(a) (1) In this section the following words have the meanings indicated.

(2) “Health care” means care, services, or supplies related to the health of an individual that includes the following:

(i) preventative, diagnostic, therapeutic, rehabilitative, maintenance care, palliative care and counseling, service assessment, or procedure:

1. with respect to the physical or mental condition or functional status of an individual; or

2. that affects the structure or function of the body; and

(ii) the sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription.

(3) “Health information” means any information, whether oral or recorded in any form or medium, that:

(i) is created or received by:

1. a health care provider;

2. a health care carrier;

3. a public health authority;

4. an employer;

5. a life insurer;

6. a school or university; or

7. a health care clearinghouse; and

(ii) relates to the:

1. past, present, or future physical or mental health or condition of an individual;

2. provision of health care to an individual; or

3. past, present, or future payment for the provision of health care to an individual.

(4) “Interactive computer service” means an information service, system, or access software provider that provides or enables computer access by multiple users to a computer server, including a system that provides access to the Internet and cellular phones.

(5) “Payment device number” has the meaning stated in § 8-213 of this title.

(6) (i) “Personal identifying information” includes a name, address, telephone number, driver’s license number, Social Security number, place of employment, employee identification number, health insurance identification number, medical identification number, mother’s maiden name, bank or other financial institution account number, date of birth, personal identification number, unique biometric data, including fingerprint, voice print, retina or iris image or other unique physical representation, digital signature, credit card number, or other payment device number.

(ii) “Personal identifying information” may be derived from any element in subparagraph (i) of this paragraph, alone or in conjunction with any other information to identify a specific natural or fictitious individual.

(7) “Re-encoder” means an electronic device that places encoded personal identifying information or a payment device number from the magnetic strip or stripe of a credit card onto the magnetic strip or stripe of a different credit card or any electronic medium that allows such a transaction to occur.

(8) “Skimming device” means a scanner, skimmer, reader, or any other electronic device that is used to access, read, scan, obtain, memorize, or store, temporarily or permanently, personal identifying information or a payment device number encoded on the magnetic strip or stripe of a credit card.

(b) A person may not knowingly, willfully, and with fraudulent intent possess, obtain, or help another to possess or obtain any personal identifying information of an individual, without the consent of the individual, in order to use, sell, or transfer the information to get a benefit, credit, good, service, or other thing of value or to access health information or health care.

(b-1) A person may not maliciously use an interactive computer service to disclose or assist another person to disclose the driver’s license number, bank or other financial institution account number, credit card number, payment device number, Social Security number, or employee identification number of an individual, without the consent of the individual, in order to annoy, threaten, embarrass, or harass the individual.

(c) A person may not knowingly and willfully assume the identity of another, including a fictitious person:

(1) to avoid identification, apprehension, or prosecution for a crime; or

(2) with fraudulent intent to:

(i) get a benefit, credit, good, service, or other thing of value;

(ii) access health information or health care; or

(iii) avoid the payment of debt or other legal obligation.

(d) A person may not knowingly, willfully, and with fraudulent intent to obtain a benefit, credit, good, service, or other thing of value or to access health information or health care, use:

(1) a re-encoder to place information encoded on the magnetic strip or stripe of a credit card onto the magnetic strip or stripe of a different credit card or use any other electronic medium that allows such a transaction to occur without the consent of the individual authorized to use the credit card from which the personal identifying information or payment device number is being re-encoded; or

(2) a skimming device to access, read, scan, obtain, memorize, or store personal identifying information or a payment device number on the magnetic strip or stripe of a credit card without the consent of the individual authorized to use the credit card.

(e) A person may not knowingly, willfully, and with fraudulent intent possess, obtain, or help another possess or obtain a re-encoder device or a skimming device for the unauthorized use, sale, or transfer of personal identifying information or a payment device number.

(f) A person may not knowingly and willfully claim to represent another person without the knowledge and consent of that person, with the intent to solicit, request, or take any other action to otherwise induce another person to provide personal identifying information or a payment device number.

(g) (1) (i) A person who violates this section where the benefit, credit, good, service, health information or health care, or other thing of value that is the subject of subsection (b), (c), or (d) of this section has a value of at least $1,500 but less than $25,000 is guilty of a felony and on conviction is subject to imprisonment not exceeding 5 years or a fine not exceeding $10,000 or both.

(ii) A person who violates this section where the benefit, credit, good, service, or other thing of value that is the subject of subsection (b), (c), or (d) of this section has a value of at least $25,000 but less than $100,000 is guilty of a felony and on conviction is subject to imprisonment not exceeding 10 years or a fine not exceeding $15,000 or both.

