Maryland ABA Privacy and Data Breach Requirements

ABA practice privacy and data breach requirements in Maryland combine HIPAA with a state law that expressly includes medical history, treatment, diagnosis, mental health information and certain insurance identifiers in personal information. A covered owner generally investigates misuse promptly and, when notice is required, notifies residents as soon as reasonably practicable and no later than 45 days. A maintainer's owner handoff generally has a 10-day outside period, and the Attorney General receives notice before residents. Maryland also requires reasonable security and contracted vendor safeguards.

Privacy has to survive the whole care story

A Maryland practice can receive a diagnosis, insurance ID, family concern and referral before it meets the child. The clinical relationship adds observations, goals, behavior data, caregiver notes, schedules, school coordination and claims. The HIPAA Privacy Rule creates a federal framework for a covered practice, while Maryland law adds its own definitions and duties.

Draw the family's information journey, including the forms and messages people use when the main system is inconvenient. For every copy, name the purpose, users, owner, retention rule and deletion or transfer path. This is a more honest foundation for ABA practice privacy and data breach requirements in Maryland than a list of software settings.

Maryland's state definition reaches health information

Commercial Law Section 14-3501 defines personal information to include a name combined with listed identifiers, health information, mental-health information, qualifying health-insurance identifiers and biometric data. It also has a route for email-account credentials and separate treatment of genetic information. The protected-health details make Maryland different from identity-only statutes.

Map fields rather than file names. A session note may contain a child's name and treatment information. An eligibility export may combine a name, insurance identifier and access key. A staff spreadsheet may carry financial credentials but no PHI. Each can require a different set of reviewers even when the same attacker obtained them.

Reasonable security is a continuing state duty

Section 14-3503 requires a business that owns, maintains or licenses Maryland residents' personal information to use reasonable security procedures and practices appropriate to the information, business size and operations. The rule is scaled, but it is not optional for a small practice.

Turn “reasonable” into choices people can show: unique accounts, multifactor authentication where available, prompt offboarding, limited exports, device management, backups, patching, log review and a practiced response route. Document why a control fits the risk and who maintains it. A small clinic can be proportionate without relying on shared passwords or an owner's memory.

Vendor contracts carry a Maryland safeguard requirement

When a business discloses personal information to a nonaffiliated service provider under a written contract, Maryland generally requires the contract to call for reasonable security practices appropriate to the information and designed to protect it. HIPAA may separately require a BAA for a business associate.

Read the security exhibit and the BAA together. Confirm that the vendor can preserve logs, identify affected Maryland residents, explain encryption, stop an account, support notice work and return or dispose of data at exit. A generic promise to follow law does not assign the investigation tasks an ABA owner will need during a difficult weekend.

The breach begins with unauthorized acquisition

Section 14-3504 defines a breach as unauthorized acquisition of computerized data that compromises the security, confidentiality or integrity of personal information. A limited good-faith employee acquisition is excluded if the information is not misused or disclosed further. The business then conducts a good-faith, reasonable and prompt investigation into the likelihood of misuse.

Preserve evidence before cleaning every system. Record which files were available, what logs show, who obtained access, whether information left the environment and what mitigation occurred. “Suspicious login,” “security incident,” “Maryland breach” and “HIPAA breach” should remain distinct statuses until the appropriate facts and definitions are applied.

A no-notice conclusion needs its own record

If the investigation reasonably determines that the breach does not create a likelihood that personal information has been or will be misused, resident notice is not required under the state section. Maryland requires records reflecting that determination to be kept for three years after it is made.

Write the reasoning for a future reader. Identify the data, residents, acquisition evidence, unauthorized person, safeguards, mitigation, missing facts and reviewer. A one-line “no risk” conclusion is difficult to defend and easy to confuse with the different HIPAA compromise assessment. The decision record should show why this event reached this result.

Owners generally work within a 45-day outside limit

Unless a permitted delay applies, an owner or licensee that must notify gives resident notice as soon as reasonably practicable and no later than 45 days after discovery or notification of the breach. Scope work, identifying people and restoring integrity can affect timing, and a qualifying law-enforcement determination has a specific route.

Do not wait for day 44 to organize the facts. Start a chronology and assign owners for population work, legal analysis, drafting, delivery, call support and follow-up. Add HIPAA, payer, insurer, contract and other-state dates separately. A visible register helps the team act promptly without merging unlike clocks.

Maintainers generally have no more than 10 days

A business maintaining Maryland personal information it does not own or license generally tells the owner as soon as reasonably practicable and no later than 10 days after discovering or learning of a breach, subject to the statutory delay provisions. It must share information relevant to the breach and cannot charge for information the owner needs to notify.

