(a)    A health care provider shall:

(1)    Keep the medical record of a patient or recipient confidential; and

(2)    Disclose the medical record only:

(i)    As provided by this subtitle; or

(ii)    As otherwise provided by law.

(b)    The provisions of this subtitle do not apply to information:

(1)    Not kept in the medical record of a patient or recipient that is related to the administration of a health care facility, including:

(i)    Risk management;

(ii)    Quality assurance; and

(iii)    Any activities of a medical or dental review committee that are confidential under the provisions of § 1–401 and Title 4, Subtitle 5 of the Health Occupations Article and any activities of a pharmacy review committee;

(2)    Governed by the federal confidentiality of alcohol and drug abuse patient records regulations, 42 C.F.R. Part 2 and the provisions of § 8–601(c) of this article; or

(3)    Governed by the developmental disability confidentiality provisions in §§ 7–1008 through 7–1011 of this article.

(c)    (1)    Unless the patient has restricted or prohibited the disclosure of directory information, a health care provider may disclose directory information about a patient to an individual who has asked for the patient by name.

(2)    A health care provider shall:

(i)    Inform a patient of the health care information that the health care provider may include in a directory and the persons to whom the health care provider may disclose the information; and

(ii)    As soon as practicable, provide the patient with the opportunity to restrict or prohibit disclosure of directory information.

(3)    If providing an opportunity under paragraph (2)(ii) of this subsection to restrict or prohibit the disclosure of directory information is not practicable because of the patient’s incapacity or need for emergency care or treatment, a health care provider may disclose the patient’s directory information if the disclosure is:

(i)    Consistent with a prior expressed preference of the patient that is known to the health care provider; and

(ii)    Determined to be, based on the health care provider’s professional judgment, in the patient’s best interest.

(d)    A person to whom a medical record is disclosed may not redisclose the medical record to any other person unless:

(1)    The redisclosure is:

(i)    Authorized by the person in interest;

(ii)    Otherwise permitted by this subtitle;

(iii)    Permitted under § 1–202(b) or (c) of the Human Services Article; or

(iv)    Directory information; or

(2)    (i)    The person to whom the medical record was disclosed is a guardian ad litem who received the medical record in accordance with § 4–306(b)(12) of this subtitle;

(ii)    A reasonable effort to secure a qualified protective order has been made in accordance with 42 C.F.R. § 164.512(e)(1)(v); and

(iii)    The guardian ad litem determines that it is necessary to redisclose the medical record to carry out the guardian ad litem’s official function to protect the best interests of a minor or a disabled or elderly individual in a criminal or juvenile delinquency court proceeding.

(e)    (1)    Except as provided in paragraph (2) of this subsection, a person may not disclose by sale, rental, or barter any medical record.

(2)    This subsection shall not prohibit the transfers of medical records relating to the transfer of ownership of a health care practice or facility if the transfer is in accord with the ethical guidelines of the applicable health care profession or professions.

(f)    The provisions of this subtitle may not be construed to constitute an exception to the reporting requirements of Title 5, Subtitle 7 and Title 14, Subtitle 3 of the Family Law Article.