This chapter sets forth the requirements for monitoring the prescribing and dispensing of controlled dangerous substances under the Prescription Drug Monitoring Program. In this chapter, the following terms have the meanings indicated. Terms Defined. “Authorized user” means a licensed prescriber, a prescriber delegate, a licensed pharmacist, a pharmacist delegate, or a licensed health care practitioner registered with another state’s prescription drug monitoring program. “Business day” means any day except Saturday, Sunday, or a holiday on which State offices are closed. “Dispense” has the meaning stated in Health Occupations Article, §12-101, Annotated Code of Maryland, but does not include: Directly administering a monitored prescription drug to a patient; or Giving a patient prescription drug samples in accordance with Health Occupations Article, §12-102(d), Annotated Code of Maryland. Dispenser. “Dispenser” means person authorized by law to dispense a monitored prescription drug to a patient or a patient’s agent in the State, including a nonresident pharmacy so authorized. “Dispenser” does not include: A licensed hospital pharmacy that only dispenses a monitored prescription drug for direct administration to an inpatient of the hospital; An opioid treatment services program; A veterinarian licensed under Agriculture Article, Title 2, Subtitle 3, Annotated Code of Maryland, when prescribing controlled substances for animals in the usual course of providing professional services; A pharmacy issued a waiver permit under COMAR 10.34.17.03 that provides pharmaceutical specialty services exclusively to persons living in assisted living facilities, comprehensive care facilities, and developmental disabilities facilities; or A pharmacy issued a waiver from reporting dispensing of monitored prescription drugs to hospice inpatients under Regulation .03G of this chapter. “Existing bona fide individual investigation” means an active and good faith investigation of an identified prescriber, dispenser, or patient for possible violations falling under the jurisdiction of the requesting governmental unit or agency. “Existing bona fide investigation” means an active and good faith investigation of identified prescribers, dispensers, or patients for possible violations falling under the jurisdiction of the requesting governmental unit or agency. “Licensed health care practitioner” means an individual who is: Licensed, certified, or registered under Health Occupations Article, Annotated Code of Maryland, or the laws of the practitioner’s respective state, as appropriate, to provide health care services; and Authorized by a prescriber or pharmacist to access prescription monitoring data in connection with the medical care of a patient to whom the prescriber prescribes or the pharmacist dispenses a monitored prescription drug. “Licensing entity” means an entity authorized under Health Occupations Article, Annotated Code of Maryland, to license, regulate, or discipline a prescriber or pharmacist. “Medical director” means an individual who is: A prescriber; and Employed by or under contract with a health care facility and serves as that facility’s chief medical officer or in an equivalent role. Monitored Prescription Drug. “Monitored prescription drug” means a prescription drug that contains a Schedule II, Schedule III, Schedule IV, or Schedule V controlled dangerous substance designated under Criminal Law Article, Title 5, Subtitle 4, Annotated Code of Maryland. “Monitored prescription drug” does not include naloxone medication. “Naloxone medication” means an opioid antagonist approved by the federal Food and Drug Administration for the reversal of an opioid overdose. “Naloxone medication data” means the information required to be submitted to the Program when dispensing naloxone medication “Office” means the Office of Controlled Substances Administration in the Department. “Opioid treatment services program” means a program that: Is certified by the State under Health-General Article, §8-401, Annotated Code of Maryland or licensed by the State under Health-General Article, §7.5-401, Annotated Code of Maryland; Is authorized to treat patients with opioid dependence with a medication approved by the federal Food and Drug Administration for opioid dependence; Complies with: The Code of Federal Regulations 42, Part 8; COMAR 10.47.02.11; and Requirements for the secure storage and accounting of opioid medication imposed by the federal Drug Enforcement Administration and the State Division of Drug Control; and Has been granted a certification for operation by the Department, the federal Substance Abuse and Mental Health Services Administration, and the Federal Center for Substance Abuse Treatment. “Patient” means: An individual for whom a prescriber has prescribed or is considering prescribing a monitored prescription drug; or An individual for whom a pharmacist has dispensed or is considering dispensing a monitored prescription drug. “Pharmacist” means an individual who is licensed under Health-Occupations Article, Title 12, Annotated Code of Maryland, to dispense a monitored prescription drug. “Pharmacist