Maryland AI Laws for Healthcare: HB 820, MODPA and What a Clinic Must Do

Less than the headlines suggest, and almost none of it is addressed to providers by name.

Maryland has not passed a general AI statute like Colorado's or a provider disclosure duty like Texas TRAIGA. HB 1331, the 2025 attempt at a Colorado style high risk AI framework, stopped after a single House hearing. The 2026 behavioural health and chatbot bills passed the House and died in Senate Finance. As of September 2026 the Maryland statute book contains exactly one AI provision written for healthcare, and it binds payers: Insurance Article section 15-10B-05.1, enacted by HB 820 (Chapter 747 of 2025).

That leaves three bodies of law a Maryland clinic deploying AI has to reason about.

• HB 820, which governs how your patients' insurers and their review agents may use AI in utilization review, and which gives you a statutory basis to challenge a denial that looks automated.
• The Maryland Online Data Privacy Act (Commercial Law title 14 subtitle 46), in force since October 1, 2025, whose strictly necessary standard for consumer health data reaches your AI vendors and your own non clinical systems.
• The all party consent wiretap law (Courts and Judicial Proceedings section 10-402), which is older than any AI product and is the rule that most directly shapes how an ambient scribe or AI phone agent must be introduced to a patient.

Layered under all three is the federal baseline in HIPAA, which Maryland law repeatedly defers to rather than displaces. Use our healthcare AI law checker if you operate across state lines and need to see how Maryland stacks against the others.

Eleven conditions and a prohibition, all of them now in Insurance Article section 15-10B-05.1 and in force since October 1, 2025.

The section applies to a carrier that uses an artificial intelligence, algorithm or other software tool for utilization review, or that contracts with or works through an entity that does, and to a pharmacy benefits manager or private review agent that uses such a tool on a carrier's behalf. Artificial intelligence is defined broadly as an engineered or machine based system that infers from input how to generate outputs that can influence physical or virtual environments, which captures rules engines as readily as language models.

An entity in scope must ensure that the tool:

1. bases its determinations on the enrollee's medical or other clinical history, individual clinical circumstances as presented by the requesting provider, or other relevant clinical information in the enrollee's record;
2. does not base determinations solely on a group dataset;
3. uses criteria and guidelines that comply with the utilization review title;
4. does not replace the role of a health care provider in the determination process under section 15-10B-07;
5. does not result in unfair discrimination prohibited by federal or state law;
6. is fairly and equitably applied, including in accordance with applicable federal HHS regulations and guidance;
7. is open to inspection for audit or compliance review by the Commissioner;
8. is described in written policies and procedures in the carrier's utilization plan filed under section 15-10B-05, including how it will be used and what oversight is provided;
9. has its performance, use and outcomes reviewed and revised at least quarterly to maximise accuracy and reliability;
10. does not use patient data beyond its intended and stated purpose, consistent with HIPAA; and
11. does not directly or indirectly cause harm to an enrollee.

Subsection (d) then states flatly that an artificial intelligence, algorithm or other software tool may not deny, delay or modify health care services. Read with item four, the effect is that a Maryland adverse decision must still come from the physician reviewer the utilization review subtitle already requires. The same Act amended section 15-10A-06 so that each carrier's quarterly report to the Commissioner records whether an AI, algorithm or software tool was used in making each adverse decision.

This is the same design as California's SB 1120, and it sits on top of the federal CMS prior authorization rule for the government programme lines. Maryland adds nothing on provider side prior authorization automation: a practice using AI to assemble and submit authorisation requests is outside section 15-10B-05.1 entirely.

As a set of questions to put in every reconsideration request and grievance, because the statute gives the carrier a list of things it must be able to show.

Nothing in HB 820 gives a provider or patient a direct claim. Enforcement runs through the Maryland Insurance Administration, which certificates private review agents, approves utilization plans and can inspect the tool. What the statute does give you is leverage in the existing appeal channels under subtitles 10A and 10B, and a regulator that now collects data on AI involvement in every adverse decision.

In practice, when a denial arrives faster than a human could have read the chart, or cites criteria that ignore the clinical history you submitted, the reconsideration request should ask, in writing:

• whether an artificial intelligence, algorithm or other software tool was used in making the adverse decision, which the carrier now reports to the Commissioner quarterly;
• which individual clinical information in the enrollee's record the determination was based on, as section 15-10B-05.1(c)(1) requires;
• the name and licence of the physician reviewer who made the determination under section 15-10B-07, since the tool may not replace that role;
• whether the tool's use is described in the utilization plan on file with the Commissioner.

A denial that cannot answer those questions is a complaint to the Maryland Insurance Administration's Life and Health Complaints unit, and complaints are what drive market conduct examinations. A denial management workflow, human or automated, should template this language for Maryland payers. Track the outcomes: the AI involvement data in carriers' quarterly reports will appear in the Commissioner's annual summary, and a practice that can match its own denials against it is well placed for the 2027 session.

