Md. Code, Commercial Law § 14–4402

This subtitle does not apply to:

(1) Protected health information that is collected by a covered entity or business associate as defined in 45 C.F.R. Parts 160 and 164; or

(2) Genetic data or biological samples collected for the purpose of research, as defined in 45 C.F.R. 164.501, that is conducted in accordance with:

(i) The federal policy for the protection of human subjects established in 45 C.F.R. Part 46;

(ii) The Good Clinical Practice Guidelines issued by the International Council for Harmonisation; or

(iii) The U.S. Food and Drug Administration Protection of Human Subjects under 21 C.F.R. Parts 50 and 56.