Maryland Privacy Laws for Large Claimant Reports: A Compliance Guide for Employers and Insurers

Maryland Online Data Privacy Act Overview

The Maryland Online Data Privacy Act of 2024 (MODPA) took effect on October 1, 2025. It creates comprehensive Consumer Data Protection duties for controllers and processors that handle Maryland residents’ personal data, and treats violations as per se violations of the Maryland Consumer Protection Act enforced by the Office of the Attorney General. There is no MODPA-created private right of action. ([oag.maryland.gov](https://oag.maryland.gov/resources-info/Pages/data-privacy.aspx))

Coverage is triggered if, in the prior calendar year, you controlled or processed personal data of at least 35,000 Maryland consumers (excluding data handled solely to complete payment transactions) or at least 10,000 consumers while deriving more than 20% of gross revenue from the sale of personal data. MODPA applies to controllers and their processors (service providers), including nonprofits that meet the thresholds. ([oag.maryland.gov](https://oag.maryland.gov/resources-info/Pages/data-privacy.aspx))

Because “consumer” excludes individuals acting in an employment context, MODPA generally does not cover employee data. That distinction is pivotal when handling large claimant reports related to workplace benefits and claims. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/laws/StatuteText?article=gcl&enactments=false§ion=14-4701))

Personal and Sensitive Data Definitions

Personal data means any information linked or reasonably linkable to an identified or identifiable Maryland resident, excluding de-identified and publicly available information. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/laws/StatuteText?article=gcl&enactments=false§ion=14-4701))

Sensitive personal data includes consumer health data, genetic or biometric data, precise geolocation, personal data of a known child, and data revealing racial or ethnic origin, religious beliefs, sex life, sexual orientation, status as transgender or nonbinary, national origin, or citizenship or immigration status. MODPA bans the sale of sensitive personal data and allows its collection, processing, or sharing only when strictly necessary to provide or maintain a specific product or service requested by the consumer. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/laws/StatuteText?article=gcl&enactments=false§ion=14-4701))

Data Minimization and Consumer Rights

Data minimization standard

Controllers must limit collection to what is reasonably necessary and proportionate to provide or maintain the specific product or service the consumer requested. Processing for incompatible purposes requires consent, and sensitive data faces a strict necessity test before processing or sharing. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&enactments=false§ion=14-4707))

Data subject rights

• Confirm whether you process a consumer’s personal data and access it.
• Correct inaccuracies, delete personal data, and obtain a portable copy (if processed by automated means).
• Receive a list of categories of third parties to which personal data was disclosed.
• Opt out of targeted advertising, the sale of personal data, and certain automated profiling with legal or similarly significant effects.

Controllers must offer secure, reliable methods to exercise these Data Subject Rights and clearly disclose how to use them. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&enactments=false§ion=14-4705))

Timelines, appeals, and costs

You must respond to a verified request within 45 days, with one 45-day extension when reasonably necessary. Provide responses free once every 12 months; additional requests may incur a reasonable fee if unfounded or excessive. Denials require an internal appeals process with a written decision within 60 days and a way to contact the Consumer Protection Division if the appeal is denied. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&enactments=false§ion=14-4705))

Universal opt-out signals

By October 1, 2025, controllers may satisfy opt-out obligations by honoring an authorized opt-out preference signal indicating a consumer’s intent to opt out of sales and targeted advertising, provided the signal meets statutory criteria. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&enactments=false§ion=14-4707))

Enforcement and Penalties under MODPA

The Attorney General exclusively enforces MODPA under the Maryland Consumer Protection Act. A violation is a per se MCPA violation, and penalties can reach up to $10,000 per violation and up to $25,000 for each subsequent violation, along with injunctive relief, restitution, economic damages, and disgorgement. ([oag.maryland.gov](https://oag.maryland.gov/resources-info/Pages/data-privacy.aspx))

The Division may issue a notice of violation and, when a cure is possible, provide time to cure; this cure period is discretionary, not guaranteed. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/2026RS/Statute_Web/gcl/14-4714.pdf?utm_source=openai))

Exemptions and Special Cases

Entity-level exemptions include government bodies, certain registered market associations, and financial institutions subject to the Gramm–Leach–Bliley Act (GLBA). ([oag.maryland.gov](https://oag.maryland.gov/resources-info/Pages/data-privacy.aspx))

Data-level exemptions include protected health information under HIPAA, Fair Credit Reporting Act data, Driver’s Privacy Protection Act data, FERPA-covered education records, certain research data, and personal data processed in an employment or contractor context. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&enactments=false§ion=14-4703))

Insurance-specific carve-out: personal data collected by or on behalf of a person regulated under the Insurance Article (or an affiliate) in furtherance of the business of insurance is exempt. This often places insurance claims data—including large claimant reports—outside MODPA’s scope when created and used for insurance operations. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&enactments=false§ion=14-4703))

Implications for Employers and Insurers

Large claimant reports in health and disability benefits

When large claimant reports are prepared by or for an insurer/TPA and used to administer, pay, or manage claims, they typically fall under HIPAA or the Insurance Article carve-out and therefore outside MODPA. Even so, you should restrict access, avoid unnecessary direct identifiers, and use aggregated or de-identified data where feasible to reduce risk exposure. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&enactments=false§ion=14-4703))

