Section 4-403 of the Health-General Article and regulations at COMAR 10.01.16 govern the retention of patient medical records. These provisions require that medical records, laboratory, and x-ray reports be maintained for at least five (5) years from the date the record or report was created.

You must maintain records:

1. in an office with access restricted to authorized staff;
2. on a computer or other device with appropriate security protocols such as passwords or data encryption;
3. in a commercial records storage site with appropriate environmental and security controls; or
4. using other storage options that ensure protection, security, and access control.

You must have access to compatible electronic hardware and software that will enable you to generate a legible copy of the record in order to comply with patient and governmental access needs, and you must have a current back-up copy of the electronic files.

You must maintain and cannot destroy a medical record, laboratory, or x-ray report until the patient reaches the age of majority (18 in Maryland) plus three (3) years – in other words, until the patient is 21 years old, or for five (5) years after the record or report is made, whichever date is later.

You must notify the parent or guardian of a minor patient by first-class mail before destroying a minor's medical record. Notification to the minor patient must be by certified mail, addressee only, if the care documented in the record was provided under circumstances in which an adult was not required to consent to the treatment. For example, if the minor is treated for or advised about drug abuse, alcoholism, venereal disease, pregnancy, or contraception, is treated or examined for alleged rape or sexual assault, or receives medical screening and physical examination in a detention center, then the minor must be notified. If the minor had an abortion and parental notice for the abortion was waived because the minor patient met the criteria outlined in Section 20-103(c) of the Health General-Article, the minor must be notified by certified mail, addressee only.

You must send notice by first-class mail to the patient's last known address, including the date that the patient's record will be destroyed, and instruct the patient that the record, or a summary of the record, may be retrieved at a designated location within 30 days of the proposed date of destruction.

Once your practice closes, the records must be maintained by another health care provider, the administrator of your estate, or a designee who has agreed to maintain the records. The new custodian of records must write to the applicable health occupations board (physicians must notify the Board of Physicians) that the records will be maintained in compliance with state law. In pursuing the destruction of the records, the new custodian, after the required five (5) year period has elapsed, must provide the patients with the proper notice for destruction or publish a notice in the daily newspaper with the proposed date of destruction, and location where records can be obtained, for patients desiring to retain their own medical records.

To notify the Board of the designee for the medical records, email mdh.mbp_intake@maryland.gov .

Maryland law (Health General Sec. 4-304) allows physicians to charge patients (or the patient's "personal representative") a fee for copying medical records. The charges may be adjusted annually for inflation. Effective immediately, the fee remains as stated below:

• A fee for copying not to exceed .76 cents for each page of the medical record, and
• The actual cost of postage and handling.
• Preparation fee of $22.88, if the records are sent to another provider. The federal HIPAA regulations do not allow a charge for a preparation fee for records provided directly to the patient.

A provider may not refuse to provide the records because of unpaid fees for medical services.