Maryland Health - General Section 4-303
§ 4-303.
  (a)   A health care provider shall disclose a medical record on the authorization of a person in interest in accordance with this section.
  (b)   Except as otherwise provided in subsection (c) of this section, an authorization shall:
    (1)   Be in writing, dated, and signed by the person in interest;
    (2)   State the name of the health care provider;
    (3)   Identify to whom the information is to be disclosed;
    (4)   State the period of time that the authorization is valid, which may not exceed 1 year, except:
      (i)   In cases of criminal justice referrals, in which case the authorization shall be valid until 30 days following final disposition; or
      (ii)   In cases where the patient on whom the medical record is kept is a resident of a nursing home, in which case the authorization shall be valid until revoked, or for any time period specified in the authorization; and
    (5)   Apply only to a medical record developed by the health care provider unless in writing:
      (i)   The authorization specifies disclosure of a medical record that the health care provider has received from another provider; and
      (ii)   The other provider has not prohibited redisclosure.
  (c)   A health care provider shall disclose a medical record on receipt of a preauthorized form that is part of an application for insurance.
  (d)   (1)   Except in cases of criminal justice referrals, a person in interest may revoke an authorization in writing.
    (2)   A revocation of an authorization becomes effective on the date of receipt by the health care provider.
    (3)   A disclosure made before the effective date of a revocation is not affected by the revocation.
  (e)   A copy of the following shall be entered in the medical record of a patient or recipient:
    (1)   A written authorization;
    (2)   Any action taken in response to an authorization; and
    (3)   Any revocation of an authorization.