Maryland Requirements

In December, Delaware Health Information Network (DHIN) provided notification of a Maryland law restricting health information exchanges (HIEs) operating within Maryland from providing access to Maryland data associated with abortion and abortion-related care to their participants without explicit patient consent. [See post below.]

That law required the Maryland Department of Health and Maryland Health Care Commission to publish regulations providing further information to HIEs and the public about what data would be subject to this heightened consent requirement and how HIEs should be expected to implement these restrictions over time.

On January 12th, those draft regulations were published in the Maryland Register and are available at: https://dsd.maryland.gov/MDRIssues/5101/Assembled.aspx. 

In general, the regulations require HIEs – including DHIN – to block access to certain reproductive health data that was generated at a Maryland location on or after May 31, 2022 and to prevent such information from being disseminated through DHIN’s standard distribution channels on a going forward basis.The Maryland Department of Health published a code set in the same Register, specifying the data subject to the regulations.

In addition to providing the specific codes to be blocked, the draft regulations also required HIEs that, like DHIN, were not presently blocking data associated with the newly-published code sets to submit to the Maryland Health Care Commission, on or before January 29, 2024, an implementation plan describing the HIE’s efforts to develop the technology needed to block the requested information and providing a timeline for completion.  

DHIN provided the Maryland Health Care Commission with its implementation plan on January 29, 2024. Among other things, that implementation plan confirms that DHIN is currently developing the technology needed to implement the new regulations and expects to have code fully tested and fully deployed in its systems on or before: 

• April 5th (for the portion of the project blocking restricted data received on or after May 31, 2022 from view in the Community Health Record)
• April 15th (blocking Maryland location HL7 messages containing the restricted codes from continuing to DHIN’s downstream distribution channels)
• May 2nd (for blocking restricted data received in Maryland location CCDs from continuing to DHIN’s downstream distribution channels)

DHIN has made significant efforts to meet the new requirements of Maryland law and will continue to work to ensure compliance in all jurisdictions in which DHIN operates. That includes continued work with DHIN’s vendors and internal technical teams to meet the evolving requirements and guidance issued by the State of Maryland, most recently contained in a January 26, 2024 technical guidance document.

While DHIN’s implementation plan is ongoing, access to DHIN’s health data and services will continue to be limited to healthcare providers and other individuals with legal rights of access to data under HIPAA and DHIN’s enabling legislation.  

DHIN retains its existing HITRUST certifications, and Delaware law prohibits entities from obtaining access to health information in DHIN’s possession through use of the subpoena power. Based on review of historic data fields from Maryland locations, DHIN expects there to be a minimal amount of data that would otherwise be subject to the Maryland regulatory restrictions that will flow through DHIN’s systems during the period of time in which DHIN’s code sets are being developed and updated.

For more information about the restrictions on access and DHIN’s registration, please contact the Maryland Health Care Commission. DHIN will continue to communicate, as needed, with data sending organizations, customers and users through email notices, also posted here.

If you have any questions about this requirement or DHIN’s implementation plan generally, please reach out to (302) 678-0220 and ask to be connected with External Affairs or Legal.