.09 Registration and Enforcement.
A. To operate an HIE in the State, a person shall be recognized by the Commission as having met requirements for registration.
(1) A person shall complete an application for registration in a form and manner specified by the Commission that shall include:
(a) The HIE's definition of what constitutes an unusual finding within Regulation .06 of this chapter;
(b) The HIE's current audited financial statement that demonstrates the financial viability of the HIE;
(c) The identity of the HIE's registered resident agent who shall accept service in Maryland on behalf of the HIE;
(d) Documentation showing its technical capabilities, which may include accreditation or candidacy status by a nationally recognized accrediting body; and
(e) Provisions for reasonable notice to participating organizations and the Commission if the HIE ceases to operate in Maryland; and
(f) Other information as required by the Commission.
(2) Financial Integrity.
(a) Following review of the financial statement provided by the HIE under §A(1)(b) of this regulation, the Commission may require a bond, letter of guarantee, or other financial instrument from the HIE, its parent company, or other responsible person.
(b) The amount of a bond, letter of guarantee, or other financial instrument required under this regulation shall be established by the Commission and be based on an HIE's financial statement.
(c) If a bond is required under §A(2)(a) of this regulation, it shall at a minimum:
(i) Identify the Commission as the sole beneficiary;
(ii) Be continuous and subject to cancellation only after 60 days' notice to the Commission;
(iii) Contain the following language or similar language acceptable to the Commission: "Payment under this bond shall be due in the event the Commission determines that the HIE is financially insolvent or unable to meet its obligations as a registered HIE in Maryland"; and
(iv) Permit the Commission to direct that the proceeds of the bond be paid or disbursed as necessary to maintain or repair the privacy and security of PHI that was or is available through the HIE.
(d) If a bond is required under §A(2)(a) of this regulation, it shall be obtained from a company licensed in the State to write surety types of insurance.
(e) If a letter of guarantee or other financial instrument is required under §A(2)(a) of this regulation, the guarantor shall submit a current balance sheet and income statement to the Commission.
(3) Within 45 days after receipt of complete information from an applicant seeking to register as an HIE in the State, the Commission shall take one of the following actions:
(a) Recognize the HIE as registered in the State; or
(b) Deny the registration for reasons enumerated to the applicant.
B. The Commission shall annually renew the registration of an HIE registered in the State that demonstrates its continued compliance with this chapter and provides the following information in a form and manner specified by the Commission, within 120 days of the close of its fiscal year:
(1) Updated information that reflects each change regarding the items in §A(1) of this regulation;
(2) Results of an audit performed in compliance with Regulation .06 of this chapter;
(3) As deemed appropriate by the Commission, additional requirements set forth in §A(2) of this regulation; and
(4) Other information as requested by the Commission.
C. The Commission may take an enforcement action against a person when there is reasonable basis to believe that the person has violated a provision of this chapter.
(1) The Commission may conduct any investigation into a potential violation.
(a) A person shall cooperate in an investigation conducted by Commission staff into a potential violation.
(b) A person shall provide information sought by Commission staff within 10 business days of its request for such information, unless an extension of time is sought for good cause shown and granted by the Commission.
(2) After an investigation under §C(1) of this regulation, the Commission staff may issue a notice of proposed action that includes:
(a) The details regarding each violation or potential violation;
(b) A request for a person to submit a corrective action plan in order to achieve compliance with this chapter, which may include:
(i) An action aimed at correcting the underlying issue; and
(ii) Any other action that is appropriate under the circumstances.
(c) A recommended resolution of the potential violation, which may include:
(i) Non-public reprimand;
(ii) Public reprimand; or
(iii) Limitations on HIE registration or a person's access to information through an HIE;
(iv) Suspension of HIE registration or a person’s access to information through an HIE;
(v) Revocation of HIE registration or a person’s access to information through an HIE;
(vi) Financial penalties in accordance with §C(3) of this regulation; or
(vii) Referral to another State or federal agency for civil or criminal enforcement.
(3) Civil and Criminal Penalties.
(a) Civil Penalties. A person who knowingly fails to comply with this chapter shall be subject to a civil penalty imposed by the Commission not exceeding $10,000 per day based on:
(i) The extent of actual or potential public harm caused by the violation;
(ii) The cost of the investigation; and
(iii) The person’s prior record of compliance.
