Individual notice deadline
Not later than 45 days after the business discovers or is notified of the breach, subject to the specified law-enforcement delay and time reasonably necessary to determine the scope of the breach and restore reasonable integrity to the data system.
The statute sets a 45-day outer bound. It is shown for context: a HIPAA covered entity is outside this section, so HIPAA's own 60-day individual-notice window is the operative deadline.
State regulator notice
Satisfied by HIPAA compliance
Prior to giving notification to individuals, the business must provide notice to the Office of the Maryland Attorney General. The notice must include the number of affected individuals, a description of the breach, remedial steps taken, and a sample copy of the individual notice.
Substitute compliance depends on actually meeting the federal obligation. A practice outside HIPAA, or one that has not met its federal notice duty, falls back on the requirement below as written. Stated trigger: All breaches (no numeric threshold) — AG notice is required prior to individual notification.
Source: Md. Code, Com. Law § 14-3504(b)(3)
Statewide rules that also reach therapy practices
Minor may consent
A minor has the same capacity as an adult to consent to medical or dental treatment if the minor is married, is the parent of a child, or is living separate and apart from the minor's parent, parents or guardian — whether or not with their consent — and is self-supporting regardless of the source of the minor's income.
What this means operationally
This is the one Maryland route that reaches dentistry on its face: subsection (a) says medical OR dental, where the emergency route in subsection (b) says medical treatment and turns on an attending physician's judgment. A dental practice in Maryland is therefore working from status, not from urgency. The statute also settles two questions intake often gets wrong — living apart counts whether or not the parents agreed to it, and self-supporting does not depend on where the income comes from.
Applies when
- The minor is married, is the parent of a child, or is living separate and apart from a parent or guardian and self-supporting
Limit on liability
A health care practitioner who treats a minor under § 20-102 does not incur civil or criminal liability, or liability for professional discipline, solely because the minor did not in fact have the capacity to consent under that section.
What this means operationally
This is what makes the Maryland scheme workable in a waiting room. Most of the routes in § 20-102 turn on facts a practice cannot verify — whether the minor is married, self-supporting, or living apart. The section removes the risk of getting that call wrong on its own, which means the operational question is whether the capacity determination was made and recorded, not whether it was ultimately correct.
Applies when
- The practitioner treated the minor under § 20-102
Exceptions
- The protection is against liability arising SOLELY from the absent capacity; it is not a general immunity for the care delivered
Parental right of access
For a minor who has the right to consent and has consented to treatment under Title 20, Subtitle 1, the minor is the person in interest for the resulting medical record. Where that does not apply, the person in interest is a parent whose authority has not been specifically limited by court order, or a person authorized to consent on the minor's behalf. A parent, guardian, custodian or court-designated representative may also be a person in interest in the discretion of the attending physician.
What this means operationally
This is the hinge between Maryland's consent rules and its records rules, and it is the reason the consent route has to be recorded rather than merely acted on. The Confidentiality of Medical Records Act grants access to the person in interest and does not otherwise mention minors — so the entire question of who may see a Maryland minor's record is decided by which consent route the episode ran under. It is also what the HIPAA personal-representative analysis under 45 CFR 164.502(g)(3) resolves against, since that rule defers to state law on whether a parent is the personal representative.
Applies when
- A request is made for a minor's medical record
Exceptions
- A parent's authority may be specifically limited by court order
- The attending physician's discretion can make a parent or guardian a person in interest
Minor may consent
A relative providing informal kinship care may consent to health care for the child where no court has appointed a guardian and the relative has filed a sworn affidavit with the Department of Human Services establishing the kinship care relationship. A copy of the affidavit goes to the child's health care provider, the affidavit must be refiled annually, and it does not extinguish the parent's or guardian's own right to consent.
What this means operationally
The provision a Maryland front desk is most likely to meet without recognizing it. The consenting adult is neither a parent nor a court-appointed guardian, and their authority rests on a document the practice is supposed to be holding a copy of. Two features have direct operational consequences: the affidavit expires unless refiled annually, so a copy on file is not evidence of current authority, and the parent's consent right survives, so this creates a second authorized adult rather than replacing the first.
