Except when communicating with the parties listed in §B of this regulation and unless otherwise authorized by law, the agent of an applicant, or the agent of a recipient, the Department:

1. A. Shall keep all applicant and recipient personal information confidential;

2. B. May not disclose personal information kept on an applicant or recipient without written consent of the:

   1. (1) Applicant;
   2. (2) Recipient;
   3. (3) Applicant’s parent or legal guardian; or
   4. (4) Recipient’s parent or legal guardian;

3. C. Shall comply with the laws and regulations concerning the privacy and security of protected health information under:

   1. (1) Health-General Article, Title 4, Subtitle 3, Annotated Code of Maryland; and
   2. (2) The Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. §§1320d et seq., as amended, the HITECH Act, 42 U.S.C. §§17932, et seq., as amended, and 45 CFR Parts 160 and 164, as amended, and their implementing regulations; and
4. D. Shall ensure that all interactive video technology-assisted communication comply with HIPAA patient privacy and security regulations.

Authority: Health-General Article, §§2-104(b), 2-104(j), 2-105(a), and 18-102(a), Annotated Code of Maryland

Effective date: March 28, 2016 (43:6 Md. R. 408)

Regulation .02B amended effective May 20, 2019 (46:10 Md. R. 488)

Regulation .04B amended effective May 20, 2019 (46:10 Md. R. 488)

Regulation .05B amended effective May 20, 2019 (46:10 Md. R. 488)