1. A. This chapter addresses the privacy and security of protected health information maintained by a health information exchange, or obtained or released by any person through a health information exchange by adopting specific requirements:

   1. (1) To assure the privacy and security of protected health information accessed, used, or disclosed through a health information exchange, including protections for the secondary use of protected health information obtained, accessed, or released through a health information exchange;
   2. (2) To govern the access, use, maintenance, and disclosure of protected health information through or by a health information exchange;
   3. (3) To improve access to clinical records by treating clinicians; and
   4. (4) To promote uses of a State-designated HIE that will assist public health agencies in reaching public health goals.

2. B. This chapter applies to:

   1. (1) An HIE, as defined in Regulation .02B(38) of this chapter, including:

      1. (a) An individual or entity that determines, controls, or has discretion to administer any requirement, policy, or agreement that allows, enables, or requires the use of any technology or services for access, exchange, or use of electronic protected health information:

         1. (i) Among more than two unaffiliated individuals or entities that are enabled to exchange electronic protected health information with each other; and
         2. (ii) That is for a treatment, payment, or health care operations purpose, as those terms are defined in 45 CFR §164.501, regardless of whether the individuals or entities are subject to the requirements of 45 CFR Parts 160 and 164; and
      2. (b) A health information technology developer of certified health information technology as that term is defined in Regulation .02B(39) of this chapter;
   2. (2) A person who accesses, uses, or discloses protected health information through an HIE;
   3. (3) Electronic health information stored in, or maintained by, an HIE; and
   4. (4) A dispenser authorized by law to dispense noncontrolled prescription drugs to a patient or the patient’s agent in the State.

3. C. This chapter does not apply to:

   1. (1) Protected health information exchanged, accessed, used, or disclosed:

      1. (a) Between a hospital and a credentialed professional;
      2. (b) Among credentialed professionals of a hospital’s medical staff;
      3. (c) Between a hospital and its affiliated ancillary clinical service provider who is affiliated with the hospital and who, if required by HIPAA, has entered into a business associate agreement with the hospital;
      4. (d) Among entities under common ownership as defined at Health-General Article, §4-301, Annotated Code of Maryland, for health care treatment, payment, or health care operations purposes, as those terms are defined in 45 CFR §164.501;
      5. (e) By a carrier, as defined in Insurance Article, §15-301, Annotated Code of Maryland, exchanging information as required by 45 CFR §156.221; or
      6. (f) Between a carrier and its business associate, as defined in 45 CFR §160.103, if the organizational and technical processes provided or governed by the business associate are transactions, as defined in 45 CFR §160.103; or
   2. (2) The use, access, or disclosure of protected health information using point-to-point transmission unless an HIE is involved in the transmission of the data.
4. D. In the event that an HIE is unable to meet a requirement of this chapter independently, it may do so by the execution of a written agreement or by requesting an exemption in accordance with Regulation .09G or H of this chapter.

5. E. The requirements in this chapter are in addition to those set forth below:

   1. (1) The Health Insurance Portability and Accountability Act of 1996, and the pertinent regulations at 45 CFR Parts 160 and 164;
   2. (2) The Maryland Consumer Protection Act, Commercial Law Article, Title 13, Annotated Code of Maryland;
   3. (3) The Maryland Personal Information Protection Act, Commercial Law Article, Title 14, Subtitle 35, Annotated Code of Maryland;
   4. (4) The Maryland Confidentiality of Medical Records Act, Health-General Article, Title 4, Subtitle 3, Annotated Code of Maryland;
   5. (5) Health General Article, §4-307, Annotated Code of Maryland, Confidentiality of Mental Health Records;
   6. (6) 16 CFR Part 318, Health Breach Notification Rule, adopted by the Federal Trade Commission pursuant to the HITECH Act;
   7. (7) 42 CFR Part 2, Confidentiality of Substance Use Disorder Patient Records;
   8. (8) Titles IV and XI of the 21st Century Cures Act and the pertinent regulations, 45 CFR Part 171, and as defined at Regulation .02B(78) of this chapter; and
   9. (9) All other applicable State and federal laws and regulations governing the use, access, maintenance, and disclosure of health information.

6. F. Nothing in this chapter shall prohibit:

   1. (1) The Maryland Department of Health, the Commission, or the Health Services Cost Review Commission from using electronic health information, subject to federal and State law, for health regulatory and public health functions;
   2. (2) The sharing or disclosing of information that is required to be exchanged under Health-General Article, Title 21, Subtitle 2A, Annotated Code of Maryland; or
   3. (3) The sharing or disclosing of information that is required to be exchanged under federal law, including for the purposes of payment, as defined in 45 CFR § 164.501.

Authority: Health-General Article, §§4-301, 4-302.2, 4-302.3, 4-302.5, 4-304, 19-103, 19-109(a)(1) and (8), 19-133, 19-143, and 19-145,
Annotated Code of Maryland

Effective date: March 17, 2014 (41:5 Md. R. 344)

Regulation .01 amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440)

Regulation .01A,B amended effective June 20, 2016 (43:12 Md. R. 666)

Regulation .01B amended effective August 13, 2018 (45:16 Md. R. 775)

Regulation .01B, E amended effective April 14, 2025 (52:7 Md. R. 322)

Regulation .01F adopted effective April 14, 2025 (52:7 Md. R. 322)

Regulation .02B amended effective June 20, 2016 (43:12 Md. R. 666); June 19, 2017 (44:12 Md. R. 588); August 13, 2018 (45:16 Md. R. 775); April 14, 2025 (52:7 Md. R. 322)

Regulation .02B amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440)

Regulation .03 amended effective June 20, 2016 (43:12 Md. R. 666); June 19, 2017 (44:12 Md. R. 588); April 14, 2025 (52:7 Md. R. 322)

Regulation .03B, G amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440)

Regulation .03D amended effective August 13, 2018 (45:16 Md. R. 775)

Regulation .04 amended effective August 13, 2018 (45:16 Md. R. 775); April 14, 2025 (52:7 Md. R. 322)

Regulation .04 amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440)

Regulation .05 amended effective June 20, 2016 (43:12 Md. R. 666)

Regulation .06 amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440)

Regulation .06A, F amended effective June 20, 2016 (43:12 Md. R. 666)

Regulation .07 amended effective June 20, 2016 (43:12 Md. R. 666)

Regulation .07C amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440)

Regulation .08 amended effective June 19, 2017 (44:12 Md. R. 588)

Regulation .08C amended effective June 20, 2016 (43:12 Md. R. 666); April 14, 2025 (52:7 Md. R. 322)

Regulation .09 amended effective June 20, 2016 (43:12 Md. R. 666)

Regulation .09 amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440)

Regulation .09G adopted effective June 19, 2017 (44:12 Md. R. 588)

Regulation .10 adopted effective June 20, 2016 (43:12 Md. R. 666)

Regulation .10 amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440)

Regulation .10A, B amended effective August 13, 2018 (45:16 Md. R. 775)

Regulation .10B amended effective April 14, 2025 (52:7 Md. R. 322)

Regulation .11 adopted effective June 20, 2016 (43:12 Md. R. 666)

Regulation .11B amended effective August 13, 2018 (45:16 Md. R. 775)

Regulation .11B amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440)

Regulation .12 adopted effective June 19, 2017 (44:12 Md. R. 588)

Regulation .12A amended effective August 13, 2018 (45:16 Md. R. 775)

Regulation .13 adopted effective April 14, 2025 (52:7 Md. R. 322)

Regulation .14 adopted effective April 14, 2025 (52:7 Md. R. 322)