Applies when
- A relative within five degrees is providing care because of a serious family hardship
- No court has appointed a guardian
- The relative has filed the sworn affidavit
Exceptions
- The arrangement excludes cases involving the local department of social services
- The affidavit must be refiled annually while the arrangement continues
Destruction or disposition requirement
Except for a minor patient, UNLESS A PATIENT IS NOTIFIED, a health care provider MAY NOT DESTROY a medical record or laboratory or X-ray report about a patient FOR 7 YEARS AFTER THE RECORD OR REPORT IS MADE. In the case of a MINOR patient, a medical record or laboratory or X-ray report MAY NOT BE DESTROYED UNTIL THE PATIENT ATTAINS THE AGE OF MAJORITY PLUS 7 YEARS, unless the parent or guardian of the minor patient is notified, or, if the medical care documented in the record was provided under § 20-102(c) or § 20-103(c) of this article, the minor patient is notified.
What this means operationally
Maryland does not state a retention duty at all — it states a DESTRUCTION PROHIBITION with a notice escape, and the difference is operational. A practice that gives the statutory notice may destroy INSIDE the seven years, which no ordinary retention floor permits. Two further points separate this from its neighbors. The clock runs from WHEN THE RECORD OR REPORT IS MADE, per document, not from last treatment, so one patient's file contains items ageing out on different dates. And for minors the escape routes to a different person depending on WHO CONSENTED: care given under § 20-102(c) or § 20-103(c) — the provisions a minor may consent to alone — requires notice to the MINOR rather than the parent, which means the consent question decides the destruction-notice question years later.
Applies when
- A health care provider proposes to destroy a medical record, laboratory report or X-ray report
Exceptions
- Destruction inside the period is permitted where the statutory notice under § 4-403(d) is given
- For minors, notice goes to the minor rather than the parent where the care was provided under § 20-102(c) or § 20-103(c)
Deadline to respond to an access request
Except as otherwise provided in this subtitle, a health care provider SHALL COMPLY WITHIN A REASONABLE TIME after a PERSON IN INTEREST REQUESTS IN WRITING to receive a copy of a medical record, or to see and copy the medical record.
What this means operationally
Maryland states no day count at all — the standard is A REASONABLE TIME, which is unusual among the states in this corpus and means the practice cannot point to a safe-harbour number. In practice the federal thirty-day rule under 45 C.F.R. § 164.524 is the operative outer bound for most requests, and the state fee provision expressly cross-references those federal limitations, so a practice should not read the vagueness here as latitude. Note the request must be IN WRITING and from a person in interest, a defined term broader than the patient.
Applies when
- A person in interest requests in writing to receive a copy of, or to see and copy, a medical record
Exceptions
- Subject to the psychiatric and psychological harm exception in § 4-304(a)(2)
Limit on copy fees, format or delivery
A health care provider may require a person in interest or other authorized person requesting a copy of a medical record to pay a REASONABLE COST-BASED FEE. For a copy requested by a person in interest or other authorized person, a provider MAY CHARGE A FEE FOR COPYING AND MAILING NOT EXCEEDING 76 CENTS PER PAGE. In addition, a provider may charge, SUBJECT TO THE FEE LIMITATIONS THAT APPLY UNDER 45 C.F.R. § 164.524 and HHS guidance on those limitations, A PREPARATION FEE NOT TO EXCEED $22.88 for medical record retrieval and preparation, and THE ACTUAL COST FOR POSTAGE AND HANDLING. Where the provider USES OR MAINTAINS the requested records IN AN ELECTRONIC FORMAT and an electronic copy is requested, the provider may charge a preparation fee not to exceed $22.88, A PER-PAGE FEE OF 75% OF THE PAPER PER-PAGE FEE THAT MAY NOT EXCEED $80 IN TOTAL, and actual postage and handling. For this subsection MEDICAL RECORD INCLUDES A COPY OF A MEDICAL BILL requested by an individual, and the subsection DOES NOT APPLY TO X-RAYS. The fees may be ADJUSTED ANNUALLY FOR INFLATION in accordance with the Consumer Price Index, EXCEPT the preparation fee, which may not be.
