Health record rights in Maryland: what state law adds
In Maryland, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a free copy of your record in some cases; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue over misuse of your records; breach notices must cover medical and health insurance information; and one of the three rules we look for on AI in care is in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Yes. You can sue over unlawful collection, use or sharing of medical records or health data in general. Same answer in 11 of the 50 states, counting this one.
Are there rules for AI used in your care?One of the three rules is in force. A licensed clinician decides, not AI alone. Same answer in 12 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
MODPA bars collecting or sharing sensitive data, including consumer health data, unless strictly necessary for a requested product, and bans its sale. Scored 2 as a gate at least as strict as opt-in. No dedicated health data law found.
Maryland Online Data Privacy Act: controller duties (sensitive data). Md. Code, Commercial Law § 14-4707(a)(1)-(2); Ch. 454 of 2024, as amended by Ch. 874 of 2026
In force · effective · read October 3, 2026 · source(mgaleg.maryland.gov)
A controller may not: (1) Except where the collection or processing is strictly necessary to provide or maintain a specific product or service requested by the consumer to whom the personal data pertains, collect, process, or share sensitive data concerning a consumer; (2) Sell sensitive data;
Who it binds, in our words: Controlled or processed the personal data of at least 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction (§ 14-4702(1)); or at least 10,000 consumers and more than 20% of gross revenue from sale of personal data (§ 14-4702(2)).
Maryland Online Data Privacy Act: applicability. Md. Code, Commercial Law § 14-4702; Ch. 454 of 2024
In force · effective · read October 3, 2026 · source(mgaleg.maryland.gov)
at least 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (2) Controlled or processed the personal data of at least 10,000 consumers and derived more than 20% of its gross revenue from the sale of personal data.
Who it binds, in our words: A person that conducts business in the State or provides products or services that are targeted to residents of the State and meets either threshold.
Genetic Information Privacy Act: consents required of direct-to-consumer genetic testing companies. Md. Code, Commercial Law § 14-4404; Ch. 501 of 2022
In force · effective · read October 3, 2026 · source(mgaleg.maryland.gov)
A direct–to–consumer genetic testing company, at a minimum, shall obtain the following consents from a consumer before collecting, using, or disclosing the consumer’s genetic data:
Who it binds, in our words: Direct-to-consumer genetic testing companies only.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Free copy for Social Security disability claims or appeals beyond HIPAA and 45 CFR 171. Deadline is 21 working days (HG 4-309(a)), not counted as shorter than 30 days. Per-page caps recorded as facts only.
Free copy: Copies requested by the patient, the patient's personal representative, a nonprofit legal services representative, or an attorney representing the patient, to be used to file a claim or appeal a denial of Social Security disability income or Social Security benefits under Title II or Title XVI (HG § 4-304(c)(5)).
Fee rule: HG § 4-304(c)(2)(ii): "a reasonable cost–based fee for providing the information requested"
Fee rule: HG § 4-304(c)(3)(i): "a fee for copying and mailing not exceeding 76 cents for each page of the medical record"
Fee rule: HG § 4-304(c)(3)(ii)1: "a preparation fee not to exceed $22.88 for medical record retrieval and preparation", subject to 45 C.F.R. 164.524 fee limits for persons in interest
Fee rule: HG § 4-304(c)(3)(iii)2 (electronic copies): "A per–page fee of 75% of the per–page fee charged by a health care provider under subparagraph (i) of this paragraph that may not exceed $80"
Fee rule: HG § 4-304(c)(7) (Medical Assistance enrollees): "a fee that exceeds $20, adjusted annually for inflation in accordance with the Consumer Price Index, for each 100 pages or portion of 100 pages copied" is barred
Fee rule: HG § 4-304(c)(4): per-page fees may be adjusted annually for inflation; preparation fees may not
Goes beyond the federal floor: yes.
Copies of medical records: fees; free copy for Social Security disability claims. Md. Code, Health-General § 4-304(c)(5); Ch. 837 and Ch. 838 of 2024
In force · effective · read October 3, 2026 · source(mgaleg.maryland.gov)
A health care provider or a representative of the health care provider may not charge a fee for providing copies of a medical record: (i) Requested by: 1. The patient; 2. The patient’s personal representative;
Who it binds, in our words: Health care providers; free copy applies only to copies that will be used for a Social Security disability or benefits claim or appeal.
