1. A. An HIE shall immediately suspend a person's access to the HIE when it is necessary to avoid serious harm to the privacy or security of health information accessed, used, or disclosed through or from the HIE.

   1. (1) An HIE may, in its sole discretion, suspend a person's access to the HIE pursuant to this section before an investigation under Regulation .07B of this chapter is completed. In addition, if the HIE determines that serious harm to the privacy or security of health information or an ongoing risk of improper use, access, maintenance, or disclosure of PHI may occur prior to conclusion of an investigation, it shall suspend a person’s access to the HIE pursuant to this section before an investigation is complete.
   2. (2) Such suspension shall continue until the underlying threat to the privacy or security of health information is contained.

2. B. An HIE shall conduct an investigation if there is reason to believe that a breach or non-HIPAA violation has occurred.

   1. (1) The HIE shall begin the investigation upon learning of the allegations giving rise to a potential breach or violation.
   2. (2) The HIE shall conduct the investigation in a thorough, timely, professional manner and take all necessary actions to gather information concerning the potential breach or violation that reflects the size and scope of such potential breach or violation.
   3. (3) If appropriate, an investigation shall include an audit under Regulation .06 of this chapter.

   4. (4) Upon the completion of an investigation, which shall not exceed 14 business days, an HIE shall:

      1. (a) Make a written finding describing the results of an investigation and provide a copy to the Commission; and
      2. (b) Maintain records of each investigation (audits, complaints, breaches, non-HIPAA violations) for at least 5 years from the date of completion of such investigation or 5 years from the date a minor patient becomes an adult, whichever is longer.

3. C. If an HIE has a reasonable belief that a breach or non-HIPAA violation has occurred, either as a result of an investigation or otherwise, the HIE shall:

   1. (1) For a breach, follow Regulation .08 of this chapter and federal breach notification requirements and timelines;

   2. (2) For non-HIPAA violations, submit a corrective action plan to the Commission within 10 business days of conclusion of its investigation, which shall include:

      1. (a) Any remedial action necessary to address the breach or violation as soon as practicable;
      2. (b) Any steps necessary to correct the underlying problem, such as a change in processes or procedures, new technology, and training; and
      3. (c) An appropriate and reasonable time frame for implementing the remedial action;

   3. (3) Within a reasonable time frame, but in no event more than 10 business days following the investigation, provide the following to the Commission, and to the participating organizations:

      1. (a) A copy of the findings of the investigation, excluding any PHI or sensitive health information;
      2. (b) Each remedial action to be taken by each person and the associated time frame of the remedial action;
      3. (c) Any action necessary to mitigate the harm that may be caused by the breach or the non-HIPAA violation;
      4. (d) The identity of the person that is responsible for carrying out each action to mitigate harm; and
      5. (e) Any future action that the HIE may take, including suspension of access or progressive discipline, if a person does not comply with the remedial action;

   4. (4) Immediately suspend access of a person when one of the following occurs:

      1. (a) Available information demonstrates a significant breach by the person;
      2. (b) Available information demonstrates a significant non-HIPAA violation by the person;
      3. (c) Available information demonstrates a violation of State or federal law relevant to privacy or security by the person;
      4. (d) The person has sold health information accessed through the HIE in violation of these regulations;
      5. (e) The person has failed to carry out the remedial actions identified by the HIE; or
      6. (f) The Commission issues a request for suspension of the person as provided in Regulation .09 of this chapter; and
   5. (5) Notify the health care consumer pursuant to Regulation .08 of this chapter, if such notification is required under applicable law, including HIPAA, or if so directed by the Commission.

4. D. After verifying that each remedial action is complete, an HIE may reinstate a person's authorization to access information through the HIE provided that:

   1. (1) The Commission has not revoked the person's access to the HIE as provided in Regulation .09 of this chapter; and
   2. (2) The HIE modifies the person's access as needed to ensure compliance with this chapter.

5. E. A person may file a written notice or request with the Commission that the Commission review an HIEs action under Regulation .07 of this chapter when the person has reason to believe that the HIE has acted inappropriately.

