Maryland Healthcare Compliance Requirements
State-specific breach notification rules, medical records retention periods, PDMP requirements, and mandatory reporting obligations for medical practices operating in Maryland.
Maryland medical practices operate under the Maryland Personal Information Protection Act, codified at Md. Comm. Law §14-3504, which requires breach notification no later than 45 days after the business discovers or is notified of the breach — HB 962 moved that clock off the conclusion of the investigation and onto discovery, effective Oct 1, 2022 — and which requires the Maryland Attorney General to be notified before any affected individuals are. Neither duty binds a HIPAA-compliant medical practice. §14-3507(d) provides that a business "subject to and in compliance with" HIPAA "shall be deemed to be in compliance with this subtitle," and because that deeming runs subtitle-wide it carries the AG-first sequencing along with the 45-day clock — HIPAA's 60-day rule governs instead. The condition inside the deeming is the part that does the work: it holds only while your HIPAA compliance does, so a practice that cannot show it was compliant falls back on PIPA in full. The AGO's Health Education and Advocacy Unit oversees healthcare-related consumer protection, and PIPA penalties run up to $1,000 per affected individual with a $100,000 cap per event. Medical records carry a 5-year retention floor under COMAR 10.07.01, with the HIPAA 6-year floor as the operative minimum for most practices. The Maryland PDMP requires every prescriber to query before every controlled-substance prescription, with carve-outs for hospice, cancer, ER 3-day supplies, post-surgical 14-day supplies, and inpatient/long-term care administration. Child-abuse reporting under Md. Family Law §5-708 routes through the Department of Social Services with serious penalties for failure.
Breach Notification Rules
Notification deadline
60 calendar days (HIPAA)
Maryland law states 45 days, but that figure does not bind a HIPAA covered practice — see below.
Notification must be made no later than 45 days after the business discovers or is notified of the breach — Md. Code, Com. Law §14-3504, as amended by HB 962 effective Oct 1, 2022. The prior rule ran 45 days from the conclusion of the investigation; the clock now starts at discovery. The Maryland Attorney General must be notified before individuals are notified. Decisively for this audience: §14-3507(d) provides that a business "subject to and in compliance with" HIPAA "shall be deemed to be in compliance with this subtitle" — the deeming runs subtitle-wide, so neither the 45-day clock nor the pre-notice Attorney General submission binds a compliant covered entity, and HIPAA's 60-day rule governs instead.
AG notification threshold (as the statute reads)
All breaches
Notify: AG
Whether this reaches a HIPAA covered practice depends on the carve-out — see the notification note.
Harm analysis required
Penalty range
Up to $1,000 per affected individual, max $100,000 per event
Enforcement Posture
The Maryland Attorney General maintains an active healthcare enforcement posture. The AGO's Health Education and Advocacy Unit is unusual nationally — it sits inside the Attorney General's office and handles healthcare-specific consumer-protection matters including PIPA enforcement. The AG-before-residents notification sequencing is a clear procedural bright line for businesses that answer to PIPA directly, and the AGO has historically pursued matters where those businesses notified residents first and the AG later — but §14-3507(d) deems a business "subject to and in compliance with" HIPAA compliant with the whole subtitle, so a covered entity meeting its federal obligations does not owe the pre-notice AG submission at all. The per-affected-individual penalty structure (up to $1,000 per individual, $100,000 cap) creates meaningful exposure even for mid-sized breaches. Department of Health licensure surveys add a parallel enforcement track on the 5-year retention rule under COMAR 10.07.01. For a medical practice the defensible posture is therefore a federal one: run HIPAA's 60-day clock from discovery, document the investigation timeline, and keep written safeguards on file — that record is also what establishes the §14-3507(d) deeming if the AGO ever asks why no pre-notice submission arrived.
Medical Records Retention
| Record type | Retention period | Measured from |
|---|---|---|
| General medical | 5 years | Last treatment |
Controlled-Substance Prescription Monitoring (Maryland PDMP)
The Maryland PDMP must be queried before every controlled-substance prescription. Exemptions cover hospice patients, active cancer treatment, ER prescriptions of 3 days or less, post-surgical prescriptions of 14 days or less, and inpatient hospital or long-term care administration. Delegation to authorized staff is permitted. The licensing board can impose discipline including license suspension, and civil penalties and possible misdemeanor charges apply for willful noncompliance.
