Md. Code, General Provisions § 4–314

(a) Subject to subsection (b) of this section, a custodian shall deny inspection of any record disclosing:

(1) the name of an account holder or a qualified beneficiary of a prepaid contract under Title 18, Subtitle 19 of the Education Article; or

(2) the name of an account holder or a qualified designated beneficiary of an investment account under Title 18, Subtitle 19A of the Education Article.

(b) A custodian:

(1) shall allow inspection by a person in interest; and

(2) may release information to an eligible institution of higher education designated:

(i) by an account holder of a prepaid contract or a qualified beneficiary under Title 18, Subtitle 19 of the Education Article; or

(ii) by an account holder or a qualified designated beneficiary under Title 18, Subtitle 19A of the Education Article.