delegate” means an individual who is: Authorized by a registered pharmacist to request or access prescription monitoring data; and Employed by or under contract with the same professional practice as the registered pharmacist. “Prescriber” means a practitioner: Lawfully authorized to prescribe a monitored prescription drug; or Legally authorized to prescribe a monitored prescription drug under an institutional DEA registration; “Prescriber delegate” means an individual who is: Authorized by a registered prescriber to request or access prescription monitoring data; and Employed by or under contract with the same professional practice as the registered prescriber. “Prescription drug” has the meaning stated in Health-General Article, §21-201, Annotated Code of Maryland. “Prescription monitoring data” means the information submitted to the program for a monitored prescription drug. “Program” means the Prescription Drug Monitoring Program established under Health-General Article, Title 21, Subtitle 2A, Annotated Code of Maryland. “Registered” means a person registered with the Program to request or access prescription monitoring data for clinical use. “Rehabilitation program under a health occupations board” means a group, committee, or program recognized by a licensing entity that provides assistance to a licensed health care practitioner in need of treatment and rehabilitation for alcoholism, drug abuse, chemical dependency, or other physical, emotional, or mental condition. “Technical Advisory Committee” means the Technical Advisory Committee established by Health-General Article, §21-2A-07, Annotated Code of Maryland. “Zero report” means an electronic report submitted by a dispenser to the Program to confirm that no monitored prescription drugs were dispensed during the reporting time frame. For each monitored prescription drug and naloxone medication dispensed, the dispenser shall report data elements required by American Society for Automation in Pharmacy (ASAP) standards in addition to the following: Identifying information for the prescription issued and drug dispensed, including: Prescription number; Date prescription was issued; Date prescription was filled; Whether the prescription was new or a refill; Number of refills ordered; Sources of payment; National Drug Code for dispensed drug; Metric quantity of drug dispensed and units; Days’ supply of drug dispensed; and Date prescription was sold; Identifying information for the patient or animal owner or handler, as appropriate, including: Last name; First name; Date of birth; Gender; (text unchanged) Address, including residential house or building number, apartment number, street name, state, and zip code; A patient identification number, which may include: A state-issued driver’s license or identification card number; An insurance or third-party payer identification number; A passport identification number; An employer-issued identification card number; A student identification card number; A United States Permanent Resident Card identification number; or A patient or customer identification number generated by the dispenser’s record management system; ID qualifier; and Species indication; First and Last name for the prescriber, including: For prescription monitoring data, a valid Drug Enforcement Administration registration number; or For naloxone medication data, a valid National Provider Identifier; Identifying information for the dispenser, including a valid Drug Enforcement Administration registration number; and Additional data elements consistent with the standards established by the ASAP. Reporting Deadline. A dispenser shall report prescription monitoring data and naloxone medication data to the Department to include zero reports at least once every 24 hours and in accordance with procedures developed by the Department and approved by the Advisory Board on Prescription Drug Monitoring. A dispenser that suffers a mechanical, electrical, or other technical failure that, as a direct consequence, precludes the dispenser’s ability to report prescription monitoring data or naloxone medication data electronically shall: Notify the Department, by a communications method approved by the Department, within 24 hours of discovery of the technical failure; and Submit a report for each monitored prescription drug and naloxone medication dispensed during the period of technical failure as soon as possible, but no later than 24 hours following reestablishment of the means of electronic reporting. Waiver from Reporting Deadline. At the Secretary’s discretion, a dispenser may be granted a waiver from §B of this regulation, provided that the dispenser’s waiver request: Is submitted on a form or in a method approved by the Department; Is particular to a unique problem, incident or other issue that prevents the dispenser from meeting the reporting deadline; and Describes in detail and includes any available documentation of the specific circumstances that prevent the dispenser from meeting the reporting deadline. A dispenser that receives a waiver shall comply with all the terms and conditions enumerated therein, including any