Check required
Every prescription
Check frequency
Every prescription
Delegation allowed
Penalty range
Licensing board discipline; civil penalties; misdemeanor for willful noncompliance
Exemptions
Hospice patients, cancer treatment, ≤14 day supply post-surgical, inpatient hospital or long-term care facility, ≤3 day supply in ER
How Maryland Rules Hit by Specialty
Pain management
Maryland PDMP queries are required before every controlled-substance prescription, with exemptions for short ER and post-surgical supplies. Maryland also imposes opioid-prescribing limits under HB 1432 — pain practices need PDMP documentation, duration limits, and CME completion records for ongoing controlled-substance prescribing privileges.
Behavioral health
Maryland's Health-General Article §4-301 et seq. layers psychiatric record confidentiality requirements onto HIPAA, requiring separate authorization for most disclosures of mental-health records and imposing stricter rules on disclosure to law enforcement.
Telehealth providers
Maryland's telehealth licensure framework under COMAR 10.32.05 reaches out-of-state providers serving Maryland residents regardless of where the practice sits physically, and PIPA follows residency the same way. What that reach costs a covered entity is small: §14-3507(d) deems a HIPAA-compliant business compliant with the subtitle, so the 45-day clock and the AG-first sequencing give way to HIPAA's 60-day rule. Licensure under COMAR 10.32.05 is the live Maryland obligation for a multistate telehealth practice, not a second breach clock.
Mandatory Reporting Obligations
Mandated reporters
Healthcare practitioners including physicians, nurses, dentists, psychologists, social workers, and emergency medical providers
Report to
Department of Social Services, local child protective services, or local law enforcement
Timeline
Immediately / as soon as possible
Penalty for failure
Misdemeanor, up to $10,000 fine and/or 5 years jail
Immunity provision
Good faith reporters immune from civil and criminal liability under Md. Family Law 5-708
Mandated reporters
Healthcare practitioners, police officers, and human services workers
Report to
Adult Protective Services, Department of Human Services
Timeline
Immediately / as soon as possible
Penalty for failure
Misdemeanor, up to $5,000 fine
Immunity provision
Good faith reporters immune from civil and criminal liability
Mandated reporters
Healthcare providers treating injuries from suspected criminal acts or domestic violence
Report to
Local law enforcement
Timeline
Immediately / as soon as possible
Immunity provision
Good faith reporters immune from civil liability
Mandated reporters
Physicians, laboratories, healthcare facilities, and infection control practitioners
Report to
Maryland Department of Health, local health department
Timeline
Within 24 hours
Penalty for failure
Misdemeanor, up to $500 fine per violation
Immunity provision
Good faith reporters immune from civil liability
Mandated reporters
All healthcare providers treating gunshot wounds or stab wounds
Report to
Local law enforcement or Maryland State Police
Timeline
Immediately / as soon as possible
Penalty for failure
Misdemeanor, up to $500 fine
Immunity provision
Good faith reporters immune from civil and criminal liability
Maryland Compliance FAQs
For a HIPAA-compliant medical practice, 60 days — the federal clock. Md. Comm. Law §14-3504 does set a 45-day state deadline running from discovery (HB 962 moved the trigger off the conclusion of the investigation effective Oct 1, 2022) and does require the Maryland Attorney General to be notified before any affected residents are. But §14-3507(d) provides that a business "subject to and in compliance with" HIPAA "shall be deemed to be in compliance with this subtitle," and that deeming runs subtitle-wide — so neither the 45-day cap nor the AG-first sequencing binds a compliant covered entity, and HIPAA's 60-day rule governs instead. The condition matters more than the exemption: the deeming holds only while your HIPAA compliance does.
COMAR 10.07.01 sets 5 years from last treatment as the state floor. The HIPAA 6-year minimum applies in parallel and is the operative floor for most practices.
Every prescriber must query the Maryland PDMP before every controlled-substance prescription, with exemptions for hospice, cancer, ER ≤3-day supplies, post-surgical ≤14-day supplies, and inpatient/long-term care administration.
Under Md. Family Law §5-704, all healthcare practitioners — physicians, nurses, dentists, psychologists, social workers, EMTs — must report suspected child abuse to the Department of Social Services or local law enforcement. Failure is a misdemeanor with up to $10,000 in fines and/or 5 years jail.
Up to $1,000 per affected individual with a $100,000 cap per breach event. The AGO's Health Education and Advocacy Unit handles healthcare-related PIPA matters.
Guides & Articles
Neighboring State Compliance Guides
Stay audit-ready in Maryland
GuardWell tracks Maryland-specific breach deadlines, retention periods, Maryland PDMP PDMP queries, and mandatory reporting obligations automatically.