(b) Criminal Penalties. Beginning June 1, 2024, a person who knowingly violates Health-General Article, §4-302.5, Annotated Code of Maryland, shall be guilty of a misdemeanor and on conviction is subject to a fine not to exceed $10,000 per day based on:
(i) The extent of actual or potential public harm caused by the violation;
(ii) The cost of the investigation; and
(iii) The person’s prior record of compliance.
(4) When the Commission staff determines that a notice of proposed action is not appropriate given the lack of available evidence or other circumstances, it may issue one of the following:
(a) A letter advising that no action is recommended at that time; or
(b) A letter finding that no action is warranted.
D. A person who receives a notice of proposed action from the Commission staff may request an opportunity to show cause why the proposed action should not be taken.
(1) A written request to show cause shall be filed with the Commission and shall comply with the following:
(a) It shall be filed within 20 days of the issuance of the notice of proposed action; and
(b) It shall include each fact upon which the person relies to show cause why the proposed action should not be taken.
(2) Upon receipt of a request to show cause, the Commission staff may meet with the person to attempt to resolve the matter in a manner that protects the public and is in the public interest.
(3) If a notice of proposed action is not resolved within 45 days of the filing of a request to show cause, a hearing officer shall be designated by the executive director of the Commission.
(a) The hearing officer shall hear evidence as needed;
(b) The hearing shall be conducted in accordance with the Maryland Administrative Procedure Act, State Government Article, Title 10, Annotated Code of Maryland, and these regulations.
(c) The hearing officer shall issue a recommended decision that contains proposed findings of fact and conclusions of law and may recommend that the Commission take one of the following actions:
(i) Adopt the action proposed by Commission staff;
(ii) Adopt a proposed action recommended by the hearing officer; or
(iii) Find that no action is warranted.
E. A request that the Commission not adopt the recommended decision may be made by either Commission staff or a person who is the subject of an enforcement action.
(1) Written exceptions to the recommended decision shall be filed within 20 days of receipt of the hearing officer's recommended decision.
(2) Exceptions shall specifically identify in writing each finding and conclusion to which exception is taken, citing those portions of the record on which each exception is based.
(3) A written response to exceptions to the recommended decision may be filed by an opposing party within 15 days of receipt of exceptions.
(4) Each person taking or responding to exceptions may present oral argument to the Commission, not to exceed 10 minutes per party, unless extended by the Chair of the Commission.
(5) The decision of the Commission shall be by a majority of the quorum present and voting.
F. The Commission may coordinate with the Office of Attorney General concerning any potential violation involving a matter within the Attorney General’s authority pursuant to State or federal law.
G. If an HIE has reasonably determined that it is unable to independently meet any requirements of this chapter, then the HIE shall develop and implement policies to ensure the HIE’s compliance through the execution of a written agreement with a participating organization or a business associate that will bring the HIE into compliance with this chapter. Every year as a part of the registration renewal process, the HIE shall submit a written attestation by an independent third-party auditor to the Commission, attesting that the HIE has been in full compliance with the requirements of this chapter for the 12-month period prior to the audit.
H. Exemptions.
(1) An HIE may request a 1-year exemption from certain requirements of this chapter.
(2) An exemption request must:
(a) Be in writing;
(b) Identify each specific requirement of this chapter from which the HIE is requesting an exemption;
(c) Identify the time period of the exemption, if any;
(d) State the reason for each exemption request; and
(e) Include information that justifies the exemption request.
(3) Within 45 days after receipt of complete information from an HIE requesting an exemption, the Commission shall take one of the following actions:
(a) Grant the exemption by providing written notification; or
(b) Deny the exemption request by providing written notification that enumerates the reasons for the denial to the HIE.
(4) An exemption may not be made for any requirement within this chapter that is otherwise required of the HIE by federal or other State law.
(5) An exemption may be made on the following grounds:
(a) The absence of certain functionality in the infrastructure of the HIE that does not allow the HIE to maintain compliance with the requirement;
(b) The requirement would hinder the ability of the HIE to comply with other requirements of this chapter or federal or other State laws; or
(c) The requirement would cause an undue burden or hardship on the HIE, such that the HIE would no longer be able to provide HIE services in the State.
(6) For good cause shown, the Commission may renew a 1-year exemption for an additional 1-year period.