new reporting deadline required. Means of Data Submission and Data Format. Prescription monitoring data shall be transmitted to the Department or its agent: In accordance with any procedures and guidelines established or approved by the Department, including by use of an encrypted electronic transmission method or a secure electronic reporting form; and In a format or utilizing a data standard approved by the Department. Reporting of Incomplete or Inaccurate Data. Data not accepted by the Department or its agent due to inaccuracy or incompleteness shall be corrected and resubmitted to the Department no later than 3 business days after receiving notification from the Department of receipt of incomplete or inaccurate data. Reporting Exemptions. The following shall be exempt from reporting prescription monitoring data to the Program: A licensed hospital pharmacy that only dispenses a monitored prescription drug for direct administration to an inpatient of the hospital; An opioid treatment service program; A veterinarian licensed under Agriculture Article, Title 2, Subtitle 3, Annotated Code of Maryland, when prescribing controlled substances for animals in the usual course of providing professional services; A pharmacy issued a waiver permit under COMAR 10.34.17.03 that provides pharmaceutical specialty services exclusively to persons living in assisted living facilities, comprehensive care facilities, and developmental disabilities facilities; and Dispensing to hospice inpatients, provided that the dispensing pharmacy has applied for and been granted a waiver by the Department pursuant to §G of this regulation. Waiver for Dispensing to Hospice Inpatients. On a form or in a manner approved by the Department, a pharmacy may apply to the Department to be granted a waiver from reporting prescription monitoring data or naloxone medication data for dispensing of monitored prescription drugs to hospice inpatients, provided that: The pharmacy demonstrates, through written application, live demonstration, or any other method required by the Department, how it will distinguish dispensing to hospice inpatients from all other dispensing of monitored prescription drugs required to be reported to the Program; and The pharmacy agrees that it will be subject to unannounced, on-site inspections by the Department to verify its reporting of prescription monitoring data and naloxone medication data on customers that are not hospice inpatients. A waiver granted to a pharmacy under this regulation shall remain in effect for 2 years. The Program shall review prescription monitoring data and naloxone medication data for indications of possible: Misuse or abuse of a monitored prescription drug; and Violations of law or possible breaches of professional standards by a prescriber or a dispenser. In determining whether its review indicates a possible violation of law or possible breach of professional standards by a prescriber or dispenser, the Program shall take into account to the extent practicable the particular specialty, circumstances, patient type, and location of the prescriber or dispenser. Registration of a Prescriber, a Prescriber Delegate, a Pharmacist, a Pharmacist Delegate, or a Licensed Health Care Practitioner to Request Prescription Monitoring Data. A prescriber, a prescriber delegate, a pharmacist, a pharmacist delegate, or a licensed health care practitioner shall register with the Department or its agent, in a manner specified by the Department, in order to request disclosure of or otherwise access prescription monitoring data. The Department or its agent shall: Establish procedures to authenticate a prescriber, a dispenser, or an authorized licensed health care practitioner in accordance with Health-General Article, §21-2A-06(b)(1)—(2), Annotated Code of Maryland; and Issue credentials to a prescriber, a prescriber delegate, a pharmacist, or a pharmacist delegate that can be used to request disclosure of or otherwise access prescription monitoring data electronically. If the credentials issued to a registrant are lost, stolen, or otherwise compromised, the registrant shall notify the Department or its agent, by a method approved by the Department, as soon as reasonably possible. A prescriber or pharmacist who authorizes the registration of a licensed health care practitioner, prescriber delegate, or pharmacist delegate to request disclosure of or otherwise access prescription monitoring data shall: Make every reasonable effort, including regularly reviewing and auditing any available logs of system access and use, to ensure the prescriber delegate or pharmacist delegate is requesting disclosure of, redisclosing, or otherwise accessing prescription monitoring data in clear compliance with Health-General Article, Title 21, Subtitle 2A, Annotated Code of Maryland, and all other State and federal laws and regulations governing the security and confidentiality of protected health information and personal medical records; Immediately notify the Department or its agent, by a method approved by the Department, as well as the licensing entity responsible for licensing, certifying, or registering