Handles health records, in Maryland

Md. Code Ann., Ins. §15-10B-05.1 · Read the law's page

• Base any determination an AI, algorithm, or other software tool makes in utilization review on the enrollee's own medical or clinical history, individual clinical circumstances, or other relevant clinical information in the enrollee's record, never solely on a group dataset.when it serves a financial business
• Keep a health care provider in the determination process; the tool may not replace that role.when it serves a financial business
• Ensure the tool is fairly and equitably applied and does not result in unfair discrimination or directly or indirectly cause harm to an enrollee.when it serves a financial business
• Make the tool available for audit or compliance review by the Insurance Commissioner, and review its performance, use, and outcomes at least quarterly.when it serves a financial business
• The tool may not itself deny, delay, or modify health care services.when it serves a financial business
• This applies to carriers, and to pharmacy benefits managers or private review agents that conduct utilization review on a carrier's behalf.

COMAR 10.25.05 · Read the law's page

• If you are the Maryland Health Care Commission and provide a de-identified standard analytic file under an approved application, provide a data extract that contains only data elements that are not considered PHI because the extract excludes direct and indirect individual identifiers as defined in the HIPAA Privacy Rule (COMAR 10.25.05.03C(1)).
• If you are the Maryland Health Care Commission and provide a limited data set under an approved application, provide a data extract that contains a limited set of indirect individual identifiers as defined in the HIPAA Privacy Rule and excludes direct individual identifiers (COMAR 10.25.05.03C(2)).
• If you are a governmental entity requesting data from the Maryland Medical Care Data Base, include in your written data request the safeguards against re-identification of an individual in a product that you will create or publish publicly (COMAR 10.25.05.05B(4)).

COMAR 10.25.18 · Read the law's page

• If you operate a health information exchange, disclose de-identified data or a limited data set to a care management organization for population health management only when an internal review committee designated by the organization has entered into a data use agreement with you and attested that the request is for population health management and limited to the minimum necessary (COMAR 10.25.18.10B(1)).
• Disclose de-identified data to a qualified research organization only when a privacy board has confirmed that the requesting entity is a qualified research organization and that the requested data is for research, limited to the minimum necessary, serves a legitimate purpose consistent with the interest of the subject individuals, and meets the de-identification standard in 45 CFR 164.514(a) to (c) (COMAR 10.25.18.10C(1)).
• If you are a qualified research organization receiving data from a health information exchange for research, contractually agree not to link de-identified data received from the exchange with other data sources to re-identify it and not otherwise to attempt to re-identify it (COMAR 10.25.18.10C(7)(a)).
• Treat as de-identified data only health information that neither identifies nor provides a reasonable basis to identify an individual and that meets 45 CFR 164.514(a) and (b) (COMAR 10.25.18.02B(21)).

Md. Code Ann., Health-Gen. §§ 4-301 to 4-309 (Title 4, Subtitle 3) · Read the law's page

• If you are a health care provider (a professional licensed, certified or otherwise authorized to provide health care, a facility where health care is provided, or an agent, employee, officer or director of one), keep the medical record of each patient or recipient confidential and disclose it only as the subtitle or other law provides (Health-Gen. 4-302(a)).
• Disclose a medical record on the authorization of a person in interest that is in writing, dated and signed by that person, states your name, identifies to whom the information is to be disclosed, and states a validity period of no more than 1 year unless an exception applies, and enter each authorization, any action taken on it and any revocation in the medical record (Health-Gen. 4-303).
• Comply within a reasonable time with a person in interest's written request for a copy of a medical record or to see and copy it, and do not refuse a request because the person in interest has not paid for health care you rendered (Health-Gen. 4-304(a), 4-309(b)).
• Establish procedures for a person in interest to request an addition to or correction of a medical record, answer a change request within a reasonable time by making the change or giving written notice of refusal with the reasons and any review procedures, and let the person in interest insert a statement of disagreement (Health-Gen. 4-304(b)).
• Do not disclose a medical record by sale, rental or barter, except in a transfer relating to the transfer of ownership of a health care practice or facility that accords with the ethical guidelines of the applicable health care profession (Health-Gen. 4-302(e)).
• Tell a patient what directory information you may include and to whom you may disclose it, and give the patient the opportunity to restrict or prohibit disclosure of directory information as soon as practicable (Health-Gen. 4-302(c)).
• If a medical record is disclosed to you, do not redisclose it unless the person in interest authorized the redisclosure, the subtitle permits it, section 1-202(b) or (c) of the Human Services Article permits it, or the information is directory information (Health-Gen. 4-302(d)).
• Do not request or obtain a medical record under false pretenses or through deception, and do not disclose a medical record in violation of the subtitle (Health-Gen. 4-309(c)).
• Disclose a medical record without the authorization of a person in interest where the subtitle requires it, including to a unit of State or local government investigating or treating suspected abuse or neglect of a child or an adult (Health-Gen. 4-306(b)).