Md. Code, Health - General § 4-309
This is the official text of Md. Code, Health - General § 4-309, part of Maryland’s Code, Health - General — covers public health regulation.
Not legal advice. This page reproduces the official text of a government statute for reference only. Laws change, and how a statute applies depends on your specific facts. For advice about your situation, consult a licensed attorney in your state.
§4–309.
Official statutory text
(a) If a health care provider knowingly refuses to disclose a medical record within a reasonable time but no more than 21 working days after the date a person in interest requests the disclosure, the health care provider is liable for actual damages.
(b) A health care provider may not refuse to disclose a medical record on the request of a person in interest because of the failure of the person in interest to pay for health care rendered by the health care provider.
(c) A health care provider or any other person is in violation of this subtitle if the health care provider or any other person:
(1) Requests or obtains a medical record under false pretenses or through deception; or
(2) Discloses a medical record in violation of this subtitle.
(d) Except as otherwise provided in subsection (e) of this section, a health care provider or any other person, including an officer or employee of a governmental unit, who knowingly and willfully violates any provision of this subtitle is guilty of a misdemeanor and on conviction is subject to a fine not exceeding $1,000 for the first offense and not exceeding $5,000 for each subsequent conviction for a violation of any provision of this subtitle.
(e) (1) A health care provider or any other person, including an officer or employee of a governmental unit, who knowingly and willfully requests or obtains a medical record under false pretenses or through deception or knowingly and willfully discloses a medical record in violation of this subtitle is guilty of a misdemeanor and on conviction is subject to the following penalties:
(i) A fine not exceeding $50,000, imprisonment for not more than 1 year, or both;
(ii) If the offense is committed under false pretenses, a fine not exceeding $100,000, imprisonment for not more than 5 years, or both; and
(iii) If the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, a fine not exceeding $250,000, imprisonment for not more than 10 years, or both.
(2) This subsection does not apply to an officer or employee of a governmental unit that is conducting a criminal investigation.
(f) A health care provider or any other person who knowingly violates any provision of this subtitle is liable for actual damages.
(b) A health care provider may not refuse to disclose a medical record on the request of a person in interest because of the failure of the person in interest to pay for health care rendered by the health care provider.
(c) A health care provider or any other person is in violation of this subtitle if the health care provider or any other person:
(1) Requests or obtains a medical record under false pretenses or through deception; or
(2) Discloses a medical record in violation of this subtitle.
(d) Except as otherwise provided in subsection (e) of this section, a health care provider or any other person, including an officer or employee of a governmental unit, who knowingly and willfully violates any provision of this subtitle is guilty of a misdemeanor and on conviction is subject to a fine not exceeding $1,000 for the first offense and not exceeding $5,000 for each subsequent conviction for a violation of any provision of this subtitle.
(e) (1) A health care provider or any other person, including an officer or employee of a governmental unit, who knowingly and willfully requests or obtains a medical record under false pretenses or through deception or knowingly and willfully discloses a medical record in violation of this subtitle is guilty of a misdemeanor and on conviction is subject to the following penalties:
(i) A fine not exceeding $50,000, imprisonment for not more than 1 year, or both;
(ii) If the offense is committed under false pretenses, a fine not exceeding $100,000, imprisonment for not more than 5 years, or both; and
(iii) If the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, a fine not exceeding $250,000, imprisonment for not more than 10 years, or both.
(2) This subsection does not apply to an officer or employee of a governmental unit that is conducting a criminal investigation.
(f) A health care provider or any other person who knowingly violates any provision of this subtitle is liable for actual damages.
Status: in_force · Read it on the official government site
Need a lawyer in Maryland?
Find a Maryland lawyer
About this page: Statute text is reproduced from official government publishers via the
Open US Law dataset
(Vaquill AI, snapshot v2026.08, CC BY 4.0). Primary legislative text like this is public domain under the government-edicts doctrine
(Georgia v. Public.Resource.Org, 2020). We link every section back to its official source so you can verify it independently.