Law / United States / 
Maryland
Health information exchanges: privacy and security of protected health information, de-identified data and re-identification
In force.
A de-identification rule binding private bodies.
- Obligation class
- Prohibition, Consent
- Audit expectation
- none
What it requires
- If you operate a health information exchange, disclose de-identified data or a limited data set to a care management organization for population health management only when an internal review committee designated by the organization has entered into a data use agreement with you and attested that the request is for population health management and limited to the minimum necessary (COMAR 10.25.18.10B(1)).
- Disclose de-identified data to a qualified research organization only when a privacy board has confirmed that the requesting entity is a qualified research organization and that the requested data is for research, limited to the minimum necessary, serves a legitimate purpose consistent with the interest of the subject individuals, and meets the de-identification standard in 45 CFR 164.514(a) to (c) (COMAR 10.25.18.10C(1)).
- If you are a qualified research organization receiving data from a health information exchange for research, contractually agree not to link de-identified data received from the exchange with other data sources to re-identify it and not otherwise to attempt to re-identify it (COMAR 10.25.18.10C(7)(a)).
- Treat as de-identified data only health information that neither identifies nor provides a reasonable basis to identify an individual and that meets 45 CFR 164.514(a) and (b) (COMAR 10.25.18.02B(21)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Penalty structure
Regulation .09C(3)(a) subjects a person who knowingly fails to comply with the chapter to a civil penalty imposed by the Commission not exceeding $10,000 per day.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Day
- Per violation amount
- 10,000
Over one month of continuous breach, USD 304,400.
Who enforces it
Enforcement body
Maryland Health Care Commission, which may take an enforcement action when it has a reasonable basis to believe that a person has violated a provision of the chapter (COMAR 10.25.18.09C).
Settledness
- As of
What it makes you log
Logging duty
Regulations .02B(21) and .10 set conditions for disclosing and receiving de-identified data and require a research recipient's contractual promise not to re-identify it. They state no log or record duty for de-identified data.
- Kind
- None
- As of
What this law does
COMAR 10.25.18.02B(21) defines de-identified data as health information that neither identifies nor provides a reasonable basis to identify an individual and that meets the standards and specifications provided in 45 CFR 164.514(a) and (b). COMAR 10.25.18.01B applies the chapter to a health information exchange and to a person who accesses, uses, or discloses protected health information through one.
A health information exchange may disclose de-identified data or a limited data set to a care management organization for population health management if an internal review committee designated by the organization has entered into a data use agreement with the exchange and attested that the request is for population health management and limited to the minimum necessary.
A health information exchange may disclose de-identified data to a qualified research organization for research purposes if a privacy board has evaluated and confirmed that the requesting entity is a qualified research organization and that the requested data is for research purposes, is limited to the minimum necessary, will be used to serve a legitimate purpose consistent with the interest of the subject individuals, and meets the de-identification standard in 45 CFR 164.514(a) to (c).
A qualified research organization that receives data from a health information exchange for research must contractually agree not to attempt to link de-identified data received from the exchange with other data sources in an effort to re-identify the data, or otherwise attempt in any other way to re-identify the data. A person who knowingly fails to comply with the chapter is subject to a civil penalty imposed by the Maryland Health Care Commission not exceeding $10,000 per day.
When LexLint raises it
When your app profile says your app handles health records, processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .