(a)      A health care provider shall:

            (1)      Keep the medical record of a patient or recipient confidential; and

            (2)      Disclose the medical record only:

                  (i)      As provided by this subtitle; or

                  (ii)      As otherwise provided by law.

      (b)      The provisions of this subtitle do not apply to information:

            (1)      Not kept in the medical record of a patient or recipient that is related to the administration of a health care facility, including:

                  (i)      Risk management;

                  (ii)      Quality assurance; and

                  (iii)      Any activities of a medical or dental review committee that are confidential under the provisions of Title 4, Subtitle 5 and Title 14, Subtitle 5 of the Health Occupations Article and any activities of a pharmacy review committee;

            (2)      Governed by the federal confidentiality of alcohol and drug abuse patient records regulations, 42 CFR Part 2 and the provisions of § 8-601(c) of this article; or

            (3)      Governed by the developmental disability confidentiality provisions in §§ 7-1008 through 7-1011 of this article.

      (c)      A health care provider may disclose directory information about a patient without the authorization of a person in interest, except if the patient has instructed the health care provider in writing not to disclose directory information.

      (d)      A person to whom a medical record is disclosed may not redisclose the medical record to any other person unless the redisclosure is:

            (1)      Authorized by the person in interest;

            (2)      Otherwise permitted by this subtitle;

            (3)      Permitted under Article 88A, § 6(b) of the Code; or

            (4)      Directory information.

      (e)      (1)      Except as provided in paragraph (2) of this subsection, a person may not disclose by sale, rental, or barter any medical record.

            (2)      This subsection shall not prohibit the transfers of medical records relating to the transfer of ownership of a health care practice or facility if the transfer is in accord with the ethical guidelines of the applicable health care profession or professions.

      (f)      The provisions of this subtitle may not be construed to constitute an exception to the reporting requirements of Title 5, Subtitle 7 and Title 14, Subtitle 3 of the Family Law Article.