HIPAA Compliance in Maryland: PIPA & Healthcare Privacy

Maryland Personal Information Protection Act (PIPA) - Md. Code Ann., Com. § 14-3504

Maryland's comprehensive breach notification law requires:

• Notification "without unreasonable delay" (interpreted as 30 days maximum in Maryland)
• Attorney General must be notified for breaches affecting 100+ Maryland residents
• Affected individuals must be notified via US mail, email, or telephone
• Notification must describe the personal information involved
• Notification must include investigation findings and remediation measures
• Credit monitoring must be offered when financial or identity information is compromised
• Notification must describe security freeze and fraud alert rights
• Breach investigation must be thorough and well-documented

Maryland Medical Records Laws - Md. Code Ann., Health-Gen. § 4-301 et seq.

Maryland establishes comprehensive medical records management requirements:

• Healthcare providers must maintain complete and accurate medical records
• Records must be retained for minimum 6 years following last patient encounter
• Minors' records must be retained until age 21 or 6 years after last visit, whichever is longer
• Patients have right to inspect and receive copies of their records
• Copies must be provided within 30 calendar days of request
• Copying fees limited to reasonable costs of reproduction and administration
• Healthcare facilities must maintain access logs documenting all record reviews
• Security measures must prevent unauthorized access and disclosure

Maryland Patient Privacy Rights - Md. Code Ann., Health-Gen. § 4-302

Maryland law establishes specific patient privacy protections including:

• Right to request restrictions on disclosure of health information
• Special protections for mental health and psychotherapy records
• Genetic information receives heightened privacy protection
• HIV-related information has enhanced privacy status
• Right to receive accounting of all disclosures
• Right to request amendments to medical records with documentation
• Right to obtain records in electronic format when available
• Deceased patient records protected for 5 years post-death

Notification Timeline & Process

Maryland's PIPA requires prompt breach notification with strict timelines:

1. Immediately investigate breach upon discovery
2. Assess scope and identify affected Maryland residents
3. Notify affected individuals within 30 days of discovery
4. Simultaneously notify Maryland Attorney General (100+ residents)
5. Notification must be written via first-class mail or email (with prior consent)
6. If contact is impossible, publish notice in major newspapers
7. Document all notification efforts and maintain records
8. Preserve breach investigation file for 3 years minimum

Required Notification Content

• Date of breach and date of discovery
• Description of personal information involved in breach
• Description of breach investigation and findings
• Measures being taken to prevent future breaches
• Steps individuals should take to protect themselves
• Contact information for incident response team
• Information about offered credit monitoring services
• Details about security freeze and fraud alert rights

Medical Records Management & Patient Rights

• Implement 30-calendar-day response system for medical record requests
• Maintain comprehensive access logs for all medical record reviews
• Create separate access logs for mental health and genetic information
• Establish procedures for patient disclosure restrictions
• Track minors' records until age 21 for retention compliance
• Implement enhanced protections for HIV-related information
• Create procedures for medical record amendment requests
• Train staff on Maryland-specific privacy requirements

Breach Response and Investigation

• Develop incident response plan with 24-hour activation capability
• Create breach assessment process to identify 100+ resident threshold
• Establish Maryland Attorney General notification procedure
• Implement data flow mapping for breach source identification
• Create 30-day breach notification tracking system
• Maintain breach documentation for 3 years minimum
• Document all investigation findings and remediation steps
• Conduct annual breach response drills and training

• Audit current breach notification procedures against 30-day timeline
• Create Maryland Attorney General notification process (100+ residents)
• Implement 30-calendar-day response system for medical record requests
• Update medical records retention schedules for minors (until age 21 + 6 years)
• Create separate access logs for mental health and genetic information
• Develop breach assessment process to identify 100+ resident threshold
• Establish data flow mapping for breach identification
• Create Maryland-specific employee privacy training
• Document security measures and access control policies
• Conduct annual third-party security audit and breach documentation review