Md. Code of Regs. §10.01.16.04 - Maintenance of Medical Records.

Providers must develop and maintain a records retention schedule in compliance with Regulations .04—.07 of this chapter. Except as provided in Regulations .06 and .07 of this chapter, a health care provider shall maintain medical records for all patients in the health care provider's care for a minimum of 5 years after the medical record is made or until the patient is 21 years old, whichever is longer.

Medical records are the personal property of the entity providing health care and are maintained for the patient, medical or treatment staff, and other treatment, payment, and health care operations.

A health care provider shall retain medical records in either an office with access restricted to authorized staff, a computer or other device with appropriate security such as passwords or data encryption, a commercial records storage site with appropriate environmental and security controls; or other storage options that ensure protection, security, and access control.

Maintenance of medical records may be contracted to a records management service that agrees to comply with and be subject to this chapter. Records placed in storage remain the responsibility of the provider, including:

• Providing the patient access to their medical records and authorized copies upon request in accordance with Health-General Article, §4-304, Annotated Code of Maryland, and 45 CFR §164.524, as amended;
• Ensuring the confidentiality of the medical records, which includes providing security and restricted access to the medical records; and
• Protecting the medical records from damage, loss, and deterioration.

If a medical record is kept in electronic form, a health care provider shall maintain or have access to compatible electronic hardware and software that enables the health care provider to generate a legible copy of the record in order to comply with patient and governmental access needs. Back-up copies of electronic records must be maintained.