Maryland Mental Health Record Privacy Laws Explained: Your Rights and What Providers Can Share

Confidentiality and Privilege of Mental Health Records

What confidentiality means in Maryland

Maryland protects mental health information confidentiality by default. Your records are private, and a provider may not disclose them unless a law permits or you authorize it. Health-General Article § 4-307 adds heightened safeguards for evaluation notes, psychotherapy notes, and other mental health documentation beyond the general medical record rules.

Confidentiality versus privilege

Confidentiality is a provider’s day‑to‑day duty to keep your information private. Privilege is your right to keep therapy communications out of legal proceedings, subject to narrow exceptions. In practice, providers should treat both principles as complementary: disclose the least information necessary, and only when a statute or court process clearly allows it.

Special handling of psychotherapy notes

Psychotherapy notes and sensitive session narratives are specially protected under Health-General Article § 4-307. They are typically kept separate from the rest of the medical record, and access or disclosure is more restricted. When direct release could be harmful, you may be offered a treatment summary instead of raw notes.

Conditions for Disclosure Without Consent

Treatment, payment, and operations

A provider may share limited mental health information without your written permission to coordinate treatment with other professionals, obtain payment, or run essential health care operations such as quality assurance. Disclosures must follow the “minimum necessary” standard and be consistent with Health-General Article § 4-307.

Emergencies and serious threats

Information may be disclosed to address an immediate risk of serious harm to you or others, or during an acute psychiatric emergency. Providers should document the threat, who received the information, and why disclosure was necessary.

Personal representatives, parents, and guardians

When Maryland law recognizes a personal representative (for example, a court‑appointed guardian or the personal representative of a deceased patient), a provider may disclose relevant records without your direct consent. Parents may access a minor’s records in many circumstances; however, access can be limited if disclosure would harm the minor or if the minor legally consented to specific services.

When written permission is required

Outside of these scenarios, patient authorization requirements apply. A valid authorization identifies what will be disclosed, to whom, for what purpose, and for how long, and it is signed and dated. You may revoke authorization at any time in writing, and providers must honor any lawful limits you place on disclosure.

Penalties for Improper Record Withholding

Maryland law establishes a medical records access timeline and requires providers to respond within that window. Unjustified delay or refusal can create liability for noncompliance under Health-General Article § 4-309. Consequences can include civil exposure for damages, administrative sanctions by licensing boards, corrective action plans, and, in willful or egregious cases, criminal penalties.

Improper withholding also carries practical risks: audit findings, contractual repercussions with payers, and reputational harm. Providers reduce these risks by documenting requests, tracking deadlines, giving clear written reasons for any denial, and offering alternative access such as a summary reviewed by another qualified professional.

Legal Exceptions to Privacy Protections

Even with strong safeguards, statutory exceptions to disclosure allow sharing in defined circumstances. Common examples include:

• Mandatory reporting of suspected child abuse, neglect, or abuse of vulnerable adults.
• Compliance with a valid court order, warrant, or subpoena that meets Maryland’s privacy requirements.
• Disclosures to health oversight agencies for inspections, licensing, audits, or investigations.
• Information needed for involuntary evaluation, commitment proceedings, or emergency petitions.
• Limited disclosures to law enforcement to locate a missing or escaped individual, or to prevent a serious and imminent threat.
• Medical examiner or coroner investigations, organ and tissue donation coordination, and narrowly tailored research or public health activities permitted by law.

Rights to Access and Timely Disclosure

Your right to see and get copies

You have the right to inspect and obtain copies of your mental health records, with narrow exceptions when release would likely endanger life or physical safety. If direct access is limited, you may request a summary or have another qualified provider review the records on your behalf, consistent with Health-General Article § 4-307.

Format, scope, and the medical records access timeline

You can request paper or electronic copies and ask that records be sent to you or a designated third party. Providers must respond within the medical records access timeline established by Health-General Article § 4-309, and they should provide only what you requested—dates, categories, or specific documents—to avoid unnecessary disclosure.

How to make an effective request

Submit a clear, signed request that states what you want, the date range, preferred format, where to send it, and any deadlines you face. Include proof of identity and authority if you are a personal representative. If your request is denied, you are entitled to a written explanation and information about review or appeal options.

Provider Obligations and Fee Structures

Core obligations

Providers must adopt policies, train staff, verify identity before releasing information, track disclosures as required, and apply the minimum‑necessary standard. They must also maintain secure record systems and follow the heightened requirements for mental health materials under Health-General Article § 4-307 and the access rules in Health-General Article § 4-309.

Permitted fees and good‑faith estimates

Health-General Article § 4-309 permits reasonable, regulated copy fees. Charges may include per‑page copying, a preparation fee, and postage or delivery costs. Electronic copies should be priced in a cost‑based manner. Providers should give you an itemized estimate on request and may not condition access on payment of unrelated treatment bills.

Practical takeaway: track requests, meet timelines, and use itemized, compliant fees. Patients: be specific about what you need and how fast you need it. Providers: clear communication and documented decisions are the best protection against liability for noncompliance.

FAQs

What protections do Maryland laws provide for mental health records?

Maryland law makes mental health records confidential by default and adds extra safeguards for sensitive materials like psychotherapy notes. Health-General Article § 4-307 limits when providers may disclose, requires the minimum necessary information, and allows summaries or alternative access if direct release could cause harm.

When can providers disclose mental health records without consent?

Disclosure without consent is allowed for treatment coordination, payment, core health care operations, emergencies or serious threats, certain health oversight functions, compliance with valid court orders, and other narrowly defined statutory exceptions to disclosure. Outside these situations, a signed, specific authorization is required.

What penalties apply if records are not disclosed promptly?

Failing to meet the medical records access timeline in Health-General Article § 4-309 can trigger liability for noncompliance. Providers may face civil liability, administrative sanctions from licensing boards, mandated corrective action, and, for willful or egregious violations, criminal penalties.

How can individuals access their mental health records in Maryland?

Send a written, signed request that specifies the records, date range, and format, and indicate where to send them. You can ask for paper or electronic copies or a summary. Providers must respond within the statutory timeline, and any denial must be explained in writing with information about review or alternative access.