Bill number does not exist. Enter a vaild keyword.
Facebook Twitter Youtube Channels MY MGA

Statutes Text

Article - Health - General




§4–302.2.

    (a)    The Maryland Health Care Commission shall adopt regulations for the privacy and security of protected health information obtained or released through a health information exchange.

    (b)    (1)    The regulations adopted under subsection (a) of this section shall:

            (i)    Govern the access, use, maintenance, disclosure, and redisclosure of protected health information as required by State or federal law, including the federal Health Insurance Portability and Accountability Act, the federal Health Information Technology for Economic and Clinical Health Act, the federal 21st Century Cures Act, and Title 21, Subtitle 2A of this article;

            (ii)    Include protections for the secondary use of protected health information obtained or released through a health information exchange;

            (iii)    Require the State–designated health information exchange to develop and maintain a consent management application, subject to State and federal law, that:

                1.    Allows a person in interest to opt out of having electronic health information shared or disclosed by a health information exchange;

                2.    Informs the person in interest of the electronic health information that may be shared or disclosed notwithstanding the choice to opt out;

                3.    Requires that the State–designated health information exchange provide a health information exchange with the opt–out status of a person in interest, on receipt of an electronic request from the health information exchange for the opt–out status of the person in interest;

                4.    Requires a health information exchange to obtain the opt–out status of a person in interest from the State–designated health information exchange before sharing or disclosing the electronic health information of the person in interest; and

                5.    Except as provided in paragraph (2) of this subsection, prohibits a health information exchange from sharing or disclosing the electronic health information of a person in interest if the person in interest has opted out of having electronic health information shared or disclosed by a health information exchange; and

            (iv)    Provide appropriate penalties for noncompliance with the regulations, including fines that do not exceed $10,000 per day and that are determined based on:

                1.    The extent of actual or potential public harm caused by the violation;

                2.    The cost of investigating the violation; and

                3.    Whether the person committed previous violations.

        (2)    The regulations adopted under subsection (a) of this section shall, subject to State and federal law, allow the Department, the Maryland Health Care Commission, and the Health Services Cost Review Commission to use electronic health information for planning activities and public health functions.

    (c)    Data obtained or released through a health information exchange:

        (1)    May not be sold for financial remuneration until the regulations required under subsections (a) and (b) of this section are adopted; and

        (2)    May be sold for financial remuneration only in accordance with the regulations adopted under subsections (a) and (b) of this section.

    (d)    The Maryland Health Care Commission shall consult with health care providers, payors, State health agencies, consumer advocates, and employers before adopting regulations under subsections (a) and (b) of this section.



Click to return on the top page