the prescriber delegate, or pharmacist delegate, if applicable, if the prescriber or pharmacist believes that the confidentiality of prescription monitoring data or the security of the Program has been compromised by that individual; and Immediately notify the Department or its agent, by a method approved by the Department, of any requested change in the registration status of a licensed health care practitioner, prescriber delegate, or pharmacist delegate, including if that individual is no longer employed by or practicing under the authority of the prescriber or pharmacist. Disclosure of Prescription Monitoring Data to a Prescriber, a Prescriber Delegate, a Pharmacist, or a Pharmacist Delegate. Upon request from a prescriber or a licensed health care practitioner or a prescriber delegate authorized by a prescriber, the Program shall disclose patient-specific prescription monitoring data provided that the request is made solely for the purpose of the medical care or treatment of the patient about whom prescription monitoring data is being requested. Upon request from a prescriber, the Program may provide a report containing prescription monitoring data on all monitored prescription drugs dispensed pursuant to the prescriber’s prescriptions, provided that the request is submitted on a form or in a manner approved by the Department. Upon request from a pharmacist or a licensed health care practitioner or pharmacist delegate authorized by a pharmacist, the Program shall disclose patient-specific prescription monitoring data provided that the request is made pursuant to a pharmacist’s responsibility to perform due diligence and exercise professional judgment when presented with a prescription to dispense a monitored prescription drug for use by the patient about whom prescription monitoring data is being requested. The Department or its agent shall make available the electronic means by which a prescriber, a pharmacist, a prescriber delegate, or a pharmacist delegate may request disclosure of or otherwise access patient-specific prescription monitoring data. If the Program’s review of prescription monitoring data under Regulation .04 of this chapter indicates possible misuse or abuse of a monitored prescription drug, possible violation of law, or possible breach of professional standards by a prescriber or dispenser, the Program shall: Report the possible misuse or abuse, possible violation of law, or possible breach of professional standards to the prescriber or dispenser of the monitored prescription drug in a manner and form determined by the Program; and Provide education to the prescriber or dispenser. Disclosure of Prescription Monitoring Data to a Federal, State, or Local Law Enforcement Agency. The Program shall disclose prescription monitoring data to a federal, State, or local law enforcement agency, for the purpose of furthering an existing bona fide individual investigation, on receipt of a subpoena that: Includes information sufficient to identify the unique prescriber, dispenser, or patient about whom prescription monitoring data is requested; Specifies the time frame for which prescription monitoring data is requested, including the day, month, and year the report is to begin and end; Includes an agency case number or other identifier sufficient to identify an existing bona fide individual investigation; and Bears the name, title, and signature of the official under whose authority the subpoena is issued. Disclosure of Prescription Monitoring Data to a Licensing Entity. The Program shall disclose prescription monitoring data to a licensing entity upon receipt of an administrative subpoena. The licensing entity shall include in the administrative subpoena: Information sufficient to identify the unique prescriber, dispenser, or patient about whom prescription monitoring data is requested; The time frame for which prescription monitoring data is requested, including the day, month, and year the report is to begin and end; A case number or other identifier sufficient to identify an existing bona fide individual investigation; and The name, title, and original signature of the official under whose authority the subpoena is issued. Disclosure of Prescription Monitoring Data to a Rehabilitation Program under a Health Occupations Board. The Program shall disclose prescription monitoring data to a rehabilitation program under a health occupations board upon receipt of an administrative subpoena that: Includes information sufficient to identify the unique licensed health care practitioner about whom prescription monitoring data is requested; Specifies the time frame for which prescription monitoring data is requested, including the day, month, and year the report is to begin and end; and Bears the name, title and original signature of the official under whose authority the subpoena is issued. Disclosure of Prescription Monitoring Data to a Patient or a Patient’s Authorized Representative. Upon request, the Program shall disclose to a patient 18 years old or older prescription monitoring data about the patient provided that the request is submitted to the Program: On a completed