top of page

Confidentiality of Medical Records

Our office is following the guidelines established in Federal Health Insurance Portability and Accountability Act (HIPAA) regulations addressing the privacy of health care information, found at 45 CFR §§ 160 & 164, 42 CFR part 2 – Confidentiality of Substance Use Disorder Patient's records and Maryland's Confidentiality of Medical Records Act (MCMRA), codified at Health-General § 4-301 et seq. HIPAA and MCMRA both establish a general rule of confidentiality for health care information. MCMRA requires a health care provider to keep the medical record of the patient confidential and disclose information only as provided by the act itself or as otherwise provided by law. HIPAA enumerates permitted disclosures slightly more specifically by allowing disclosures: to the individual (patient); for treatment, payment, and health care operations; incident to a use or disclosure permitted by the act; and pursuant to authorizations, agreements, or certain public use exceptions. The 42 CFR Part 2 regulations serve to protect patient records created by federally assisted programs for the treatment of substance use disorders (SUD). Part 2 has been revised to further facilitate better coordination of care in response to the opioid epidemic while maintaining its confidentiality protections against unauthorized disclosure and use.


Maryland Confidentiality of Medical Records Act

Notice of Privacy Practices

HIPAA Regulations

The Health Insurance Portability & Accountability Act of 1996 ("HIPAA") is a Federal program that requests that all medical records and other individually identifiable health information used or disclosed by us in any form, whether electronically, on paper, or orally are kept properly confidential. This Act gives you, the patient, the right to understand and control how your personal health information ("PHI") is used. HIPAA provides penalties for covered entities that misuse personal health information.

As required by HIPAA, we prepared this explanation of how we are to maintain the privacy of your health information and how we may disclose your personal information.

We may use and disclose your medical records only for each of the following purposes: treatment, payment, and health care operation.

• Treatment means providing, coordinating, or managing health care and related services by one or more healthcare providers. An example of this is a primary care doctor referring you to a specialist doctor.

• Payment means such activities as obtaining reimbursement for services, confirming coverage, billing or collections activities, and utilization review. An example of this would include sending your insurance company a bill for your visit and/or verifying coverage prior to a surgery.

• Health Care Operations include business aspects of running our practice, such as conducting quality assessments and improving activities, auditing functions, cost management analysis, and customer service. An example of this would be new patient survey cards.

• The practice may also be required or permitted to disclose your PHI for law enforcement and other legitimate reasons. In all situations, we shall do our best to assure its continued confidentiality to the extent possible.

We may also create and distribute de-identified health information by removing all reference to individually identifiable information.

We may contact you, by phone or in writing, to provide appointment reminders or information about treatment alternatives or other health-related benefits and services, in addition to other fundraising communications, that may be of interest to you. You do have the right to "opt out" with respect to receiving fundraising communications from us.

The following use and disclosures of PHI will only be made pursuant to us receiving a written authorization from you:

• Most uses and disclosure of psychotherapy notes;

• Uses and disclosure of your PHI for marketing purposes, including subsidized treatment and health care operations;

• Disclosures that constitute a sale of PHI under HIPAA; and

• Other uses and disclosures not described in this notice.

You may revoke such authorization in writing and we are required to honor and abide by that written request, except to the extent that we have already taken actions relying on your prior authorization.

You may have the following rights with respect to your PHI.

• The right to request restrictions on certain uses and disclosures of PHI, including those related to disclosures of family members, other relatives, close personal friends, or any other person identified by you. We are, however, not required to honor a request restriction except in limited circumstances which we shall explain if you ask. If we do agree to the restriction, we must abide by it unless you agree in writing to remove it.

• The right to reasonable requests to receive confidential communications of Protected Health

Information by alternative means or at alternative locations.

• The right to inspect and copy your PHI.

• The right to amend your PHI.

• The right to receive an accounting of disclosures of your PHI.

• The right to obtain a paper copy of this notice from us upon request.

• The right to be advised if your unprotected PHI is intentionally or unintentionally disclosed.

If you have paid for services "out of pocket", in full and in advance, and you request that we not disclose PHI related solely to those services to a health plan, we will accommodate your request, except where we are required by law to make a disclosure.

We are required by law to maintain the privacy of your Protected Health Information and to provide you

the notice of our legal duties and our privacy practice with respect to PHI.

This notice if effective as of ________________________ and it is our intention to abide by the terms of the Notice of Privacy Practices and HIPAA Regulations currently in effect. We reserve the right to change the terms of our Notice of Privacy Practice and to make the new notice provision effective for all PHI that we maintain. We will post and you may request a written copy of the revised Notice of Privacy Practice from our office.

You have recourse if you feel that your protections have been violated by our office. You have the right to file a formal, written complaint with office and with the Department of Health and Human Services, Office of Civil Rights. We will not retaliate against you for filing a complaint.

Feel free to contact the Practice Compliance Officer (insert name and telephone number) for more information, in person, or in writing.

(Copyright 2014 American Psychiatric Association and American Academy of Dermatology Association. APA members have permission to use for personal practice.)

Copy and Release of the Medical Records

Under Maryland law, you have the right to obtain a copy of your medical records.

 To do so, you must make a written request. This signed and dated request must state your name, the name of your health care provider, and the party who should receive your records. Your authorization to release your records is good for one year. 

A provider must disclose a medical record within a reasonable period of time after receiving your written request.

Under state law, you may be charged no more than 76 cents per page for having your records copied, plus actual postage and handling costs. (These limitations do not apply to x-rays.) If a medical practice is using an electronic medical records system, they must provide a patient requesting their medical record with a copy in electronic format, if the patient so requests. The charge for the copy provided can be no more than the actual labor costs incurred by the practice in responding to that request. These fees may be adjusted annually for inflation.

 Federal law forbids a provider from charging preparation fees, including fees for retrieving or handling the information or for processing the request, if the records are being provided to the consumer. 

If the records are being sent to someone other than the consumer, the law allows for an administrative fee of no more than $22.88 in 2014, which may also be adjusted annually.

 To avoid a surprise bill, ask about fees before requesting records. In most cases, the provider may withhold your records unless you pay the fee. 

However, the provider may not withhold the records because you have not paid an outstanding bill for treatment. 

Copy of Medical Record:                   

 0.75 cents per page plus actua​l postage and handling cost

  • Instagram
  • Facebook
bottom of page