(iii) A person who violates this section where the benefit, credit, good, service, or other thing of value that is the subject of subsection (b), (c), or (d) of this section has a value of $100,000 or more is guilty of a felony and on conviction is subject to imprisonment not exceeding 20 years or a fine not exceeding $25,000 or both.

(2) A person who violates this section where the benefit, credit, good, service, health information or health care, or other thing of value that is the subject of subsection (b), (c), or (d) of this section has a value of at least $100 but less than $1,500 is guilty of a misdemeanor and on conviction is subject to imprisonment not exceeding 1 year or a fine not exceeding $500 or both.

(3) A person who violates this section under circumstances that reasonably indicate that the person’s intent was to manufacture, distribute, or dispense another individual’s personal identifying information without that individual’s consent is guilty of a felony and on conviction is subject to imprisonment not exceeding 10 years or a fine not exceeding $25,000 or both.

(4) A person who violates subsection (b-1), (c)(1), (e), or (f) of this section is guilty of a misdemeanor and on conviction is subject to imprisonment not exceeding 1 year or a fine not exceeding $500 or both.

(5) When the violation of this section is pursuant to one scheme or continuing course of conduct, whether from the same or several sources, the conduct may be considered as one violation and the value of the benefit, credit, good, service, or other thing of value may be aggregated in determining whether the violation is a felony or misdemeanor.

(h) A person described in subsection (g)(2) or (4) of this section is subject to § 5-106(b) of the Courts Article.

(i) In addition to restitution under Title 11, Subtitle 6 of the Criminal Procedure Article, a court may order a person who pleads guilty or nolo contendere or who is found guilty under this section to make restitution to the victim for reasonable costs, including reasonable attorney’s fees, incurred:

(1) for clearing the victim’s credit history or credit rating;

(2) for clearing the victim’s record or history related to health information or health care; and

(3) in connection with a civil or administrative proceeding to satisfy a debt, lien, judgment, or other obligation of the victim that arose because of the violation.

(j) A sentence under this section may be imposed separate from and consecutive to or concurrent with a sentence for any crime based on the act or acts establishing the violation of this section.

(k) Notwithstanding any other law, the Department of State Police may initiate investigations and enforce this section throughout the State without regard to any limitation otherwise applicable to the Department’s activities in a municipal corporation or other political subdivision.

(l) (1) Notwithstanding any other law, a law enforcement officer of the Maryland Transportation Authority Police, the Maryland Port Administration Police, the Park Police of the Maryland-National Capital Park and Planning Commission, or a municipal corporation or county may investigate violations of this section throughout the State without any limitation as to jurisdiction and to the same extent as a law enforcement officer of the Department of State Police.

(2) The authority granted in paragraph (1) of this subsection may be exercised only in accordance with regulations that the Department of State Police adopts.

(3) The regulations are not subject to Title 10, Subtitle 1 of the State Government Article.

(4) The authority granted in paragraph (1) of this subsection may be exercised only if an act related to the crime was committed in the investigating law enforcement agency’s jurisdiction or if the complaining witness resides in the investigating law enforcement agency’s jurisdiction.

(m) If action is taken under the authority granted in subsection (l) of this section, notification of an investigation:

(1) in a municipal corporation, shall be made to the chief of police or designee of the chief of police;

(2) in a county that has a county police department, shall be made to the chief of police or designee of the chief of police;

(3) in a county without a police department, shall be made to the sheriff or designee of the sheriff;

(4) in Baltimore City, shall be made to the Police Commissioner or the Police Commissioner’s designee;

(5) on property owned, leased, or operated by or under the control of the Maryland Transportation Authority, the Maryland Aviation Administration, or the Maryland Port Administration, shall be made to the respective chief of police or the chief’s designee; and

(6) on property owned, leased, or operated by or under the control of the Maryland-National Capital Park and Planning Commission, to the chief of police of the Maryland-National Capital Park and Planning Commission for the county in which the property is located.

(n) When acting under the authority granted in subsection (k) or (l) of this section, a law enforcement officer:

(1) in addition to any other immunities and exemptions to which the officer may be entitled, has the immunities from liability and exemptions accorded to a law enforcement officer of the Department of State Police; but

(2) remains an employee of the officer’s employing agency.

(o) (1) A State’s Attorney or the Attorney General may investigate and prosecute a violation of this section or a violation of any crime based on the act establishing a violation of this section.

(2) If the Attorney General exercises authority under paragraph (1) of this subsection, the Attorney General has all the powers and duties of a State’s Attorney, including the use of a grand jury in any county or Baltimore City, to investigate and prosecute the violation.

(p) Notwithstanding any other provision of law, the prosecution of a violation of this section or for a violation of any crime based on the act establishing a violation of this section may be commenced in any county in which:

(1) an element of the crime occurred; or

(2) the victim resides.