Law / United States / 
Maryland
Insurer disclosure of an insured's medical or claims records: authorization and listed exceptions
In force.
A sensitive categories rule binding private bodies.
- Obligation class
- Prohibition, Consent, Disclosure
As of .
What it requires
- If you are an insurer, or an insurance service organization whose functions include the collection of medical data, do not disclose the contents of an insured's medical or claims records except to the insured, the insured's agent or representative or, on the insured's request, a physician of the insured's choice, with the insured's authorization, or in one of the cases listed in Ins. 4-403(c) (Ins. 4-403(a)-(c)).
- Before you disclose an insured's medical information to the insured's treating providers under Ins. 4-403(c)(12), give the insured a notice that specifies the information to be shared, with whom it will be shared and the uses and disclosures you may make, and an opportunity to opt out of the sharing (Ins. 4-403(c)(12)(iii)-(iv)).
- Disclose through an infrastructure for the exchange of protected health information among entities not under common ownership only in compliance with Health-Gen. 4-302.2 and 4-302.3 (Ins. 4-403(c)(12)(v)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionYes
Penalty structure
Section 4-113(d)(1) of the Insurance Article lets the Commissioner, instead of or in addition to suspending or revoking a certificate of authority, impose on the holder a penalty of not less than $100 but not more than $125,000 for each violation of the article.
- Rule
- Per violation only
- As of
- Minimum
- 100
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 125,000
Who enforces it
Enforcement body
Maryland Insurance Commissioner, who may penalize the holder of a certificate of authority under section 4-113(d) of the Insurance Article; a plaintiff may recover damages under section 4-403(e).
Settledness
- As of
- Open questions
- Does an insurer's disclosure of an insured's claims records to a third-party vendor that administers the claims count as a disclosure of 'the contents of an insured's medical or claims records' under section 4-403(a), or does it fall within an item of subsection (c)?
What this law does
An insurer, or an insurance service organization whose functions include the collection of medical data, may not disclose the contents of an insured's medical or claims records, except as subsection (b), (c) or (d) of Insurance Article section 4-403 provides.
An insurer may disclose specific medical information or medical data contained in an insured's medical or claims records to the insured, the insured's agent or representative, or, on request of the insured, a physician of the insured's choice. An insurer, or an insurance service organization whose functions include the collection of medical data, may disclose specific medical information or medical data contained in an insured's medical or claims records if the insured authorizes the disclosure.
Subsection (c) of Insurance Article section 4-403 lets an insurer or insurance service organization disclose specific medical information without the insured's authorization in twelve listed cases, including legal process, investigating possible insurance fraud, reinsurance purposes, underwriting through an insurer information exchange, evaluating an application or a claim, and disclosure to the insured's treating providers for care coordination.
A disclosure to the insured's treating providers under item (12) of subsection (c) is subject to the additional limits in section 4-307 of the Health-General Article on mental health records, may be made only in accordance with the federal Health Insurance Portability and Accountability Act (HIPAA) privacy rules, and requires a notice that gives the insured an opportunity to opt out of the sharing.
Insurance Article section 4-403 does not prohibit the use of medical records, data or statistics if the use does not disclose the identity of a particular insured or covered person. An insurer that knowingly violates Insurance Article section 4-403 is liable to a plaintiff for any damages recoverable in a civil action, including reasonable attorney's fees.
Insurance Article section 4-113 lets the Commissioner, instead of or in addition to suspending or revoking a certificate of authority, impose on the holder a penalty of not less than $100 but not more than $125,000 for each violation of the article.
When LexLint raises it
When your app profile says your app is an insurer.