Maryland Health - General Section 4-303

      (a)      A health care provider shall disclose a medical record on the authorization of a person in interest in accordance with this section.

      (b)      Except as otherwise provided in subsection (c) of this section, an authorization shall:

            (1)      Be in writing, dated, and signed by the person in interest;

            (2)      State the name of the health care provider;

            (3)      Identify to whom the information is to be disclosed;

            (4)      State the period of time that the authorization is valid, which may not exceed 1 year, except:

                  (i)      In cases of criminal justice referrals, in which case the authorization shall be valid until 30 days following final disposition; or

                  (ii)      In cases where the patient on whom the medical record is kept is a resident of a nursing home, in which case the authorization shall be valid until revoked, or for any time period specified in the authorization; and

            (5)      Apply only to a medical record developed by the health care provider unless in writing:

                  (i)      The authorization specifies disclosure of a medical record that the health care provider has received from another provider; and

                  (ii)      The other provider has not prohibited redisclosure.

      (c)      A health care provider shall disclose a medical record on receipt of a preauthorized form that is part of an application for insurance.

      (d)      (1)      Except in cases of criminal justice referrals, a person in interest may revoke an authorization in writing.

            (2)      A revocation of an authorization becomes effective on the date of receipt by the health care provider.

            (3)      A disclosure made before the effective date of a revocation is not affected by the revocation.

      (e)      A copy of the following shall be entered in the medical record of a patient or recipient:

            (1)      A written authorization;

            (2)      Any action taken in response to an authorization; and

            (3)      Any revocation of an authorization.