1. A. Requirement. The Department may not share BAR information with a person until the person becomes a trusted partner by entering into a trusted partner agreement, using the form developed by the Department.

2. B. The Department shall develop and use a trusted partner form that contains, as applicable, separate clauses that:

   1. (1) Establish the length of time that the trusted partner agreement is in effect;

   2. (2) Address that confidentiality will survive the termination, expiration, or cancellation of the trusted partner agreement and state that the trusted partner:

      1. (a) May not use BAR information in a way that is detrimental to the Department;
      2. (b) Shall keep BAR information confidential;

      3. (c) Shall limit disclosure of BAR information only:

         1. (i) To individuals with a legitimate need in performance of the individuals' duties; and
         2. (ii) On a need-to-know basis as prescribed by this chapter; and

      4. (d) Shall employ security policies that:

         1. (i) Protect the confidentiality of BAR information; and
         2. (ii) Prevent improper disclosures or access to BAR information;
   3. (3) Require the trusted partner to notify the Department whenever the trusted partner discloses BAR information as allowed by this chapter;
   4. (4) Warrant and represent that the trusted partner is in compliance with all applicable State and federal laws and regulations regarding BAR information;
   5. (5) Require the trusted partner to execute a trusted partner agreement that upholds the standards and requirements in the trusted partner agreement that the trusted partner has with the Department;

   6. (6) Require the trusted partner to notify the Department when there is:

      1. (a) An improper or unauthorized:

         1. (i) Disclosure of BAR information; or
         2. (ii) Access to BAR information;
      2. (b) A misuse of BAR information;
      3. (c) A computer information system compromise that affects BAR information; or
      4. (d) An authorized release of BAR information as set forth in this chapter;

   7. (7) Address corrective action by stating:

      1. (a) The steps necessary to prevent any further unauthorized disclosure and misuse of BAR information;
      2. (b) That the trusted partner shall maintain an incident log of all unauthorized disclosures and misuse of BAR information; and
      3. (c) That the trusted partner shall send a copy of incident log entries to the BAR Program;

   8. (8) Require the trusted partner to:

      1. (a) Return the BAR information that was provided to the trusted partner; and
      2. (b) Exercise due diligence to destroy all material based on BAR information in a manner that renders nonidentifiable all documents, memoranda, notes, or other writings created or prepared by or for the trusted partner or BAR information custodian;
   9. (9) Require the trusted partner to make available on demand to the Department all policies and procedures relevant to safeguarding BAR information;

   10. (10) Address the authority of the individuals signing the trusted partner agreement that state that:

       1. (a) The individuals signing the trusted partner agreement have the right and authority to execute the agreement on behalf of their respective entity; and
       2. (b) No further approvals are necessary to make the trusted partner agreement binding;
   11. (11) State that the trusted partner agreement is the entire agreement between the Department and the trusted partner;
   12. (12) State that the trusted partner agreement may not be amended, except as agreed to by the Department in writing;
   13. (13) State that no provision or clause in the trusted partner agreement may be waived unless approved in writing by the Department;
   14. (14) Identify the individual designated by the trusted partner and authorized by the Department to receive, maintain, and if provided by this chapter, release BAR information;
   15. (15) Attest that the BAR information custodian has the trusted partner's agency clearance to receive BAR information;

   16. (16) Address a trusted partner's security policy that states the:

       1. (a) Value of BAR information;
       2. (b) Protection responsibilities; and
       3. (c) Organizational commitment for a system to protect the integrity, confidentiality, and availability of BAR information; and
   17. (17) State that if a provision, section, subsection, sentence, clause, or phrase of the trusted partner agreement is held invalid, the remaining portions of the trusted partner agreement remain valid.

Authority: Health-General Article, §§17-601—17-605, Annotated Code of Maryland

Effective date: November 25, 2002 (29:23 Md. R. 1811)

Chapter revised effective July 31, 2006 (33:15 Md. R. 1280)

Chapter revised effective January 23, 2012 (39:1 Md. R. 17)

Regulation .03B amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .04B amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .07F amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .09B amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .10E amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .11A amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .12B, C amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .13 amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .14 amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .21 amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .22 amended effective May 18, 2020 (47:10 Md. R. 517)