MODPA is the state privacy law most likely to reach a health AI deployment that HIPAA does not fully cover, and it has been enforceable since October 1, 2025.

The threshold is low. A controller that conducts business in Maryland or targets Maryland residents is covered if in the preceding calendar year it controlled or processed personal data of at least 35,000 consumers, or of at least 10,000 consumers while deriving more than 20 percent of gross revenue from selling personal data. Most regional health systems, most digital front door platforms and most AI vendors with a consumer facing surface clear that bar.

The exemptions are data level, not entity level. Section 14-4603 exempts protected health information under HIPAA, and information that is a medical record under Health-General section 4-301 if it is held by a HIPAA covered entity or business associate that applies HIPAA and section 4-301 standards to it. It does not exempt the hospital, the practice or the vendor as an organisation. Everything a covered entity or its vendor holds that is not PHI, such as website and app analytics, marketing lists, call centre metadata, chatbot transcripts from unauthenticated visitors and workforce data, is in scope.

Three MODPA provisions bite hardest on AI.

• Strictly necessary. Under section 14-4607, a controller may not collect, process or share sensitive data, which expressly includes consumer health data, unless strictly necessary to provide or maintain a specific product or service the consumer requested. Consent is required in addition, not instead. Training a model on Maryland consumer health data that was collected to deliver a service is hard to fit inside strictly necessary.
• No sale of sensitive data. The prohibition on selling sensitive data is absolute. No consent mechanism unlocks it.
• Consumer health data handling. Section 14-4604 bars giving employees, contractors or processors access to consumer health data without a duty of confidentiality and a compliant processor contract, and bars geofencing within 1,750 feet of a mental health or reproductive or sexual health facility to identify, track or message consumers about their health data.

Consumer health data is defined as personal data a controller uses to identify a consumer's physical or mental health status, and includes data related to gender affirming care and reproductive or sexual health care. Data protection assessments are required for processing that presents a heightened risk, including any processing of sensitive data, for activities on or after October 1, 2025.

For procurement, the practical test is contractual. Does the vendor's agreement meet the processor requirements in section 14-4608, does it prohibit secondary use and sale of Maryland data, and does it commit the vendor to support your consumer rights requests? Our vendor question list covers the HIPAA side; MODPA adds the non PHI side, and both belong in the same diligence pack.

Consent from everyone in the conversation, before recording starts, and documented. Maryland is an all party consent state and the rule is criminal.

Courts and Judicial Proceedings section 10-402(c)(3) makes it lawful for a party to intercept a wire, oral or electronic communication only where all of the parties have given prior consent. Willful interception, disclosure or use without that consent is a felony punishable by up to five years' imprisonment and a fine of up to ten thousand dollars, and section 10-410 gives the person recorded a civil action. Maryland courts apply the rule to private conversations where the parties have a reasonable expectation of privacy, and a clinical encounter is the paradigm case.

Three implications for AI deployments.

• Ambient scribes record. Whether or not the vendor retains audio, the interception happens in the room. The patient, and any family member or interpreter who speaks, must consent before the device is switched on. A one time consent on an intake form is defensible for a returning patient only if it is specific about recording and the patient is reminded; a spoken confirmation at the start of each visit, noted in the chart, is the safer pattern and it is what most Maryland health systems have adopted.
• AI phone agents record and transcribe. An opening announcement that the call is with an automated assistant and is recorded, delivered before any substantive exchange, is the minimum. The announcement should not be skippable and should repeat if a human takes over a call the agent started.
• Calls out of state. Maryland applies its law to calls with a Maryland party. Configure the agent to announce on every call rather than trying to detect location.

On telehealth, HB 869 (Chapter 482 of 2025) made permanent the coverage and payment requirements in Health-General section 15-141.2 and the Insurance Article, and Maryland's practice standards (COMAR 10.32.05 for physicians, with parallel regulations for other boards) require informed consent to telehealth and the same standard of care as in person. An AI agent that conducts a clinical intake by phone is not itself telehealth, but if a clinician then relies on that intake in a telehealth visit the consent conversation should cover both the AI collection and the telehealth modality. See the telehealth provider page for the general framework.

Nothing specific, as far as we can find. Checked September 2026: the Maryland Board of Physicians has published no AI guidance, position statement or newsletter article that we could locate on mbp.health.maryland.gov, and none of the other health occupations boards has adopted an AI rule. That absence is the point, not a gap: the existing rules apply unchanged.

Four of them do the work.