   1. (1) A request for review shall be filed within 30 days after the person knew or had reason to know of the HIEs action in question;
   2. (2) The request for review shall set forth each reason why the person believes that the HIE's action is inappropriate.
   3. (3) The Commission may determine that no investigation is necessary or may take action under Regulation .09C.

6. F. An HIE shall provide notice of each suspension and each reinstatement of a person's authorization to access information through an HIE in the following manner:

   1. (1) The HIE shall send an electronic notice to the person who is the subject of the action within 24 hours of the suspension or the reinstatement and to the Commission on a monthly basis.

   2. (2) The notice shall include:

      1. (a) The name of the person who is the subject of the action;
      2. (b) The name of any affected participating organization;
      3. (c) The basis for the suspension or reinstatement; and
      4. (d) The effective date of the suspension or reinstatement.
   3. (3) The notice shall not include PHI.
   4. (4) The notice shall not be considered confidential.

Authority: Health-General Article, §§4-301, 4-302.2, 4-302.3, 4-302.5, 4-304, 19-103, 19-109(a)(1) and (8), 19-133, 19-143, and 19-145,
Annotated Code of Maryland

Effective date: March 17, 2014 (41:5 Md. R. 344)

Regulation .01 amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440)

Regulation .01A,B amended effective June 20, 2016 (43:12 Md. R. 666)

Regulation .01B amended effective August 13, 2018 (45:16 Md. R. 775)

Regulation .01B, E amended effective April 14, 2025 (52:7 Md. R. 322)

Regulation .01F adopted effective April 14, 2025 (52:7 Md. R. 322)

Regulation .02B amended effective June 20, 2016 (43:12 Md. R. 666); June 19, 2017 (44:12 Md. R. 588); August 13, 2018 (45:16 Md. R. 775); April 14, 2025 (52:7 Md. R. 322)

Regulation .02B amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440)

Regulation .03 amended effective June 20, 2016 (43:12 Md. R. 666); June 19, 2017 (44:12 Md. R. 588); April 14, 2025 (52:7 Md. R. 322)

Regulation .03B, G amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440)

Regulation .03D amended effective August 13, 2018 (45:16 Md. R. 775)

Regulation .04 amended effective August 13, 2018 (45:16 Md. R. 775); April 14, 2025 (52:7 Md. R. 322)

Regulation .04 amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440)

Regulation .05 amended effective June 20, 2016 (43:12 Md. R. 666)

Regulation .06 amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440)

Regulation .06A, F amended effective June 20, 2016 (43:12 Md. R. 666)

Regulation .07 amended effective June 20, 2016 (43:12 Md. R. 666)

Regulation .07C amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440)

Regulation .08 amended effective June 19, 2017 (44:12 Md. R. 588)

Regulation .08C amended effective June 20, 2016 (43:12 Md. R. 666); April 14, 2025 (52:7 Md. R. 322)

Regulation .09 amended effective June 20, 2016 (43:12 Md. R. 666)

Regulation .09 amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440)

Regulation .09G adopted effective June 19, 2017 (44:12 Md. R. 588)

Regulation .10 adopted effective June 20, 2016 (43:12 Md. R. 666)

Regulation .10 amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440)

Regulation .10A, B amended effective August 13, 2018 (45:16 Md. R. 775)

Regulation .10B amended effective April 14, 2025 (52:7 Md. R. 322)

Regulation .11 adopted effective June 20, 2016 (43:12 Md. R. 666)

Regulation .11B amended effective August 13, 2018 (45:16 Md. R. 775)

Regulation .11B amended as an emergency provision effective January 9, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440)

Regulation .12 adopted effective June 19, 2017 (44:12 Md. R. 588)

Regulation .12A amended effective August 13, 2018 (45:16 Md. R. 775)

Regulation .13 adopted effective April 14, 2025 (52:7 Md. R. 322)

Regulation .14 adopted effective April 14, 2025 (52:7 Md. R. 322)