form approved by the Department that contains a notarized signature of the requester; or In any other manner approved by the Department. Upon request, the Program shall disclose patient-specific prescription monitoring data to a patient’s authorized representative who is 18 years old or older, including the parent or legal guardian of a minor, an individual with power of attorney, the personal representative of a decedent’s estate, or any other person duly authorized by State law to request or otherwise access medical records on behalf of a patient, provided that the request shall be submitted to the Program: In person and accompanied by: A completed form approved by the Department; Valid photo identification issued by a government agency of any jurisdiction of the United States verifying that the patient’s authorized representative is 18 years old or older; and An original copy of any form or documentation required by State law or regulation to verify the authority of the representative to request or otherwise access the medical records of a patient on their behalf; or In any other manner approved by the Department. If a patient, a patient’s authorized representative, or a patient’s prescriber believes that prescription monitoring data relating to the patient’s prescription history is incorrect, the patient, authorized representative, or prescriber may request that the Program correct the data provided that the request: Is submitted to the Program in writing and on a form or in a manner approved by the Department; and Includes documentation, which may include but not be limited to, a copy of the original prescription and a signed, notarized statement from the prescriber or dispenser that demonstrates which of the specific data elements reported to the Program under Regulation .03A of this chapter are incorrect. Upon determination by the Secretary that prescription monitoring data specific to a patient’s prescription history is incorrect, the Program shall issue a corrected prescription history report to the patient or the patient’s authorized representative. Disclosure of Prescription Monitoring Data to the Office of the Attorney General. The Program shall disclose prescription monitoring data to the Office of the Attorney General, for the purpose of furthering an existing bona fide investigation, on receipt of a subpoena that: Includes information sufficient to identify the prescribers, dispensers, or patients about whom prescription monitoring data is requested; Specifies the time frame for which prescription monitoring data is requested, including the day, month, and year the report is to begin and end; Includes an agency case number or other identifier sufficient to identify an existing bona fide investigation; and Bears the name, title, and signature of the official under whose authority the subpoena is issued. Disclosure of Prescription Monitoring Data to an Authorized User of Another State’s Prescription Drug Monitoring Program or of any Other Authorized Agency. Upon request, the Program shall disclose prescription monitoring data to an authorized user of another state’s prescription drug monitoring program or an authorized user with any other authorized local, state, territorial, or federal agency in connection with the provision of medical care, provided that the request: Is submitted in a manner approved by the Department; Is under the authority of the authorized administrator of that state’s program or authorized agency; Includes an attestation that prescription monitoring data will only be used or redisclosed in a manner consistent with the provisions of Health-General Article, §21-2A-06, Annotated Code of Maryland, and Regulation .08D of this chapter; and Relates to a patient to whom the authorized user anticipates providing, is providing, or has provided medical care. The Program may develop and implement interoperability with another state’s prescription drug monitoring program or authorized agency to facilitate the automated exchange of prescription monitoring data provided that a written agreement has been established with the other state’s program or authorized agency specifying that the information technology employed will: Only disclose prescription monitoring data to authorized users in a manner consistent with the provisions of Health-General Article, §21-2A-06, Annotated Code of Maryland, and this regulation; and Operate in accordance with all other State and federal laws and regulations governing the security and confidentiality of protected health information and personal medical records. Disclosure of Prescription Monitoring Data to Units of the Department. Upon request, the Program may disclose prescription monitoring data to the Maryland Medical Assistance Program, the Office of the Inspector General of the Department, the Office of Health Care Quality, and the Office, provided that the request: Includes information sufficient to identify the unique individual about whom prescription monitoring data is requested; Specifies the time frame for which prescription monitoring data is requested, including the day, month and year the report is to begin