Md. Code, Commercial Law § 14–4704

A person may not:

(1) Provide an employee or a contractor access to consumer health data unless:

(i) The employee or contractor is subject to a contractual or statutory duty of confidentiality; or

(ii) Confidentiality is required as a condition of employment of the employee;

(2) Provide a processor access to consumer health data unless the person providing access to the consumer health data and the processor comply with § 14–4708 of this subtitle; or

(3) Use a geofence to establish a virtual boundary that is within 1,750 feet of any mental health facility or reproductive or sexual health facility for the purpose of identifying, tracking, or collecting data from, or sending any notification to a consumer regarding the consumer’s consumer health data.