1. A. If a data recipient fails to comply with any of the terms and conditions of a data use agreement, or it becomes known after execution of a data use agreement that a data recipient provided false information during the application process, the Commission, acting through the Executive Director, may take one or more of the following administrative and judicial enforcement actions, depending upon the facts, circumstances, and gravity of the acts of noncompliance:

   1. (1) Terminate a data recipient’s current access to data;

   2. (2) Suspend a data recipient’s current access to data for a period of time:

      1. (a) Subject to conditions that a data recipient must satisfy before the suspension may be lifted and access to data reinstated; or
      2. (b) If required by the Executive Director, until a data recipient enters into a new data use agreement that requires compliance with a corrective action plan addressing the acts of noncompliance;
   3. (3) Require a data recipient to suspend or retract for a designated period of time a product that has been created or published from the data, subject to conditions that a data recipient must satisfy before the suspension or retraction may be lifted;
   4. (4) Demand the secure destruction or return of data and require documentary proof that all data released to a data recipient has been destroyed;
   5. (5) Terminate a data use agreement; or
   6. (6) Prohibit a data recipient from submitting a new application requesting data for a designated period of time.
2. B. The Executive Director may refer an instance of unauthorized access, use, or disclosure of data to the Office of the Attorney General of Maryland, the Maryland State’s Attorney Office, or any other appropriate State or federal law enforcement authority.

3. C. The Commission, based upon information provided by the Executive Director, may seek any appropriate administrative and judicial remedy allowed by State or federal law for:

   1. (1) Failing to comply with any terms and conditions for accessing and using data; and
   2. (2) Any instance of unauthorized or impermissible access, use, and disclosure of data.

Authority: Health-General Article, §§19-103(c)(3), 19-109(a)(1) and (7) and (b)(5), and 19-133(d), and 19-134, Annotated Code of Maryland

Effective date: June 19, 1995 (22:12 Md. R. 900)

Regulation .01 amended effective October 15, 2001 (28:20 Md. R. 1783)

Regulation .02 amended effective October 15, 2001 (28:20 Md. R. 1783); October 22, 2007 (34:21 Md. R. 1915)

Regulation .04 amended effective December 23, 2002 (29:25 Md. R. 1983)

Regulation .06 amended effective March 10, 1997 (24:5 Md. R. 412)

Regulation .06 repealed and new Regulation .06 adopted effective October 15, 2001 (28:20 Md. R. 1783)

Regulation .06 repealed effective October 22, 2007 (34:21 Md. R. 1915)

Regulations .01—.05 under Small Group Market Data Collection repealed and new Regulations .01—.14 under Data Release adopted effective December 13, 2021 (48:25 Md. R. 1079)