and end; Includes a case number or other identifier sufficient to identify an existing bona fide individual investigation; and Is approved by the Secretary. Disclosure of Prescription Monitoring Data to a Medical Director of a Health Care Facility. The Program may disclose prescription monitoring data to the medical director of a health care facility, as defined in Health-General Article, §19-114, Annotated Code of Maryland, or the medical director’s designee for the purpose of providing health care practitioners employed or contractually employed at the health care facility access to the prescription monitoring data in connection with the provision of medical care or the dispensing of a monitored prescription drug to an individual who receives health care at the health care facility and on whom a medical record is maintained at the health care facility, provided that the health care facility: Is licensed by the Department of Health or is operated by the federal government or a federally recognized Indian tribe; Has an active participation agreement with the State’s Health Information Exchange; Operates in accordance with all other State and federal laws and regulations governing the security and confidentiality of protected health information and personal medical records; and Can provide an audit trail of the facility’s staff access to the prescription monitoring data to the Department upon request. Disclosure of Prescription Monitoring Data to the Office of the Chief Medical Examiner. Upon request from the Office of Chief Medical Examiner, the Program shall disclose decedent-specific prescription monitoring data, provided that the request is made solely for the purpose of carrying out duties authorized under Health-General Article, §5-309, Annotated Code of Maryland. The Program shall determine the electronic means by which the Office of the Chief Medical Examiner may request disclosure of or otherwise access decedent-specific prescription monitoring data. Disclosure of Prescription Monitoring Data to Case Review Entities. Upon request, the Program may disclose prescription monitoring data to the following case review entities for the purposes of furthering an existing bona fide individual case review: The State Child Fatality Review Team or a local child fatality review team as defined in Health-General Article, §5-701, Annotated Code of Maryland, upon request from the chair of the State or local team; A local drug overdose fatality review team as described in Health-General Article, §5-902, Annotated Code of Maryland, upon request from the chair of the local team; The Maternal Mortality Review Program, as defined in Health-General Article, §13-1203, Annotated Code of Maryland, on request from the Program; and A medical review committee described in Health Occupations Article, §1-401(b)(3), Annotated Code of Maryland, upon request from the committee. The request shall: Include information sufficient to identify the unique individual about whom prescription monitoring data is requested; Specify the time frame for which prescription monitoring data is requested, including the day, month, and year the report is to begin and end; Include a case number or other identifier sufficient to identify an existing bona fide individual case review; and Be approved by the Secretary. Disclosure of Prescription Monitoring Data for Research, Analysis, Education, and Public Reporting. The Program may disclose prescription monitoring data for research, analysis, education, and public reporting: In response to requests determined by the Department to be consistent with institutional review board protocols and human subjects research protections; Upon approval by the Department of a written proposal or abstract explaining the purpose and scope of the research, analysis, education, and public reporting; and After redaction of all information that could identify a patient, prescriber, dispenser, or any other individual. The Secretary may waive the requirement of §M(1)(b) of this regulation for requests from units of the Department. Technical Advisory Committee Review. Before the Program discloses prescription monitoring data under §§C—E, H, and I of this regulation, the Technical Advisory Committee may: Review the request for disclosure; and Within 10 business days of submission of the request to the Technical Advisory Committee for review, submit to the Program, in written form, clinical guidance and interpretation of the prescription monitoring data requested to: Assist the Secretary’s decision on how to respond to a judicial subpoena, administrative subpoena, or other request; and Be made available for use by the recipient of prescription monitoring data should the request for disclosure be authorized. Notwithstanding §N(1) of this regulation, the Program may disclose prescription monitoring data to the authorized administrator of another state’s prescription drug monitoring program or authorized agency for disclosure to an authorized user in a manner consistent with §H of this regulation. Before the Program discloses prescription monitoring data to a prescriber or dispenser under §B(5) of this