Law / United States / 
Maryland
Confidentiality of Medical Records Act: health care provider duties on medical records
Md. Code Ann., Health-Gen. §§ 4-301 to 4-309 (Title 4, Subtitle 3)
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Data subject rights, Disclosure, Prohibition
As of .
What it requires
- If you are a health care provider (a professional licensed, certified or otherwise authorized to provide health care, a facility where health care is provided, or an agent, employee, officer or director of one), keep the medical record of each patient or recipient confidential and disclose it only as the subtitle or other law provides (Health-Gen. 4-302(a)).
- Disclose a medical record on the authorization of a person in interest that is in writing, dated and signed by that person, states your name, identifies to whom the information is to be disclosed, and states a validity period of no more than 1 year unless an exception applies, and enter each authorization, any action taken on it and any revocation in the medical record (Health-Gen. 4-303).
- Comply within a reasonable time with a person in interest's written request for a copy of a medical record or to see and copy it, and do not refuse a request because the person in interest has not paid for health care you rendered (Health-Gen. 4-304(a), 4-309(b)).
- Establish procedures for a person in interest to request an addition to or correction of a medical record, answer a change request within a reasonable time by making the change or giving written notice of refusal with the reasons and any review procedures, and let the person in interest insert a statement of disagreement (Health-Gen. 4-304(b)).
- Do not disclose a medical record by sale, rental or barter, except in a transfer relating to the transfer of ownership of a health care practice or facility that accords with the ethical guidelines of the applicable health care profession (Health-Gen. 4-302(e)).
- Tell a patient what directory information you may include and to whom you may disclose it, and give the patient the opportunity to restrict or prohibit disclosure of directory information as soon as practicable (Health-Gen. 4-302(c)).
- If a medical record is disclosed to you, do not redisclose it unless the person in interest authorized the redisclosure, the subtitle permits it, section 1-202(b) or (c) of the Human Services Article permits it, or the information is directory information (Health-Gen. 4-302(d)).
- Do not request or obtain a medical record under false pretenses or through deception, and do not disclose a medical record in violation of the subtitle (Health-Gen. 4-309(c)).
- Disclose a medical record without the authorization of a person in interest where the subtitle requires it, including to a unit of State or local government investigating or treating suspected abuse or neglect of a child or an adult (Health-Gen. 4-306(b)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 4-309(d) makes a knowing and willful violation of any provision of the subtitle a misdemeanor punishable by a fine not exceeding $1,000 for a first offense and $5,000 for each subsequent conviction. Section 4-309(e)(1) makes knowingly and willfully requesting or obtaining a medical record under false pretenses or through deception, or knowingly and willfully disclosing one in violation of the subtitle, a misdemeanor punishable by a fine not exceeding $50,000, imprisonment for not more than 1 year, or both, rising to $100,000 and 5 years if the offense is committed under false pretenses and to $250,000 and 10 years if committed with intent to sell, transfer or use individually identifiable health information for commercial advantage, personal gain or malicious harm.
Who enforces it
Enforcement body
No administrative enforcer is named in the subtitle. A person in interest sues for actual damages under section 4-309(a) and (f), and a knowing and willful violation is prosecuted as a misdemeanor under section 4-309(d) and (e).
Settledness
- As of
- Open questions
- Does a health application company that holds no license under the Health Occupations Article and operates no facility fall within 'health care provider' as defined in section 4-301(h), or only within the 'any other person' clauses of section 4-309(c) to (e)?
What this law does
Chapter 480 of the Acts of 1990 enacted Subtitle 3, Confidentiality of Medical Records, of Title 4 of the Health-General Article.
A health care provider is a person licensed, certified or otherwise authorized under the Health Occupations Article or section 13-516 of the Education Article to provide health care in the ordinary course of business or practice, or a facility where health care is provided, and includes the agents, employees, officers and directors of a facility and the agents and employees of a health care provider.
A medical record is any oral, written or other transmission in any form or medium of information that is entered in the record of a patient or recipient, identifies or can readily be associated with the identity of the patient or recipient, and relates to the health care of the patient or recipient. A health care provider must keep the medical record of a patient or recipient confidential and disclose it only as Subtitle 3 or other law provides.
Subtitle 3 does not apply to information not kept in the medical record that relates to the administration of a health care facility, such as risk management and quality assurance, or to information governed by the federal confidentiality of alcohol and drug abuse patient records regulations or the developmental disability confidentiality provisions in sections 7-1008 through 7-1011 of the Health-General Article.
A person to whom a medical record is disclosed may not redisclose it unless the redisclosure is authorized by the person in interest, otherwise permitted by Subtitle 3, permitted under section 1-202(b) or (c) of the Human Services Article, or directory information. Except for transfers relating to the transfer of ownership of a health care practice or facility, a person may not disclose a medical record by sale, rental or barter.
A health care provider must disclose a medical record on the authorization of a person in interest, and the authorization must be in writing, dated and signed by the person in interest, state the name of the health care provider, identify to whom the information is to be disclosed, and state a validity period that may not exceed 1 year, with stated exceptions.
A health care provider must comply within a reasonable time after a person in interest requests in writing to receive a copy of a medical record or to see and copy it. A health care provider must establish procedures for a person in interest to request an addition to or correction of a medical record, and a person in interest may not have any information deleted from a medical record.
A health care provider may disclose a medical record without the authorization of a person in interest to the provider's authorized employees, agents, medical staff, medical students or consultants for the sole purpose of offering, providing, evaluating or seeking payment for health care to patients or recipients by the provider.
A health care provider must disclose a medical record without the authorization of a person in interest to a unit of State or local government, or a member of a multidisciplinary team assisting the unit, for purposes of investigation or treatment in a case of suspected abuse or neglect of a child or an adult, subject to stated conditions.
A health care provider that knowingly refuses to disclose a medical record within a reasonable time, but no more than 21 working days after the date a person in interest requests the disclosure, is liable for actual damages. A health care provider or any other person who knowingly violates any provision of Subtitle 3 is liable for actual damages.
A health care provider or any other person, including an officer or employee of a governmental unit, who knowingly and willfully violates a provision of Subtitle 3 is guilty of a misdemeanor and on conviction is subject to a fine not exceeding $1,000 for the first offense and not exceeding $5,000 for each subsequent conviction, except where subsection (e) applies.
Knowingly and willfully requesting or obtaining a medical record under false pretenses or through deception, or knowingly and willfully disclosing a medical record in violation of Subtitle 3, is a misdemeanor punishable by a fine not exceeding $50,000, imprisonment for not more than 1 year, or both, with higher penalties if the offense is committed under false pretenses or with intent to sell, transfer or use individually identifiable health information for commercial advantage, personal gain or malicious harm.
When LexLint raises it
When your app profile says your app handles health records.