(b) The purpose of the Commission is to make recommendations to the Secretary regarding sensitive health services that should be determined by the Secretary to be legally protected health care under this subtitle.

(c) The Commission consists of the following members:

(1) The Attorney General or the Attorney General’s designee;

(2) The Executive Director of the Maryland Health Care Commission or the Executive Director’s designee; and

(3) The following members appointed by the Secretary:

(i) A resident of the State who is a licensed physician and nominated by the American College of Obstetricians and Gynecologists;

(ii) A resident of the State who is a licensed clinician who provides reproductive health care and nominated by the Reproductive Health Access Project;

(iii) A resident of the State who is a certified nurse-midwife nominated by the Maryland affiliate of the American College of Nurse Midwives;

(iv) A resident of the State who is a representative of Physicians for Reproductive Health;

(vi) Two residents of the State who are consumer representatives with expertise in consumer data privacy; and

(vii) A resident of the State with expertise in health information.

(d) The Commission shall:

(1) Select a chair of the Commission each year; and

(2) Meet at least four times a year.

(e) The Department shall provide staff for the Commission.

(f) (1) The Commission shall identify sensitive health services information by diagnosis, procedural, medication, or related codes for which disclosure by a health information exchange or electronic health network to a treating provider, business entity, another health information exchange, or another electronic health network would create a substantial risk to patients or health care providers.

(2) In carrying out its work, the Commission may consult with:

(i) Organizations with expertise in legal issues impacting providers of legally protected health care;

(ii) Organizations with expertise in consumer health privacy;

(iii) Organizations with expertise in health information technology; and

(iv) Other organizations with clinical, policy, or legal expertise related to the work of the Commission.

(g) (1) The Commission shall issue semiannual reports to the Secretary on recommendations regarding sensitive health services that should be determined by the Secretary to be legally protected health care under this subtitle or for which the Secretary should rescind a previous determination.

(2) The reports shall include an assessment of the potential risk to patients and health care providers that would result from the disclosure of the sensitive health services that are addressed in the reports.

(3) Within 60 days after receiving a semiannual report under paragraph (1) of this subsection, the Secretary shall submit a written response to the report that includes the findings and determinations of the Secretary to:

(i) The Commission; and

(ii) In accordance with § 2-1257 of the State Government Article, the Senate Finance Committee and the House Health and Government Operations Committee.