• Medical records. Health-General title 4 subtitle 3 governs the confidentiality, disclosure and retention of medical records, and Health Occupations section 14-404 lists failure to keep adequate medical records as grounds for discipline. A note drafted by an ambient scribe is the licensee's note the moment it is signed. Errors, hallucinated findings and omitted negatives are the physician's, and the Board will assess them as it assesses any record.
• Delegation. COMAR 10.32.12 governs delegation of acts by physicians. Software is not a delegatee, which means there is no framework under which an AI tool's output carries any authority of its own.
• Standard of care. The Board's practice standards, including the telehealth regulations in COMAR 10.32.05, require the same standard of care regardless of modality. Clinical decision support does not shift that.
• National guidance. The Federation of State Medical Boards' April 2024 statement on responsible incorporation of AI into clinical practice is what Maryland investigators are most likely to reference in the absence of a state document. It expects clinicians to understand the tools they use, to disclose AI use where it materially affects care, and to remain accountable for outputs.

The operational consequence is the same as in Texas, where SB 1188 wrote the review duty into statute: no AI generated content should reach the signed chart without clinician review, and the system should record who reviewed what and when. The scribe checklist sets out the workflow controls. If a patient later asks the Board why a note recorded a history they never gave, the answer will be judged on the record, and a review log is the only evidence that exists.

Nothing is pending in the technical sense: Maryland's General Assembly meets for 90 days from January, adjourned on April 13, 2026, and bills do not carry over. Everything below died and will have to be refiled for the 2027 session that opens in January.

Two things to draw from the table. First, the House has now passed behavioural health AI restrictions and a chatbot bill by wide margins, and the obstacle was time in the Senate rather than opposition. A behavioural health practice evaluating a patient facing AI product should assume HB 883's core rules arrive in some form in 2027 and buy accordingly. Second, the Workgroup on Artificial Intelligence Implementation created by HB 956 was due to report by July 1, 2026 on, among other things, enforcement authority for the Attorney General's Consumer Protection Division. We could not locate the report on a state site as of September 2026; if it recommends a general AI consumer protection statute, that becomes the 2027 vehicle. Our regulation tracker is updated as bills are prefiled.

Seven items. None requires a statute that has not passed, and together they cover HB 820, MODPA, the wiretap law and the Board's existing expectations.

1. Put consent before recording, everywhere. A spoken, documented consent at the start of every ambient scribe encounter and a non skippable recording announcement on every AI handled call. Section 10-402 is a felony statute and it does not care that the recorder was software.
2. Gate every AI drafted note behind clinician review and log it. The Board judges the record. A review timestamp and reviewer identity per note is the evidence.
3. Inventory which data your AI vendors touch that is not PHI. Website chat, call analytics, marketing and patient engagement data are inside MODPA. Confirm each vendor contract meets section 14-4608, prohibits sale and secondary use, and supports rights requests. Our vendor exposure tool is a quick first pass.
4. Write a data protection assessment for any AI processing consumer health data. MODPA requires it for sensitive data processing on or after October 1, 2025. One assessment per system, kept with the risk register, also serves as the NIST style documentation Texas and Colorado ask for.
5. Template HB 820 questions into your denial appeals. Ask whether an AI tool was used, which individual clinical information was relied on, and who the physician reviewer was. Escalate unanswered questions to the Maryland Insurance Administration.
6. Adopt a written AI policy that names the duty holders. Who approves a new tool, who reviews outputs, how patients are told, how vendors are assessed. Start from our AI policy template and localise the consent language to Maryland.
7. Watch the 2027 prefiles. HB 883 and HB 952 came within one committee vote of passage. If you run or plan any patient facing conversational AI, build to their disclosure and crisis protocol requirements now rather than retrofitting.

None of this is expensive relative to the alternative. The failure modes in Maryland are a recording nobody consented to, a note nobody reviewed, and a vendor contract that let Maryland consumer health data leave for a purpose the statute calls unnecessary. All three are procurement and configuration decisions, made once.

A single view of obligations that come from three different regulators, mapped to the systems you actually run, and a vendor assessment that is not written by the vendor.

Maryland's rules are fragmented by design: the Insurance Administration owns HB 820, the Attorney General's Consumer Protection Division owns MODPA, the health occupations boards own clinician conduct, and the wiretap statute is enforced by prosecutors and private plaintiffs. Vendors will tell you they are HIPAA compliant, which answers the smallest of the four questions. Nobody on the selling side has an incentive to tell you that their analytics module puts you inside MODPA, or that their phone agent's recording disclosure plays after the first question is asked.

Our AI governance and compliance engagement builds the inventory, the consent and disclosure specification, the data protection assessments and the review controls once, then maps them across Maryland, Colorado, Texas and California so the same evidence answers every regulator. For an organisation that has not yet chosen tools, the vendor selection service scores candidates against Maryland's consent and data rules before contracts are signed rather than after. We take no vendor commissions. If you are about to sign something in Maryland, book a call and bring the contract; the state AI law map is a useful read beforehand.