MD Code, Health-General § 4-309 - Violations of Subtitle

A health care provider who fails to provide a patient his or her medical record upon written request after 21 working days from the request will be liable for actual damages. 

A health care provider may not refuse to disclose medical records based on the failure of the patient to pay for the health care services rendered. 

A violation of this section includes a health care provider or other person obtaining a patient’s medical record under false pretenses or deception or if the health care provider discloses a medical record in violation of the provisions of this subtitle. 

A health care provider or any other person, including a government employee, who knowingly and willfully violates this subtitle is guilty of a misdemeanor and upon conviction is subject to a fine not to exceed $1,000 for the first violation and $5,000 for each subsequent violation of the provisions of this section. 

A health care provider or any other person, including a government employee, who knowingly and willfully obtains a medical record under false pretenses or deception or knowingly and willfully discloses a medical record in violation of the provisions of this subtitle, is guilty of a misdemeanor and upon conviction is subject to a fine not to exceed $50,000, imprisonment for 1 year, or both; if the offense is committed under false pretenses, a fine not to exceed $100,000, imprisonment of not more than 5 years, or both; and if the offense is committed with the intent to sell, transfer or use individually identifiable information for commercial purposes, malicious intent or personal gain, a fine to not exceed $250,000, imprisonment for 10 years, or both.  These penalties do not apply to a government employee conducting a criminal investigation. 

A health care provider who knowingly violates any of the provisions of this section or subtitle is liable for actual damages.