Workers’ compensation and P&C lines

For property and casualty, including workers’ compensation, data processed by or on behalf of regulated insurers in furtherance of the business of insurance generally remains exempt. Confirm that downstream vendors act “on behalf of” the insurer and do not repurpose data for unrelated, non-insurance uses. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&enactments=false§ion=14-4703))

Where MODPA can still apply

• Non-insurance marketing sites, cookies, or lead-gen tools targeting Maryland consumers.
• Vendor analytics that are not performed on behalf of a regulated insurer or that serve unrelated commercial purposes.
• Data about nonemployees in contexts unrelated to insurance operations (e.g., retail benefits marketplaces or direct-to-consumer services).

In these edge cases, the Data Minimization Requirement, privacy notices, rights-response workflows, and opt-out mechanisms must be implemented. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&enactments=false§ion=14-4707))

Processor contracts and algorithmic assessments

If you use processors, a written contract must govern processing instructions, purpose, data types, duration, security, deletion/return, subcontractor flow-downs, and cooperation with compliance inquiries. For high-risk processing, conduct data protection assessments—including an assessment for each algorithm used—to weigh benefits against risks and document safeguards. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4708&utm_source=openai))

Compliance Steps and Best Practices

1) Map and segment your data

• Catalog “large claimant report” sources, fields, and flows; tag HIPAA- or Insurance Article–exempt data; separate any MODPA-scope consumer data.
• Identify Sensitive Personal Data and restrict it to strictly necessary use tied to a consumer-requested service.

([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&enactments=false§ion=14-4703))

2) Apply the Data Minimization Requirement

• Limit collection to the minimum needed for the specific product or service the consumer requested; prohibit incompatible uses without consent.
• Prefer de-identified or aggregated claimant summaries when sharing with employers for plan oversight or renewals.

([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&enactments=false§ion=14-4707))

3) Prepare to honor Data Subject Rights (for any in-scope data)

• Stand up request intake, authentication, and tracking; respond within 45 days (plus a permissible 45-day extension); provide one free response per 12 months.
• Offer appeals with a written decision within 60 days and a path to contact the Division if the appeal is denied.

([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&enactments=false§ion=14-4705))

4) Implement opt-outs and universal signals

• Clearly disclose any sales, targeted ads, or qualifying profiling, and provide easy opt-outs.
• Honor authorized opt-out preference signals that meet MODPA’s criteria.

([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&enactments=false§ion=14-4707))

5) Strengthen contracts and governance

• Bind processors via written agreements that set instructions, security, deletion/return, and subcontractor terms; maintain oversight.
• Perform data protection assessments for heightened-risk processing and for each algorithm used, and retain documentation.

([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4708&utm_source=openai))

6) Train teams and verify exemptions

• Educate claims, benefits, and analytics teams on MODPA scope, GLBA/HIPAA carve-outs, and when MODPA does apply (e.g., marketing sites).
• Regularly re-check your applicability thresholds and exemption bases as operations evolve.

([oag.maryland.gov](https://oag.maryland.gov/resources-info/Pages/data-privacy.aspx))

Summary

For large claimant reports, most insurer-controlled claim operations are exempt under HIPAA and the Insurance Article carve-out, but MODPA still matters at the margins—especially for non-insurance consumer touchpoints. Knowing the thresholds, strict data minimization, sensitive-data limits, rights timelines, and AG enforcement posture lets employers and insurers design processes that both respect exemptions and meet in-scope obligations. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&enactments=false§ion=14-4703))

FAQs.

What are the data processing thresholds under MODPA?

MODPA applies if you controlled or processed personal data of at least 35,000 Maryland consumers in the prior year (excluding data handled solely to complete payment transactions) or at least 10,000 consumers while deriving more than 20% of gross revenue from selling personal data. ([codes.findlaw.com](https://codes.findlaw.com/md/commercial-law/md-code-coml-sect-14-4702/?utm_source=openai))

How do employers comply with consumer rights requests?

First determine scope: “consumer” excludes individuals acting in an employment context, and many large claimant reports are exempt when created by or on behalf of insurers for insurance operations. For any in-scope requests, respond within 45 days (one 45-day extension allowed), provide one free response per 12 months, and offer an appeals process with a written decision within 60 days. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/laws/StatuteText?article=gcl&enactments=false§ion=14-4701))

What penalties apply for non-compliance?

The Attorney General enforces MODPA. Civil penalties can reach up to $10,000 per violation and up to $25,000 for each subsequent violation, and the AG may also seek injunctive relief, restitution, economic damages, and disgorgement. ([oag.maryland.gov](https://oag.maryland.gov/resources-info/Pages/data-privacy.aspx))

Are insurers exempt under certain conditions?

Yes. MODPA does not apply to financial institutions subject to GLBA and exempts personal data collected by or on behalf of persons regulated under the Insurance Article when processed in furtherance of the business of insurance—conditions that frequently cover large claimant reports. ([oag.maryland.gov](https://oag.maryland.gov/resources-info/Pages/data-privacy.aspx))