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
COMAR 10.25.18.03 gives an opt-out from HIE access. Sensitive data needs consent where federal or State law requires it (Part 2, HG 4-302.5). CRISP is named State-Designated HIE on an MHCC page. Dates from the COMAR chapter history.
Set by a regulation.
Designated exchange: CRISP (Chesapeake Regional Information System for our Patients).
Some sensitive records need your consent even where routine records do not.
HIE privacy and security: health care consumer right to opt out. COMAR 10.25.18.03
In force · effective · read October 3, 2026 · source(regs.maryland.gov)
A health care consumer has the right to opt out of an HIE at any time and refuse access to the patient's PHI through an HIE, except when a disclosure is limited to:
Who it binds, in our words: Health information exchanges operating in Maryland and their participating organizations.
HIE: access, use, or disclosure of sensitive health information. COMAR 10.25.18.04A(2)
In force · effective · read October 3, 2026 · source(regs.maryland.gov)
If federal or State law requires written consent or authorization for access, use, or disclosure of sensitive health information, a person shall obtain consent or authorization consistent with the applicable law prior to the access, use, or disclosure of sensitive health information to and through an HIE
Who it binds, in our words: Sensitive health information, including records under 42 CFR Part 2 and HG § 4-302.5.
HIE disclosure of abortion care and sensitive health services data. Md. Code, Health-General § 4-302.5(b); Ch. 248 of 2023
In force · effective · read October 3, 2026 · source(mgaleg.maryland.gov)
a health information exchange or electronic health network may not disclose Mifepristone data or the diagnosis, procedure, medication, or related codes for abortion care and other sensitive health services as determined by the Secretary under subsection (d) of this section to a treating provider,
Who it binds, in our words: Health information exchanges and electronic health networks.
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
HG 4-302.5 limits HIE and network disclosure of abortion care and sensitive health services codes and Mifepristone data. Disclosure allowed for claims, or to a named treating provider with the patient's written request and consent.
HIE and electronic health network disclosure of abortion care and sensitive health services data. Md. Code, Health-General § 4-302.5(b); Ch. 248 of 2023
In force · effective · read October 3, 2026 · source(mgaleg.maryland.gov)
a health information exchange or electronic health network may not disclose Mifepristone data or the diagnosis, procedure, medication, or related codes for abortion care and other sensitive health services as determined by the Secretary under subsection (d) of this section to a treating provider,
Who it binds, in our words: Health information exchanges and electronic health networks; exceptions for claims adjudication and for a specific treating provider at the patient's written request and consent.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
HG 4-307 adds rules for mental health records on top of the general medical records act. Unauthorized disclosure is limited to the relevant part of the record. Date from MGA Statutes Affected (2018 Ch. 682).
Disclosure of mental health records. Md. Code, Health-General § 4-307(c); last amended by Ch. 682 of 2018
In force · effective · read October 3, 2026 · source(mgaleg.maryland.gov)
When a medical record developed in connection with the provision of mental health services is disclosed without the authorization of a person in interest, only the information in the record relevant to the purpose for which disclosure is sought may be released.
Who it binds, in our words: Medical records developed in connection with the provision of mental health services.
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
HG 18-201.1(d) makes provider HIV and AIDS reports confidential and bars their use as evidence in legal actions. HG 18-337 separately governs partner notification by a physician.
HIV and AIDS case reports: confidentiality. Md. Code, Health-General § 18-201.1(d); Ch. 752 of 2024
In force · effective · read October 3, 2026 · source(mgaleg.maryland.gov)
The reports and any proceedings, records, or files relating to the reports required under this section are not discoverable and are not admissible in evidence in any criminal, civil, or administrative action.
Who it binds, in our words: Health care provider reports of HIV infection or AIDS to the health officer and the Secretary.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
CL 14-4404 requires express consent before a direct-to-consumer genetic testing company transfers or discloses genetic data to third parties, uses it beyond the primary purpose, or keeps a sample.
Genetic Information Privacy Act: required consents. Md. Code, Commercial Law § 14-4404; Ch. 501 of 2022
In force · effective · read October 3, 2026 · source(mgaleg.maryland.gov)
A direct–to–consumer genetic testing company, at a minimum, shall obtain the following consents from a consumer before collecting, using, or disclosing the consumer’s genetic data:
Who it binds, in our words: Direct-to-consumer genetic testing companies.
