§ 4-309
391 words·~2 min read·
/md/health-general/4-309A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
§4–309.
(a)If a health care provider knowingly refuses to disclose a medical record within a reasonable time but no more than 21 working days after the date a person in interest requests the disclosure, the health care provider is liable for actual damages.
(b)A health care provider may not refuse to disclose a medical record on the request of a person in interest because of the failure of the person in interest to pay for health care rendered by the health care provider.
(c)A health care provider or any other person is in violation of this subtitle if the health care provider or any other person:
(1)Requests or obtains a medical record under false pretenses or through deception; or
(2)Discloses a medical record in violation of this subtitle.
(d)Except as otherwise provided in subsection
(e)of this section, a health care provider or any other person, including an officer or employee of a governmental unit, who knowingly and willfully violates any provision of this subtitle is guilty of a misdemeanor and on conviction is subject to a fine not exceeding $1,000 for the first offense and not exceeding $5,000 for each subsequent conviction for a violation of any provision of this subtitle.
(1)A health care provider or any other person, including an officer or employee of a governmental unit, who knowingly and willfully requests or obtains a medical record under false pretenses or through deception or knowingly and willfully discloses a medical record in violation of this subtitle is guilty of a misdemeanor and on conviction is subject to the following penalties:
(i)A fine not exceeding $50,000, imprisonment for not more than 1 year, or both;
(ii)If the offense is committed under false pretenses, a fine not exceeding $100,000, imprisonment for not more than 5 years, or both; and
(iii)If the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, a fine not exceeding $250,000, imprisonment for not more than 10 years, or both.
(2)This subsection does not apply to an officer or employee of a governmental unit that is conducting a criminal investigation.
(f)A health care provider or any other person who knowingly violates any provision of this subtitle is liable for actual damages.