Md. Code Regs. 10.25.07.09 - Withdrawal of Certification and Other Penalties
A. The
Commission may withdraw certification from an MHCC-certified EHN if the
Commission finds that:
(1) The MHCC-certified
EHN fails to meet the certification standards set forth in Regulation .05 of
this chapter;
(2) A principal or
owner of the MHCC-certified EHN, or the entity itself, is convicted of, or
pleads guilty or nolo contendere to, a crime related to the operation of the
EHN or to a crime involving financial improprieties;
(3) A principal or owner of the MHCC-certified EHN, or
the entity itself, is notified by a qualified accreditation or certification
organization or the Commission of a violation of HIPAA privacy or security
standards and fails to take action to remedy the violation within the period of
time specified by a qualified accreditation or certification organization or by
the Commission;
(4) The
MHCC-certified EHN disclosed legally protected health information in violation
of Health-General Article, §4-302.5, Annotated Code of Maryland; or
(5) The MHCC-certified EHN violated a
provision of COMAR 10.25.18.
B. An MHCC-certified EHN shall report on
compliance progress to the Commission, as follows:
(1) By January 8, 2024, an MHCC-certified EHN
shall submit to the Commission:
(a) An
affirmation that to the extent required by Health-General Article, §4-302.5,
Annotated Code of Maryland, it:
(i) Possesses
the technological capability to filter and restrict from disclosure legally
protected health information;
(ii)
Is parsing restricted codes and conveying all other information in the health
record that is not prohibited by law to exchange; and
(iii) Possesses the technological capacity to
allow a consumer to request and consent to the exchange of legally protected
health information to a specific treating provider; or
(b) An implementation plan that includes:
(i) An affirmation that, despite its best
efforts, the MHCC-certified EHN lacks the technological capability to fully
comply with HealthGeneral Article, §4-302.5, Annotated Code of Maryland, as of
January 8, 2024, including a detailed explanation of the EHN's
limitations;
(ii) A detailed
description of the steps the MHCC-certified EHN is taking to ensure compliance
with Health-General Article, §4-302.5, Annotated Code of Maryland, by June 1,
2024;
(iii) A timeline to implement
Health-General Article, §4-302.5, Annotated Code of Maryland, by June 1, 2024;
and
(iv) A description of the
extent legally protected health information and other health information will
be restricted by the MHCC-certified EHN during the implementation of its
plan.
(2) If a
MHCC-certified EHN submits an implementation plan in accordance with §B(1) of
this regulation, the EHN shall:
(a) Provide a
status report to the Commission by April 1, 2024, detailing the progress the
MHCC-certified EHN has made under its implementation plan; and
(b) Submit validation to the Commission by
June 1, 2024, that it possesses the technological capability to filter and
restrict from disclosure legally protected health information to the extent
required by law.
C. Beginning June 1, 2024, a person who
knowingly violates Health-General Article, §4-302.5, Annotated Code of
Maryland, shall be guilty of a misdemeanor and on conviction is subject to a
fine not to exceed $10,000 per day based on:
(1) The extent of actual or potential public
harm caused by the violation;
(2)
The cost of investigating the violation; and
(3) The person's prior record of
compliance.
Notes
Regulation .09C amended effective December 15, 2008 (35:25 Md. R. 2150); amended effective 51:3 Md. R. 152, eff.
State regulations are updated quarterly; we currently have two versions available. Below is a comparison between our most recent version and the prior quarterly release. More comparison features will be added as we have more versions to compare.
No prior version found.