Maryland Insurance Section 4-403

      (a)      Except as provided in subsection (b), (c), or (d) of this section, an insurer, or an insurance service organization whose functions include the collection of medical data, may not disclose the contents of an insured's medical records.

      (b)      (1)      An insurer may disclose specific medical information contained in an insured's medical records to:

                  (i)      the insured;

                  (ii)      the insured's agent or representative; or

                  (iii)      on request of the insured, a physician of the insured's choice.

            (2)      An insurer, or an insurance service organization whose functions include the collection of medical data, may disclose specific medical information contained in an insured's medical records if the insured authorizes the disclosure.

      (c)      An insurer, or an insurance service organization whose functions include the collection of medical data, may disclose the contents of an insured's medical records without the authorization of the insured:

            (1)      to a medical review committee, accreditation board, or commission, if the information is requested by or is in furtherance of the purpose of the committee, board, or commission;

            (2)      in response to legal process;

            (3)      to a nonprofit health service plan or Blue Cross or Blue Shield plan to coordinate benefit payments under multiple sickness and accident, dental, or hospital medical contracts;

            (4)      to investigate possible insurance fraud;

            (5)      for reinsurance purposes;

            (6)      in the normal course of underwriting, to an insurer information exchange that may not redisclose the information unless expressly authorized by the person to whom the information pertains;

            (7)      to evaluate an application for or renewal of insurance;

            (8)      to evaluate and adjust a claim for benefits under a policy;

            (9)      to evaluate, settle, or defend a claim or suit for personal injury;

            (10)      in accordance with a cost containment contractual obligation to verify that benefits paid by the insurer were proper contractually; or

            (11)      to a policyholder if:

                  (i)      the policyholder does not further disclose the specific medical information; and

                  (ii)      the information is required for an audit of the billing made by the insurer to the policyholder.

      (d)      This section does not prohibit the use of medical records, data, or statistics if the use does not disclose the identity of a particular insured or covered person.

      (e)      An insurer that knowingly violates this section is liable to a plaintiff for any damages recoverable in a civil action, including reasonable attorney's fees.