An ABA practice can be an owner for family records and a maintainer for a school, network or affiliate. Its technology providers may be maintainers in turn. Put ownership, evidence exchange, resident mapping and escalation contacts in the contract so a ten-day outside period does not become ten days of searching for the right person.

The Attorney General is notified before residents

Before giving resident notice, the business generally provides the Maryland Attorney General with the state resident count, a description of when and how the event occurred, steps taken or planned, the notice form and a sample. Resident content separately includes the information categories, business contact information and resources for identity-theft help.

Build a recipient matrix instead of one generic letter. The Attorney General, residents, HHS, media, payers, insurers and contracting partners can require different timing and content. Record who approved each communication and preserve proof of delivery. Sequence errors are easier to prevent when the route is visible before drafting begins.

HIPAA and Maryland can both care about a treatment note

The HIPAA breach rule generally presumes an impermissible use or disclosure is a breach unless an exception applies or a documented four-factor assessment supports a low probability of compromise. Maryland's state definition, acquisition test and likelihood-of-misuse inquiry are separate even though both may cover the same clinical information.

Run the analyses side by side. The conclusions may align, but they should not be copied from one column to the other. A documented result should identify which entity is a covered entity, which data is PHI or Maryland personal information and what evidence supports each risk question. This prevents a federal conclusion from silently deciding state notice.

Maryland medical-record confidentiality has its own lane

Health-General Section 4-302 protects medical records, requires a provider to keep them confidential and disclose them only as authorized by law, and calls for safeguards and procedures. Its definitions and related provisions determine which providers, records, recipients and exceptions fit.

Coordinate access, amendment, subpoena, school, payer and family-authority requests through one visible process. Verify identity and representative authority, document the legal basis and retain what was disclosed. Do not promise absolute confidentiality, and do not use a payer's request as a blanket reason to send an entire chart.

The comprehensive privacy law uses data-level healthcare exemptions

Maryland's Online Data Privacy Act has controller thresholds and duties that require a separate scope review. Its exemption section exempts PHI and certain medical-record information when the detailed conditions are met. It does not say that every data set held anywhere in a healthcare organization disappears from the law.

Map marketing leads, website analytics, workforce data and affiliate operations separately from PHI. Confirm the controller and consumer relationship, threshold, purpose and exemption for each flow. A practice should not paste “HIPAA exempt” into a privacy notice without checking whether the information and entity actually qualify.

Maryland Medicaid requires an authoritative service record

The current Maryland Medicaid ABA Provider Manual is effective February 1, 2026. It requires enrolled ABA providers to maintain documentation for each service, including consent, location, date and time, service description, measurable behavior or symptoms, caregiver participation and a legible provider signature. It also links coverage and billing to current COMAR provisions.

Those records need to be complete, retrievable and protected. Keep the billed service, treatment plan and signed note aligned, and store temporary downtime documentation safely until it is reconciled. Confirm the current retention period through the applicable regulation, agreement, payer and record type rather than inventing one universal ABA number.

A portal mistake makes the overlap visible

Chesapeake Behavior Collective is fictional. A password-reset link opens the wrong family's portal profile. The visible page includes a name, mental-health diagnosis, treatment schedule and insurance subscriber identifier. The practice closes the link path, preserves identity and application logs and confirms that current clinicians can still reach the correct plans.

Reviewers assess unauthorized acquisition and likelihood of misuse under Maryland law, then run the distinct HIPAA analysis. They open resident, Attorney General, HHS, payer, insurer and vendor tracks without deciding notice before reviewing the logs. A three-year decision record will be retained if they conclude Maryland resident notice is not required.

Families need a response written for humans

If outreach is required, explain the event and involved information in ordinary language. Say what the practice has done, what the family can do and where a person can ask a question. Keep confirmed facts apart from estimates. Mention continuity of services if it matters to the family's immediate life.

Prepare language access, alternate formats and a consistent call guide. Let frontline staff escalate questions rather than improvise legal conclusions. A friendly tone does not soften accountability; it makes the response usable. The practice can be careful about uncertainty while still sounding present and concerned.

Privacy should change as the practice changes

Review data movement when the practice adds a location, payer, school partnership, vendor, service or acquired clinic. Sample permissions after implementation, test offboarding and restoration, and ask staff where they are compensating for a broken workflow. Keep a short record of the decision and next review.

That rhythm is manageable even for a small organization. Over time it creates an evidence trail for reasonable security and makes the incident plan easier to use. Privacy becomes part of operating the practice, not a separate project that appears only at renewal or after a complaint.

ABA Practice Privacy and Data Breach Requirements in Maryland