Law / United States / 
Maryland
Maryland Medical Care Data Base data release: de-identified and limited data set files and safeguards against re-identification
In force.
A de-identification rule binding public and private bodies.
- Obligation class
- Disclosure
- Audit expectation
- none
What it requires
- If you are the Maryland Health Care Commission and provide a de-identified standard analytic file under an approved application, provide a data extract that contains only data elements that are not considered PHI because the extract excludes direct and indirect individual identifiers as defined in the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (COMAR 10.25.05.03C(1)).
- If you are the Maryland Health Care Commission and provide a limited data set under an approved application, provide a data extract that contains a limited set of indirect individual identifiers as defined in the HIPAA Privacy Rule and excludes direct individual identifiers (COMAR 10.25.05.03C(2)).
- If you are a governmental entity requesting data from the Maryland Medical Care Data Base, include in your written data request the safeguards against re-identification of an individual in a product that you will create or publish publicly (COMAR 10.25.05.05B(4)).
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
Maryland Health Care Commission, acting through its Executive Director, which may terminate or suspend a data recipient's access, require a product to be suspended or retracted, or demand destruction of the data when a data recipient fails to comply with a data use agreement (COMAR 10.25.05.14A).
Settledness
- As of
What record it asks for
Logging duty
Regulations .03C and .05B(4) set the levels of detail at which data is provided and a re-identification safeguard to be stated in a request. They state no log or record duty for de-identified data.
- Kind
- None
- As of
What this law does
COMAR 10.25.05.01A sets the requirements, parameters, administrative process, and procedures for submission, review, approval, and disapproval of requests for data from the Maryland Medical Care Data Base. COMAR 10.25.05.02B(11) defines de-identified data as information that does not identify an individual and for which there is no reasonable basis to believe that it can be used to identify an individual.
COMAR 10.25.05.03C(1) describes a de-identified standard analytic file as a data extract that contains only data elements that are not considered PHI because the extract excludes direct and indirect individual identifiers as defined in the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. COMAR 10.25.05.03C(2) describes a limited data set as a data extract that contains a limited set of indirect individual identifiers as defined in the HIPAA Privacy Rule and excludes direct individual identifiers.
COMAR 10.25.05.05B(4) requires a governmental entity's written data request to include the safeguards against re-identification of an individual in a product that will be created or published publicly by the governmental entity.
When LexLint raises it
When your app profile says your app handles health records, processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .