Besides begging and pleading, the only sword lawyers have in collecting medical records is § 4-309(a) of the Health-General Article of the Maryland Code. This statute requires health care providers to produce the records with a HIPAA authorization. This statute provides that: If a health care provider knowingly refuses to disclose a medical record within a reasonable time but no more than 21 working days after the date a person in interest requests the disclosure, the health care provider is liable for actual damages.