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Yes. You can sue over unlawful collection, use or sharing of medical records or health data in general.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
HG 4-309(f) makes anyone who knowingly violates the medical records subtitle, including unlawful disclosure, liable for actual damages. Date is Ch. 270 of 2000, which reenacted (f) unchanged; no later amendment found.
Damages a court may award: None stated. Actual damages only (HG § 4-309(a) and (f)).
Confidentiality of Medical Records Act: liability for violations. Md. Code, Health-General § 4-309(f); reenacted without amendment by Ch. 270 of 2000
In force · effective · read October 3, 2026 · source(mgaleg.maryland.gov)
A health care provider or any other person who knowingly violates any provision of this subtitle is liable for actual damages.
Who it binds, in our words: Health care providers and any other person, for knowing violations of HG Title 4, Subtitle 3 (disclosure of medical records).
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Personal information includes health information and health insurance policy or subscriber numbers. Notice within 45 days; Attorney General notice before individual notice. HIPAA-compliant businesses are deemed compliant.
Deadline to tell people: As soon as reasonably practicable, but not later than 45 days after the business discovers or is notified of the breach (CL § 14-3504(b)(3))..
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Maryland Personal Information Protection Act: definition of personal information. Md. Code, Commercial Law § 14-3501(e)(1)(i)4-5; Ch. 502 of 2022
In force · effective · read October 3, 2026 · source(mgaleg.maryland.gov)
4. Health information, including information about an individual’s mental health; 5. A health insurance policy or certificate number or health insurance subscriber identification number, in combination with a unique identifier used by an insurer or an employer that is self–insured, that permits access to an individual’s health information;
Who it binds, in our words: Businesses that own, license, or maintain computerized personal information of Maryland residents.
Breach notice to individuals and the Attorney General. Md. Code, Commercial Law § 14-3504(b)(3), (h)(1); Ch. 502 of 2022
In force · effective · read October 3, 2026 · source(mgaleg.maryland.gov)
Prior to giving the notification required under subsection (b) of this section and subject to subsection (d) of this section, a business shall provide notice of a breach of the security of a system to the Office of the Attorney General.
Who it binds, in our words: Owners or licensees of computerized data that includes personal information of Maryland residents.
Deemed compliance for HIPAA-covered businesses. Md. Code, Commercial Law § 14-3507(d); Ch. 518 of 2017
In force · effective · read October 3, 2026 · source(mgaleg.maryland.gov)
A business that is subject to and in compliance with the federal Health Insurance Portability and Accountability Act of 1996 shall be deemed to be in compliance with this subtitle.
Who it binds, in our words: HIPAA-covered businesses and their affiliates.
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
One of the three rules is in force. A licensed clinician decides, not AI alone.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Ins. 15-10B-05.1 says AI may not replace the provider's role and may not deny, delay or modify care. No AI disclosure-to-patient or human-review rule found. HB 995 of 2026 was withdrawn.
You must be told when AI is used in your care: not found.
A licensed clinician decides, not AI alone: in force.
You can reach a human, or have a human review the decision: not found.
Related limit on AI (recorded, not counted in the answer): Insurance § 15-10B-05.1(d): "An artificial intelligence, algorithm, or other software tool may not deny, delay, or modify health care services."
Utilization review: use of artificial intelligence. Md. Code, Insurance § 15-10B-05.1(c)(4); Ch. 747 of 2025
In force · effective · read October 3, 2026 · source(mgaleg.maryland.gov)
(4) an artificial intelligence, algorithm, or other software tool does not replace the role of a health care provider in the determination process under § 15–10B–07 of this subtitle;
Who it binds, in our words: Carriers, and pharmacy benefits managers or private review agents, that use an artificial intelligence, algorithm, or other software tool for utilization review.
Quarterly carrier report on adverse decisions, including AI use. Md. Code, Insurance § 15-10A-06(a); phrase added by Ch. 747 of 2025
In force · effective · read October 3, 2026 · source(mgaleg.maryland.gov)
AND WHETHER AN ARTIFICIAL INTELLIGENCE, ALGORITHM, OR OTHER SOFTWARE TOOL WAS USED IN MAKING THE ADVERSE DECISION;
Who it binds, in our words: Carriers, reporting quarterly to the Insurance Commissioner. Earns no element: the report goes to the regulator, not the person.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
7.2%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
95.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
90.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
6.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$98,461 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
4.2%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
8.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
19.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
11.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
