2010 Maryland Code
INSURANCE
TITLE 14 - ENTITIES THAT ACT AS HEALTH INSURERS
Subtitle 1 - Nonprofit Health Service Plans
Section 14-138 - Disclosure of medical information.

§ 14-138. Disclosure of medical information.
 

(a)  Prohibited.- Except as provided in subsection (b), (c), or (d) of this section, a nonprofit health service plan or Blue Cross or Blue Shield plan may not disclose specific medical information contained in a subscriber's or certificate holder's medical records. 

(b)  Exception - Disclosure to or authorized by subscriber or certificate holder.- A nonprofit health service plan or Blue Cross or Blue Shield plan may disclose specific medical information contained in a subscriber's or certificate holder's medical records: 

(1) to the individual or individual's agent or representative; or 

(2) if the individual authorizes the disclosure. 

(c)  Same - Disclosure without authorization of subscriber or certificate holder.- A nonprofit health service plan or Blue Cross or Blue Shield plan may disclose specific medical information contained in a subscriber's or certificate holder's medical records without the authorization of the subscriber or certificate holder: 

(1) to a medical review committee, accreditation board, or commission, if the information is requested by or is in furtherance of the purpose of the committee, board, or commission; 

(2) in response to legal process; 

(3) to another nonprofit health service plan, Blue Cross or Blue Shield plan, or insurer to coordinate benefit payments under multiple sickness and accident, dental, or hospital medical contracts; 

(4) to a government agency performing its lawful duties as authorized by an act of the General Assembly or United States Congress; 

(5) to a researcher, on request, for medical and health care research in accordance with a protocol approved by an institutional review board; 

(6) in accordance with a cost containment contractual obligation to verify that benefits paid by the nonprofit health service plan were proper contractually; or 

(7) to a third party payor if: 

(i) the third party payor does not further disclose the specific medical information; and 

(ii) the information is required for an audit of the billing made by the plan to the payor. 

(d)  Same - Identity of subscriber or certificate holder not disclosed.- This section does not prohibit the use of medical records, data, or statistics if the use does not disclose the identity of a particular subscriber or certificate holder. 

(e)  Liability for damages.- A nonprofit health service plan that knowingly violates this section is liable to a plaintiff for any damages recoverable in a civil action, including reasonable attorney's fees. 
 

[An. Code 1957, art. 48A, § 354-O; 1997, ch. 35, § 2; 1998, ch. 21, § 1.]