Section 4-309 - Refusal to disclose records; violations of subtitle; penalties. - Maryland Statutes

§ 4-309. Refusal to disclose records; violations of subtitle; penalties.
 

(a)  Refusal to disclose records.- If a health care provider knowingly refuses to disclose a medical record within a reasonable time but no more than 21 working days after the date a person in interest requests the disclosure, the health care provider is liable for actual damages. 

(b)  Refusal to disclose because payment is owed.- A health care provider may not refuse to disclose a medical record on the request of a person in interest because of the failure of the person in interest to pay for health care rendered by the health care provider. 

(c)  Violations of subtitle.- A health care provider or any other person is in violation of this subtitle if the health care provider or any other person: 

(1) Requests or obtains a medical record under false pretenses or through deception; or 

(2) Discloses a medical record in violation of this subtitle. 

(d)  Criminal penalties.- Except as otherwise provided in subsection (e) of this section, a health care provider or any other person, including an officer or employee of a governmental unit, who knowingly and willfully violates any provision of this subtitle is guilty of a misdemeanor and on conviction is subject to a fine not exceeding $1,000 for the first offense and not exceeding $5,000 for each subsequent conviction for a violation of any provision of this subtitle. 

(e)  Fraudulent obtaining of records; wrongful disclosure of records.-  

(1) A health care provider or any other person, including an officer or employee of a governmental unit, who knowingly and willfully requests or obtains a medical record under false pretenses or through deception or knowingly and willfully discloses a medical record in violation of this subtitle is guilty of a misdemeanor and on conviction is subject to the following penalties: 

(i) A fine not exceeding $50,000, imprisonment for not more than 1 year, or both; 

(ii) If the offense is committed under false pretenses, a fine not exceeding $100,000, imprisonment for not more than 5 years, or both; and 

(iii) If the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, a fine not exceeding $250,000, imprisonment for not more than 10 years, or both. 

(2) This subsection does not apply to an officer or employee of a governmental unit that is conducting a criminal investigation. 

(f)  Civil penalties.- A health care provider or any other person who knowingly violates any provision of this subtitle is liable for actual damages. 
 

[1990, ch. 480, § 2; 1994, ch. 585; 1997, ch. 580.]