(a) The Maryland Health Care Commission shall adopt regulations for the privacy and security of protected health information obtained or released through a health information exchange.
(b) The regulations adopted under subsection (a) of this section shall:
(1) Govern the access, use, maintenance, disclosure, and redisclosure of protected health information as required by State or federal law, including the federal Health Insurance Portability and Accountability Act and the federal Health Information Technology for Economic and Clinical Health Act; and
(2) Include protections for the secondary use of protected health information obtained or released through a health information exchange.
(c) Data obtained or released through a health information exchange:
(1) May not be sold for financial remuneration until the regulations required under subsections (a) and (b) of this section are adopted; and
(2) May be sold for financial remuneration only in accordance with the regulations adopted under subsections (a) and (b) of this section.
(d) The Maryland Health Care Commission shall consult with health care providers, payors, State health agencies, consumer advocates, and employers before adopting regulations under subsections (a) and (b) of this section.