1. A. A trusted partner shall protect and maintain BAR information in a secure manner by limiting access only to a BAR information custodian who is:

   1. (1) An individual designated by the trusted partner; and
   2. (2) Authorized by the Department in a trusted partner agreement.

2. B. Before the Department shares BAR information with a trusted partner, the trusted partner shall:

   1. (1) Develop, implement, and maintain administrative, physical, and technical security measures and practices to protect and safeguard the integrity, confidentiality, and availability of BAR information by managing and supervising the:

      1. (a) Selection, execution, and use of security measures to protect BAR information; and
      2. (b) Conduct of personnel in relation to the protection of BAR information;
   2. (2) Assess potential risks and vulnerabilities to the BAR information in its possession using a BAR information security self-assessment checklist provided by the BAR Program; and

   3. (3) Submit a:

      1. (a) Completed BAR information security self-assessment; and
      2. (b) Document verifying that the trusted partner's BAR information custodian has successfully undergone a security risk assessment as described in 42 CFR §73.7.

3. C. If a BAR information custodian believes that the security of BAR information has been or is suspected to have been misused, mishandled, lost, stolen, or otherwise compromised, the BAR information custodian shall immediately notify the:

   1. (1) BAR Program; and
   2. (2) Individuals who signed the BAR information custodian's trusted partner agreement.

Authority: Health-General Article, §§17-601—17-605, Annotated Code of Maryland

Effective date: November 25, 2002 (29:23 Md. R. 1811)

Chapter revised effective July 31, 2006 (33:15 Md. R. 1280)

Chapter revised effective January 23, 2012 (39:1 Md. R. 17)

Regulation .03B amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .04B amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .07F amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .09B amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .10E amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .11A amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .12B, C amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .13 amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .14 amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .21 amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .22 amended effective May 18, 2020 (47:10 Md. R. 517)