Privacy Law Library

Maryland Confidentiality of Medical Records Act

MCMRA

Health

Maryland's medical records law requires health care providers to keep patient records confidential and disclose them only as the subtitle or other law allows, gives patients rights to see, copy, and seek corrections to their records, and criminalizes obtaining records under false pretenses. Recent amendments restrict health information exchanges and electronic health networks from sharing abortion, mifepristone, and other legally protected sensitive-service data, and require HIE opt-out consent management.

Where

Maryland

Citation

Md. Code, Health-Gen. §§ 4-301 to 4-310

Status

In force

Last amended

2025-07-01

Enforced by

State's Attorneys (criminal); Maryland Health Care Commission (HIE regulations); private civil actions for actual damages

People can sue

Yes

Penalties

Knowing and willful violations are misdemeanors (fines up to $1,000 first offense, $5,000 subsequent); obtaining records under false pretenses or wrongful disclosure carries up to $50,000 and 1 year, $100,000 and 5 years under false pretenses, or $250,000 and 10 years for commercial or malicious purposes (4-309(d)-(e)). Providers and others who knowingly violate the subtitle, or fail to produce records within 21 working days, are liable for actual damages (4-309(a), (f)). Unlawful HIE disclosure of abortion or sensitive-service data is a misdemeanor up to $10,000 per day (4-302.5(c)).

Applies to

• Health care providers and facilities in Maryland, and any other person who requests, obtains, or discloses medical records (4-302, 4-309)
• Health information exchanges and electronic health networks (4-302.2, 4-302.3, 4-302.5)
• Excludes facility administrative records not kept in the medical record, 42 CFR Part 2 substance-use records, and developmental disability records governed elsewhere (4-302(b))