regulation, the Technical Advisory Committee: For indications of possible misuse or abuse, may provide clinical guidance and interpretation of the prescription monitoring data that indicates possible misuse or abuse; and For indications of possible violations of law or breach of professional standards, shall provide clinical guidance regarding the method used and advise whether the method identifies possible violations of law or breach of professional standards. If the Technical Advisory Committee has not provided clinical guidance and interpretation in accordance with §N(1) or (3) of this regulation within 10 business days of submission of the request or data to the Technical Advisory Committee for review, the Program may proceed as if the Technical Advisory Committee does not have clinical guidance or interpretation to provide regarding the request, data, or method at issue. Before making a referral to the Office in accordance with Regulation .05O of this chapter, the Program shall provide to the Technical Advisory Committee notice and an opportunity to make recommendations within 10 business days on the referral. If the Technical Advisory Committee has not provided recommendations within 10 business days under §N(5) of this regulation, the Program may proceed as if the Technical Advisory Committee does not have clinical guidance or interpretation to provide. The Department shall establish procedures, which may include but not be limited to secure electronic messaging, for the timely disclosure of prescription monitoring data to the Technical Advisory Committee and the receipt of responses from the Technical Advisory Committee to ensure that the review process is conducted with all possible expediency. For all purposes, including but not limited to confidentiality, security, redisclosure, and admissibility as evidence, Program reports based on evaluation of prescription monitoring data and that contain individual identifying information shall be considered as one and the same with the prescription monitoring data. Disclosure of Prescription Monitoring Data to the Office. The Program may disclose prescription monitoring data and make a referral to the Office about a possible violation of law or possible breach of professional standards by a prescriber or dispenser as identified under Regulation .04 of this chapter, if the Program: Determines the: Outreach and education provided was inadequate to address the possible breach or violation; or Outreach and education would be inadequate to address the possible violations of law or a possible breach of professional standards; Provides notice and an opportunity to the Technical Advisory Committee to make recommendations within 10 business days regarding interpretation of the prescription monitoring data; Provides the recommendations, if any, of the Technical Advisory Committee to the Office; and Notifies the prescriber or the dispenser that the prescription monitoring data will be provided to the Office for further investigation. Disclosure of Naloxone Medication Data for Public Health Surveillance, Research, Analysis, Education, and Public Reporting. The Program shall disclose naloxone medication data for research, analysis, education, and public reporting: Upon approval by the Department of a written proposal or abstract explaining the purpose and scope of the research, analysis, education, and public reporting; and After redaction of all information that could identify a patient, prescriber, dispenser, or any other individual. The Secretary may waive the requirement of §A(1) of this regulation for requests from units of the Department. The Program may disclose de-identified naloxone medication data for public health surveillance purposes. The Program may not disclose identifiable naloxone medication data to any entity, including but not limited to prescribers or dispensers. Pharmacists. Any pharmacist who intends to request prescription monitoring data from the Program may post a sign that can be easily viewed by the public at the place where the prescription is delivered to the pharmacist. The sign shall disclose to the public that the pharmacist may access prescription monitoring data on a patient for whom a prescription for a monitored prescription drug is presented. In lieu of posting a sign, the pharmacist may provide such notice in written material provided to the patient. Prescriber. Any prescriber who intends to request prescription monitoring data from the Program may post a sign that can be easily viewed by the public that discloses to the public that the prescriber may access prescription monitoring data on a patient. In lieu of posting a sign, the prescriber may provide such notice in written material provided to the patient. Prescription monitoring data and naloxone medication data are confidential, privileged, not subject to discovery, subpoena, or other means of legal compulsion in civil litigation, and are not public records. The Program shall ensure that confidential or privileged patient information be kept confidential and that records or information protected by a privilege between a health care provider and a