Health General, § 4-403, Annotated Code of Maryland governs the retention of patient medical records. These provisions require that medical records, laboratory reports, and X-ray reports be maintained for at least seven (7) years from the date the record or report was created.

You must maintain records:

1. In an office with access restricted to authorized staff;
2. On a computer or other device with appropriate security protocols such as passwords or data encryption;
3. In a commercial records storage site with appropriate environmental and security controls; or
4. Using other storage options that ensure protection, security, and access control.

Yes, you must:

1. Have access to compatible electronic hardware and software that will enable you to generate a legible copy of the record to comply with patient and governmental access needs; and
2. Have a current backup copy of the electronic files.

You cannot destroy a medical record, laboratory, or X-ray report until the patient reaches the age of majority (18 in Maryland) plus seven (7) years - in other words, until the patient is 25 years old, unless:

1. The parent or guardian of the minor patient is notified; or
2. If the medical care documented in the record was provided under Health General, § 20‐102(c) or § 20‐103(c), Annotated Code of Maryland, and the minor patient is notified.

In some circumstances, an adult is not required to consent to a minor patient's treatment, and the minor shall be notified. For example, if the minor is treated for or advised about substance use, alcoholism, venereal disease, pregnancy, or contraception, is treated or examined for alleged rape or sexual assault, receives medical screening and physical examination in a detention center, or if the minor had an abortion and parental notice was waived then the minor must be notified (Health General, §§ 20‐102(c) and 20‐103(c), Annotated Code of Maryland). The minor must be notified by certified mail, addressee only.

You must notify the patient by first-class mail to the patient's last known address and by e-mail to the patient's last known e-mail address. If the patient is a minor and the medical care documented in the record was not provided under Health General § 20‐102(c) or § 20‐103(c), Annotated Code of Maryland, the parent or guardian of the patient must be notified. The notice must include the date that the patient's record will be destroyed, and instruct the patient that the record, or a summary of the record, may be retrieved at a designated location within 60 days of the designated date of destruction.

Once your practice closes, the records must be maintained by another healthcare provider, the administrator of your estate, or a designee who has agreed to maintain the records. The new custodian of records must notify the applicable health occupations board (physicians must notify the Board of Physicians) that the records will be maintained in compliance with state law. The new custodian shall forward the notice to patients or the parent or guardian of the minor patients unless the medical care documented in the record was provided under Health General, § 20‐102(c) or § 20‐103(c), Annotated Code of Maryland, before the destruction or transfer of medical records.

To notify the Board of the designee for the medical records, email mdh.mbp_intake@maryland.gov.

Please refer to Health General, § 4-304(c), Annotated Code of Maryland.

A provider may not refuse to provide the records because of unpaid fees for medical services.