Maryland Statutes
Subtitle 3 - Confidentiality of Medical Records
Section 4-303 - Disclosure Upon Authorization of a Person in Interest

(a)    A health care provider shall disclose a medical record on the authorization of a person in interest in accordance with this section.
    (b)    Except as otherwise provided in subsections (c) and (d) of this section, an authorization shall:
        (1)    Be in writing, dated, and signed by the person in interest;
        (2)    State the name of the health care provider;
        (3)    Identify to whom the information is to be disclosed;
        (4)    State the period of time that the authorization is valid, which may not exceed 1 year, except:
            (i)    In cases of criminal justice referrals, in which case the authorization shall be valid until 30 days following final disposition; or
            (ii)    In cases where the patient on whom the medical record is kept is a resident of a nursing home, in which case the authorization shall be valid until revoked, or for any time period specified in the authorization; and
        (5)    Apply only to a medical record developed by the health care provider unless in writing:
            (i)    The authorization specifies disclosure of a medical record that the health care provider has received from another provider; and
            (ii)    The other provider has not prohibited redisclosure.
    (c)    A health care provider shall disclose a medical record on receipt of a preauthorized form that is part of an application for insurance.
    (d)    A health care provider shall disclose a medical record on receipt of an authorization for the release of relevant medical information that is included with the claim application form filed with the Workers’ Compensation Commission in accordance with § 9–709(a), § 9–710(b), or § 9–711(a) of the Labor and Employment Article.
    (e)    (1)    Except in cases of criminal justice referrals, a person in interest may revoke an authorization in writing.
        (2)    A revocation of an authorization becomes effective on the date of receipt by the health care provider.
        (3)    A disclosure made before the effective date of a revocation is not affected by the revocation.
    (f)    A copy of the following shall be entered in the medical record of a patient or recipient:
        (1)    A written authorization;
        (2)    Any action taken in response to an authorization; and
        (3)    Any revocation of an authorization.