patient, or otherwise required by law to be held confidential, be filed in a manner that, except as otherwise provided in Health-General Article, §21-2A-06, Annotated Code of Maryland, and Regulation .04 of this chapter, does not disclose the identity of the person protected. The Program shall periodically conduct an audit review of prescription monitoring data and naloxone medication data and disclosure requests to ensure compliance with §B of this regulation. Civil Penalties. A dispenser who knowingly fails to submit prescription monitoring data or naloxone medication data to the Program as required by Regulation .03 of this chapter shall be subject to a civil penalty not exceeding $500 for each failure to submit required information. Criminal Penalties. A person who knowingly discloses, uses, obtains, or attempts to obtain by fraud or deceit prescription monitoring data or naloxone medication data in violation of in Health-General Article, §21-2A, Annotated Code of Maryland, shall be guilty of a misdemeanor and on conviction is subject to imprisonment not exceeding 1 year or a fine not exceeding $10,000 or both. Administrative Sanctions. A prescriber or pharmacist who knowingly discloses or uses prescription monitoring data or naloxone medication data in violation of Health-General Article, §21-2A, Annotated Code of Maryland shall be subject to disciplinary action by the appropriate licensing entity. The Program shall make available the information technology necessary for dispensers to report prescription monitoring data and naloxone medication data to the Program. The Program may not impose any fees or other assessments on prescribers or dispensers to support the operation of the Program. A prescriber or pharmacist, when acting in good faith, is not subject to liability or disciplinary action arising solely from: Requesting or receiving prescription monitoring data from the Program; or Acting, or failing to act, on the basis of prescription monitoring data provided by the Program. Redisclosure of Prescription Monitoring Data. Prescription monitoring data received under Health-General Article, §21-2A-06, Annotated Code of Maryland, and Regulation .05 of this chapter may be redisclosed only: In a manner consistent with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. §1320d et seq., as amended, and all other State and federal laws and regulations governing the security and confidentiality of protected health information and personal medical records; or For entities to which the Program has disclosed data, in furtherance of an existing, bona fide, individual investigation to another agency cooperating with or providing support to the original data. The release of prescription monitoring data by a prescriber or pharmacist to a licensed health care professional solely for treatment purposes in a manner otherwise consistent with State and federal law is not a violation of Health-General Article, Title 21, Subtitle 2A, Annotated Code of Maryland. Redisclosure of Naloxone Medication Data. Naloxone medication data received under Health-General Article, §21-2A-6.1, Annotated Code of Maryland, and Regulation .05-1 of this chapter may be redisclosed only in a manner consistent with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. §1320d et seq., as amended, and all other State and federal laws and regulations governing the security and confidentiality of protected health information and personal medical records. The Program shall retain prescription monitoring data and naloxone medication data for 5 years from the date of receipt. A member of the Technical Advisory Committee: Shall serve for a term of 3 years from the date of appointment; and May be reappointed at the discretion of the Secretary. Health-General Article, Title 21, Subtitle 2A, Annotated Code of Maryland Effective date: January 7, 2013 (39:26 Md. R. 1665) Regulation .04H amended effective October 28, 2013 (40:21 Md. R. 1775) Regulation .08D amended effective October 28, 2013 (40:21 Md. R. 1775) Chapter revised effective June 8, 2015 (42:11 Md. R.725) Regulation .02B amended effective October 8, 2018 (45:20 Md. R. 918); May 18, 2020 (47:10 Md. R. 519); July 20, 2023 (50:8 Md. R. 338) Regulation .03 amended effective July 20, 2023 (50:8 Md. R. 338) Regulation .03B, F amended effective October 8, 2018 (45:20 Md. R. 918) Regulation .04 amended effective May 18, 2020 (47:10 Md. R. 519) Regulation .04A amended effective July 20, 2023 (50:8 Md. R. 338) Regulation .05 amended effective February 29, 2016 (43:4 Md. R. 332); October 8, 2018 (45:20 Md. R. 918); May 18, 2020 (47:10 Md. R. 519) Regulation .05D, F amended effective July 20, 2023 (50:8 Md. R. 338) Regulation .05-1 adopted effective July 20, 2023 (50:8 Md. R. 338) Regulation .06A amended effective October 8, 2018 (45:20 Md. R. 918) Regulation .07A, C amended effective July 20, 2023 (50:8 Md. R. 338) Regulation .08 amended effective July 20, 2023 (50:8 Md. R. 338) Regulation .08C amended effective October 8, 2018 (45:20 Md. R. 918) Regulation .09 amended effective July 20, 2023 (50:8 Md. R. 338) Regulation .09C—E amended effective October 8, 2018 (45:20 Md. R. 918)