This changes on 2027-01-01
The per-page figures in this proposition — 76 cents for paper and the 75% derived electronic rate — move annually with CPI, so the numbers stated here are a point-in-time reading rather than a stable rule. The $22.88 preparation fee and the $80 electronic cap are not inflation-adjusted by this subsection. Any guidance quoting the per-page figure needs a date next to it.
What this means operationally
Two structural points matter more than the figures. Every charge is expressly SUBJECT TO the federal § 164.524 limits and HHS guidance, so where a request is a patient's own access request the federal cost-based ceiling governs and the state numbers are an upper bound that may not be reachable. And electronic delivery is capped in absolute terms at eighty dollars for the per-page component regardless of length, which makes it dramatically cheaper than paper for a large chart. The per-page figures move: they are CPI-adjusted annually, so any published guidance quoting seventy-six cents will drift, while the $22.88 preparation fee is fixed by statute and does not. Note billing records count as medical records here, and X-rays fall outside the subsection entirely.
Applies when
- A person in interest or other authorized person requests a copy of a medical record
Exceptions
- Does not apply to X-rays
- State facilities regulated by the Maryland Department of Health charge under Gen. Prov. Art. § 4-206 instead
- All charges are subject to the fee limitations under 45 C.F.R. § 164.524 and HHS guidance
Right to amend or correct the record
A health care provider SHALL ESTABLISH PROCEDURES for a person in interest to request AN ADDITION TO OR CORRECTION OF a medical record. A PERSON IN INTEREST MAY NOT HAVE ANY INFORMATION DELETED from a medical record. WITHIN A REASONABLE TIME after a request for a change, the provider SHALL EITHER MAKE THE REQUESTED CHANGE OR PROVIDE WRITTEN NOTICE OF A REFUSAL. A notice of refusal SHALL CONTAIN EACH REASON for the refusal AND THE PROCEDURES, IF ANY, that the provider has established for REVIEW of the refusal. If the final determination is a refusal, the provider SHALL PERMIT the person in interest TO INSERT A CONCISE STATEMENT OF THE REASON THEY DISAGREE with the record, and MAY insert a statement of the reasons for the refusal.
What this means operationally
This is a fuller amendment regime than most states and it starts before any request arrives: the provider must HAVE ESTABLISHED PROCEDURES, so the absence of a written amendment process is itself a breach. Deletion is expressly off the table — the most the patient can achieve is an addition, a correction, or a statement of disagreement sitting alongside the original. The refusal notice is doing real work: it must give EACH reason, not a reason, and must disclose any internal review route, which makes a one-line denial non-compliant. Where the practice has no review procedure it must say so rather than stay silent.
Applies when
- A person in interest requests an addition to or correction of a medical record
Exceptions
- No information may be deleted from a medical record at a person in interest’s request
Provider must disclose
A health care provider SHALL GIVE A NOTICE OF A CHANGE in a medical record, or A COPY OF A STATEMENT OF DISAGREEMENT, TO ANY INDIVIDUAL THE PERSON IN INTEREST HAS DESIGNATED to receive it, AND TO WHOM THE HEALTH CARE PROVIDER HAS DISCLOSED AN INACCURATE, AN INCOMPLETE, OR A DISPUTED MEDICAL RECORD WITHIN THE PREVIOUS 6 MONTHS. If a health care provider DISCLOSES A MEDICAL RECORD AFTER an addition, correction or statement of disagreement has been made, the provider SHALL INCLUDE WITH THE MEDICAL RECORD A COPY OF EACH addition, correction or statement of disagreement.
What this means operationally
The retroactive limb is the demanding one and it is genuinely unusual: the practice must go back over SIX MONTHS of disclosures of the disputed record and notify every recipient. That is only possible if disclosures are logged with recipient and date, so this provision quietly requires a disclosure register even though it does not say so. The forward limb is permanent rather than time-limited — once an addition, correction or statement of disagreement exists, every future release of that record must carry a copy of it, with no expiry. Practices that store amendments as separate correspondence rather than attaching them to the record will fail this on the first outbound request.
