(a) This section may not be construed to impose an obligation on a health care provider to disclose a medical record.
(b) A health care provider may disclose a medical record without the authorization of a person in interest:
(1) (i) To the provider’s authorized employees, agents, medical staff, medical students, or consultants for the sole purpose of offering, providing, evaluating, or seeking payment for health care to patients or recipients by the provider;
(ii) To the provider’s legal counsel regarding only the information in the medical record that relates to the subject matter of the representation; or
(iii) To any provider’s insurer or legal counsel, or the authorized employees or agents of a provider’s insurer or legal counsel, for the sole purpose of handling a potential or actual claim against any provider if the medical record is maintained on the claimant and relates to the subject matter of the claim;
(2) If the person given access to the medical record signs an acknowledgment of the duty under this Act not to redisclose any patient identifying information, to a person for:
(i) Educational or research purposes, subject to the applicable requirements of an institutional review board;
(ii) Evaluation and management of health care delivery systems; or
(iii) Accreditation of a facility by professional standard setting entities;
(3) Subject to the additional limitations for a medical record developed primarily in connection with the provision of mental health services in § 4–307 of this subtitle, to a government agency performing its lawful duties as authorized by an act of the Maryland General Assembly or the United States Congress;
(4) Subject to the additional limitations for a medical record developed primarily in connection with the provision of mental health services in § 4–307 of this subtitle, to another health care provider for the sole purpose of treating the patient or recipient on whom the medical record is kept;
(5) If a claim has been or may be filed by, or with the authorization of a patient or recipient on behalf of the patient or recipient, for covered insureds, covered beneficiaries, or enrolled recipients only, to third party payors and their agents, if the payors or agents have met the applicable provisions of §§ 15–10B–01 to 15–10B–18 of the Insurance Article, including nonprofit health service plans, health maintenance organizations, fiscal intermediaries and carriers, the Department and its agents, the United States Department of Health and Human Services and its agents, or any other person obligated by contract or law to pay for the health care rendered for the sole purposes of:
(i) Submitting a bill to the third party payor;
(ii) Reasonable prospective, concurrent, or retrospective utilization review or predetermination of benefit coverage;
(iii) Review, audit, and investigation of a specific claim for payment of benefits; or
(iv) Coordinating benefit payments in accordance with the provisions of the Insurance Article under more than one sickness and accident, dental, or hospital and medical insurance policy;
(6) If a health care provider makes a professional determination that an immediate disclosure is necessary, to provide for the emergency health care needs of a patient or recipient;
(7) To immediate family members of the patient or any other individual with whom the patient is known to have a close personal relationship, provided that:
(i) The disclosure is limited to information that is directly relevant to the individual’s involvement in the patient’s health care; and
(ii) 1. If the patient is present or otherwise available before the disclosure and has the capacity to make health care decisions:
A. The patient has been provided with an opportunity to object to the disclosure and the patient has not objected; or
B. The health care provider reasonably infers from the circumstances that, based on the health care provider’s professional judgment, the patient does not object to the disclosure; or
2. If the patient is not present or otherwise available before the disclosure is made, or providing the patient with an opportunity to object to the disclosure is not practicable because of the patient’s incapacity or need for emergency care or treatment, the health care provider determines, based on the health care provider’s professional judgment, that the disclosure is in the best interests of the patient;
(8) To an appropriate organ, tissue, or eye recovery agency under the restrictions of § 5–408 of this article for a patient whose organs and tissues may be donated for the purpose of evaluating the patient for possible organ and tissue donation;
(9) To the Department or an organ, tissue, or eye recovery agency designated by the Department for the purpose of conducting death record reviews under § 19–310 of this article;
(10) Subject to subsection (c) of this section, if the purpose of the medical record disclosure is for the coordination of services and record retention within the Montgomery County Department of Health and Human Services; or
(11) To a carrier, as defined in § 15–1301 of the Insurance Article, or an accountable care organization, as defined in § 3022 of the Patient Protection and Affordable Care Act, for the sole purposes of enhancing or coordinating patient care, provided that:
(i) A disclosure under this item is subject to the additional limitations in § 4–307 of this subtitle on disclosure of a medical record developed primarily in connection with the provision of mental health services;
(ii) A medical record may be disclosed only in accordance with the federal Health Insurance Portability and Accountability Act of 1996, any regulations adopted under the Act, and any other applicable federal privacy laws, and disclosures under this item may not be made in violation of the prohibited uses or disclosures under the federal Health Insurance Portability and Accountability Act of 1996;
(iii) A disclosure under this item may not be used for underwriting or utilization review purposes;
(iv) A health care provider that discloses a medical record in accordance with this item shall provide a notice consistent with the requirements of 45 C.F.R. § 164.520 specifying the information to be shared, with whom it will be shared, and the specific types of uses and disclosures that the health care provider may make in accordance with this item;
(v) The notice required by item (iv) of this item shall include an opportunity for the individual to opt out of the sharing of the individual’s medical record with a carrier or an accountable care organization for the purposes identified in this item;
(vi) If a health care provider discloses medical information or medical data to a carrier or accountable care organization through an infrastructure that provides organizational and technical capabilities for the exchange of protected health information among entities not under common ownership, the health care providers are subject to the requirements of §§ 4–302.2 and 4–302.3 of this subtitle; and
(vii) If the disclosure is of abortion care or other sensitive health services information as determined by the Secretary under § 4–302.5(d) of this subtitle, the disclosure is subject to the requirements under § 4–302.5 of this subtitle.
(c) (1) The disclosure of medical records under subsection (b)(10) of this section to a person that is not employed by or under contract with the Montgomery County Department of Health and Human Services shall be conducted in accordance with this subtitle.
(2) Under provisions of State law regarding confidentiality, the Montgomery County Department of Health and Human Services shall be considered to be one agency.