2013 Maryland Code
HEALTH - GENERAL
§ 4-302 - Confidentiality and disclosure generally

§4-302.

(a) A health care provider shall:

(1) Keep the medical record of a patient or recipient confidential; and

(2) Disclose the medical record only:

(i) As provided by this subtitle; or

(ii) As otherwise provided by law.

(b) The provisions of this subtitle do not apply to information:

(1) Not kept in the medical record of a patient or recipient that is related to the administration of a health care facility, including:

(i) Risk management;

(ii) Quality assurance; and

(iii) Any activities of a medical or dental review committee that are confidential under the provisions of Title 4, Subtitle 5 and Title 14, Subtitle 5 of the Health Occupations Article and any activities of a pharmacy review committee;

(2) Governed by the federal confidentiality of alcohol and drug abuse patient records regulations, 42 C.F.R. Part 2 and the provisions of § 8-601(c) of this article; or

(3) Governed by the developmental disability confidentiality provisions in §§ 7-1008 through 7-1011 of this article.

(c) A health care provider may disclose directory information about a patient without the authorization of a person in interest, except if the patient has instructed the health care provider in writing not to disclose directory information.

(d) A person to whom a medical record is disclosed may not redisclose the medical record to any other person unless the redisclosure is:

(1) Authorized by the person in interest;

(2) Otherwise permitted by this subtitle;

(3) Permitted under § 1-202(b) or (c) of the Human Services Article; or

(4) Directory information.

(e) (1) Except as provided in paragraph (2) of this subsection, a person may not disclose by sale, rental, or barter any medical record.

(2) This subsection shall not prohibit the transfers of medical records relating to the transfer of ownership of a health care practice or facility if the transfer is in accord with the ethical guidelines of the applicable health care profession or professions.

(f) The provisions of this subtitle may not be construed to constitute an exception to the reporting requirements of Title 5, Subtitle 7 and Title 14, Subtitle 3 of the Family Law Article.

§ 4-302 - 1. Medical care electronic claims clearinghouses

(a) Limitations on payors' acceptance of claims. -- Payors that accept claims originating in this State from medical care electronic claims clearinghouses shall accept claims only from medical care electronic claims clearinghouses that are:

(1) Accredited by the Electronic Healthcare Network Accreditation Commission; or

(2) Certified by the Maryland Health Care Commission.

(b) Regulations. -- The Maryland Health Care Commission shall adopt regulations to carry out this section.

§ 4-302 - 2. Health information exchanges -- Regulations

(a) In general. -- The Maryland Health Care Commission shall adopt regulations for the privacy and security of protected health information obtained or released through a health information exchange by:

(1) A health care provider;

(2) A payor that holds a valid certificate of authority issued by the Maryland Insurance Commissioner;

(3) A health care consumer; or

(4) Any person authorized by a health care consumer to act on behalf of the health care consumer.

(b) Regulations to include protection for secondary use of information. -- The regulations adopted under subsection (a) of this section shall include protections for the secondary use of protected health information obtained or released through a health information exchange.

(c) Data to be sold only in accordance with regulations. -- Data obtained or released through a health information exchange:

(1) May not be sold for financial remuneration until the regulations required under subsections (a) and (b) of this section are adopted; and

(2) May be sold for financial remuneration only in accordance with the regulations adopted under subsections (a) and (b) of this section.

(d) Matters outside scope of regulations. -- Regulations adopted under subsections (a) and (b) of this section may not apply to protected health information exchanged:

(1) Between a hospital and credentialed members of the hospital's medical staff;

(2) Among credentialed members of a hospital's medical staff; or

(3) Between a hospital and ancillary clinical service providers that are affiliated with the hospital and have signed a business associate agreement.

(e) Consultations prior to adoption of regulations. -- The Maryland Health Care Commission shall consult with health care providers, payors, State health agencies, consumer advocates, and employers before adopting regulations under subsections (a) and (b) of this section.

§ 4-302 - 3. Health information exchanges -- State designated exchange

(a) (1) Definitions. -- In this section the following words have the meanings indicated.

(2) "State designated exchange" means the health information exchange designated by the Maryland Health Care Commission and the Health Services Cost Review Commission under § 19-143 of this article.

(3) "Standard request" means a request for clinical information from a health information exchange that conforms to the major standards version specified by the Office of the National Coordinator for Health Information Technology.

(b) Scope of section. -- This section applies to:

(1) Except for the State designated exchange, a health information exchange operating in the State; and

(2) A payor that:

(i) Holds a valid certificate of authority issued by the Maryland Insurance Commissioner; and

(ii) Acts as, operates, or owns a health information exchange.

(c) Connection to State designated exchange. -- An entity to which this section applies shall connect to the State designated exchange in a manner consistent with applicable federal and State privacy laws.

(d) Response to standard request. -- When a standard request for clinical information is received through the State designated exchange, an entity to which this section applies shall respond to the request to the extent authorized under federal and State privacy laws.

(e) Scope of consent. -- A consent from a patient to release clinical information to a provider obtained by an entity to which this section applies shall apply to information transmitted through the State designated exchange or by other means.

(f) Regulations -- Implementing connectivity to State designated exchange. -- The Maryland Health Care Commission:

(1) May adopt regulations for implementing the connectivity to the State designated exchange required under this section; and

(2) Shall seek, through any regulations adopted under item (1) of this subsection, to promote technology standards and formats that conform to those specified by the Office of the National Coordinator for Health Information Technology.

(g) Regulations -- Scope of clinical information to be exchanged. --

(1) The Maryland Health Care Commission may adopt regulations specifying the scope of clinical information to be exchanged under this section.

(2) Any regulations adopted under paragraph (1) of this subsection shall limit the scope of the clinical information to purposes that promote:

(i) Improved access to clinical records by treating clinicians; or

(ii) Uses of the State designated exchange important to public health agencies.

(h) Collection of additional clinical information or authorizations not required; permitted acts. -- This section does not:

(1) Require an entity to which this section applies to collect clinical information or obtain any authorizations, not otherwise required by federal or State law, relating to information to be sent or received through the State designated exchange;

(2) Prohibit an entity to which this section applies from directly receiving or sending information to providers or subscribers outside of the State designated exchange; or

(3) Prohibit an entity to which this section applies from connecting and interoperating with the State designated exchange in a manner and scope beyond that required under this section.

§ 4-302 - 4. New cause of action not created

The existence of a health information exchange does not, in itself, create a new cause of action against a health information exchange or a health care provider.