by the electronic advance directives service. C. The Commission shall approve an application for renewal of State Recognition status by an electronic advance directives service that: (1) Continues to meet all State Recognition criteria; (2) Has complied with the terms and condition of its previous award of State Recognition status; and (3) Has provided high quality service to persons who utilize its electronic advance directives service. D. If Commission staff recommends denial of a renewal application, the procedure in Regulation .04C(2) of this chapter applies. #### Regulation .06 Nontransferability of State Recognition. *COMAR 10.25.19.06* State Recognition issued pursuant to this chapter may not be sold, assigned, leased, or transferred in any way, except as provided in Regulation .07 of this chapter. #### Regulation .07 Closure, Sale, Merger, Lease, Assignment, or Transfer of All or Part of a State-Recognized Electronic Advance Directives Service. *COMAR 10.25.19.07* A. At least 90 days before a State-Recognized electronic advance directives service closes on a sale, merger, lease, assignment, or transfer of all or part of a State-Recognized electronic advance directives service, the State-Recognized electronic advance directives service shall: (1) Submit in writing to the Commission information requested by Commission staff about the desired change and a plan that assures the proposed transaction: (a) Results in the secure transfer to another State-Recognized electronic advance directives service; (b) Provides notice of the proposed transaction to the Commission, to the Maryland Department of Health, to the State-Designated Health Information Exchange, and to the Consumer Protection Division of the Office of the Maryland Attorney General; and (c) Provides notice of the proposed transaction electronically and on the Vendor’s website to each declarant who prepared an electronic advance directive through the service and health care agent named in an electronic advance directive, which at a minimum, includes: (i) Information about the transfer of the declarant’s advanced directive to another State-Recognized entity; (ii) The name, contact information and web address of the State-Recognized receiving entity; (iii) The date the transfer will occur; and (iv) Specific instructions about how the transfer of an advance directive impacts the declarant and the health care agent. (2) Not proceed with the proposed transaction until it receives written determination from the Executive Director that State Recognition status may be transferred as a result of the proposed sale, merger, lease, assignment, or transfer of all or part of a State-Recognized electronic advance directives service. (3) The provisions of §A(1) of this regulation do not apply to a State-Recognized electronic advance directives service that seeks to sell, merge, lease, assign, or transfer all or part of a State-Recognized electronic advance directives service to: (a) A person who was identified as a majority owner of the electronic advance directives service at the time of the most recent State Recognition by the Commission; or (b) To an entity identified as the majority owner of the electronic advance directives service at the time of the most recent State Recognition by the Commission and whose membership or ownership, and percentage of ownership remain substantially the same as identified at the time of the most recent State Recognition by the Commission. B. As soon as a State-Recognized electronic advance directives service has information that sets forth a reasonable basis to believe that its ability to continue to operate as a State-Recognized electronic advance directives service will be materially affected, and no fewer than 90 days prior to an anticipated closure, it shall submit complete written information to the Commission, along with a plan that includes provisions assuring the following: (1) The secure transfer of electronic advance directives to another State-Recognized electronic advance directives service to the extent that such transfer is consistent with State and federal law; (2) Submission of any reporting required under an existing State or federal grant; (3) Plans for the continuation of electronic advance directives services during a period of transition and for a mutually agreed timeframe prior to the transfer of electronic advance directives to another State-Recognized electronic advance directives service or until the Commission awards State Recognition to a new electronic advance directives service to whom the existing service shall transfer existing advance directives; (4) Plans for such transition services to a successor State-Recognized electronic advance directives service as are reasonably feasible given the circumstances of the closure; and (5) A minimum of 45 days advance notice of the full or partial closure to each declarant who prepared an electronic advance directive through the service and health care agent named in an electronic advance directive in accordance with §A(1)(c) of this regulation, to the Commission, to the Maryland Department of Health, to the State-Designated Health Information Exchange, and the Consumer Protection Division of the Office of the Maryland Attorney General. #### Regulation .08 Commission Oversight of State-Recognized Electronic Advance Directives Services. *COMAR 10.25.19.08* A. Commission staff may, on its own initiative or in response to information provided to the Commission, investigate any State-Recognized electronic advance directives service. B. Failure of a State-Recognized electronic advance directives service to provide full information requested by Commission staff in a timely and complete manner is grounds for suspension or revocation of State Recognition status. C. Following Commission staff’s investigation, the Executive Director may issue a notice of proposed action, which may include the following: (1) A time-limited opportunity to correct deficiencies identified by the investigation; (2) Suspension of the State Recognition of an electronic advance directives service for a definite period of time after which, depending upon the circumstances of the case and completion of appropriate corrective actions, the Vendor may seek reinstatement of its State Recognition; or (3) Revocation of State Recognition. D. An electronic advance directives service that receives a notice of proposed action from the Executive Director may request an opportunity to show cause why the proposed action should not be implemented. A written request to show cause shall be filed with the Commission within 20 days of the issuance of the notice of proposed action and shall: (1) State with particularity the grounds and factual basis for the electronic advance directives service's disagreement with the proposed action; (2) Include each fact upon which the electronic advance directives service relies to show cause why the proposed action should not be taken; and (3) Be supported by relevant documentation and affidavits. E. The Commission shall determine whether to impose the proposed action or a different action under the exceptions procedure provided in Regulation .04C(2) of this chapter. F. In the event that State Recognition status is not renewed, or the Commission suspends or revokes State Recognition status, the electronic advance directives service must notify each declarant who prepared an electronic advance directive through the service and health care agent named in an electronic advance directive about the impact of the action on accessibility of the advance directive.