Applies when
- A change is made to a medical record, or a statement of disagreement is inserted after a refusal
Destruction or disposition requirement
The notice permitting destruction SHALL be made by FIRST-CLASS MAIL to the last known address of the patient, or by E-MAIL to the last known e-mail address of the patient (or, for a minor whose care was not provided under § 20-102(c) or § 20-103(c), of the parent or guardian). The notice shall INCLUDE THE DATE ON WHICH THE RECORD SHALL BE DESTROYED and A STATEMENT THAT THE RECORD OR SYNOPSIS OF THE RECORD, IF WANTED, MUST BE RETRIEVED AT A DESIGNATED LOCATION. If notice is given by e-mail and NO RESPONSE OR DELIVERY RECEIPT IS OBTAINED, the health care provider SHALL PROVIDE NOTICE BY FIRST-CLASS MAIL AT LEAST 10 DAYS BEFORE the date on which the record is to be destroyed. The provider SHALL MAKE THE RECORD OR REPORT AVAILABLE FOR RETRIEVAL by the patient or the parent or guardian of a minor patient WITHIN 60 DAYS BEFORE THE DATE OF DESTRUCTION, and at the location designated in the notice.
What this means operationally
The e-mail route is cheaper but conditional, and the condition is the part practices miss: no response AND no delivery receipt means the whole notice must be repeated by first-class mail, at least ten days out. A bounced or silently-delivered e-mail therefore buys nothing and costs a second mailing on a deadline. Two content elements are mandatory and specific — the actual destruction DATE and a named LOCATION where the record can be collected — so a generic records-retention notice does not qualify. The sixty-day retrieval window runs BACKWARDS from the destruction date, which means the notice has to go out early enough for the window to exist.
Applies when
- A health care provider gives notice in order to destroy a record inside the statutory period
Destruction or disposition requirement
After consulting the Maryland Hospital Association, the Maryland State Medical Society and other interested parties including consumers and payors, the SECRETARY SHALL ADOPT REGULATIONS GOVERNING THE DESTRUCTION OF MEDICAL RECORDS. The regulations SHALL specify the manner in which a health care provider shall MAINTAIN AND STORE medical records to ENSURE CONFIDENTIALITY and to PROVIDE LIMITED ACCESS to the medical records UNTIL THE RECORDS ARE DESTROYED, and shall ENSURE THAT THE METHOD OF DESTRUCTION RENDERS THE MEDICAL RECORDS UNREADABLE. The regulations MAY NOT REQUIRE OR ENCOURAGE THE DESTRUCTION of medical records.
What this means operationally
Two things worth holding. The storage standard is expressly tied to the whole pre-destruction life of the record — confidentiality and LIMITED ACCESS must hold until the moment of destruction, so an archived box or a decommissioned system still carries an access-control obligation. And the statute forbids the regulations from requiring or encouraging destruction, which is a deliberate signal that the seven-year mark is a permission, not a prompt: a practice reading its retention schedule as an instruction to destroy has the policy backwards.
Applies when
- A health care provider stores medical records pending destruction, or destroys them
Custody on closure or transfer
AFTER THE DEATH, RETIREMENT, SURRENDER OF THE LICENSE, OR DISCONTINUANCE OF THE PRACTICE OR BUSINESS of a health care provider, the health care provider, THE ADMINISTRATOR OF THE ESTATE, or A DESIGNEE WHO AGREES to provide for the maintenance of the medical records and WHO STATES, IN WRITING TO THE APPROPRIATE HEALTH OCCUPATION BOARD WITHIN A REASONABLE TIME, THAT THE RECORDS WILL BE MAINTAINED IN COMPLIANCE WITH THIS SECTION, shall FORWARD THE NOTICE required in this section BEFORE THE DESTRUCTION OR TRANSFER of medical records to the patient, or for a minor patient to the parent or guardian unless the care was provided under § 20-102(c) or § 20-103(c).
What this means operationally
The designee route has a formality most successions overlook: it is not enough to agree privately to take the records, the designee must STATE IN WRITING TO THE RELEVANT HEALTH OCCUPATION BOARD that they will maintain them in compliance. Without that filing there is no valid designee and the duty stays with the provider or the estate. Note also that the notice obligation is triggered by TRANSFER as well as destruction, so moving records to a successor practice is itself a notice event — patients must be told before their file changes hands, not after.
Applies when
- A health care provider dies, retires, surrenders their license, or discontinues the practice or business, and records are to be destroyed or transferred
