Sen. Katie Hester

Maddy summarySB 600 modifies Maryland's sales tax definition to exclude certain business-to-business technology service sales from taxation. It specifically exempts sales of data/information technology services (NAICS 518, 519) and software publishing services (NAICS 5132) when: (1) buyers intend to incorporate them into other taxable services for resale, or (2) vendors and buyers are affiliated entities. This affects businesses selling or purchasing these technology services, removing sales tax liability for qualifying transactions. The bill clarifies existing tax rules rather than creating new taxes, effective July 1, 2026.

Maddy summarySB 563 adds crisis pregnancy clinics to Maryland’s definition of "health care provider" under confidentiality laws. This means these clinics must now follow the same medical record privacy rules as hospitals, clinics, and other healthcare facilities. The bill specifically covers clinics providing pregnancy-related care, including mobile facilities, even if they’re not subject to federal HIPAA rules. It applies directly to crisis pregnancy clinics operating in Maryland, requiring them to protect patient records like other healthcare providers. The law takes effect October 1, 2026.

Maddy summarySB 183 establishes the Maryland Cyber Reserve as a new component of Maryland's organized militia under the Military Department. It directly affects state and local government agencies, critical infrastructure operators, and later may support corporations or citizens targeted by cyber attacks. The bill creates a formal structure for the reserve, including a commanding general appointed by the Adjutant General, with its primary mission focused on preventing and resolving cyber attacks through educational and technical support. Members will receive workers' compensation coverage during training and active duty, and the reserve operates separately from the National Guard. The bill amends Maryland law to define the reserve's authority, enlistment requirements, and operational responsibilities.

Maddy summarySB 121 would create a program allowing specific public servants and their immediate family members (including prosecutors, law enforcement officers, elected officials, and their spouses/children) to request that government entities or individuals remove their personal information - including home addresses, phone numbers, Social Security numbers, and license plate details - from public online platforms like government websites or social media. The bill requires government entities to remove such information within 72 hours of a written request and establishes legal remedies, including injunctions and attorney fees, for violations. It also imposes criminal penalties for knowingly publishing protected individuals' personal information. This bill, currently pre-filed and awaiting committee hearings, does not yet apply as law.

Maddy summaryThis bill (SB 2) restricts investor-owned electric, gas, and combined gas/electric utility companies in Maryland from recovering certain costs through customer rates. It prohibits rate recovery for employee bonuses (except those approved before December 2025 or in collective bargaining agreements) and limits recovery of supervisor compensation exceeding a set amount. The bill also requires utility boards to adopt company-wide policies capping spending on entertainment, office renovations, transportation (including private planes), staff development, and performance incentives. These changes take effect October 1, 2026.

Maddy summarySB 705 requires Maryland's Department of Information Technology to establish specific oversight procedures for major information technology development projects. This law directly affects the Department of Information Technology and state agencies implementing large-scale IT systems. The key provision mandates the department to create and follow defined processes for monitoring project scope, budget, and timelines. The bill became law on May 25, 2025, under Maryland's Constitution.

Maddy summarySB 294 changes how the Maryland Cybersecurity Council is led and who serves on it. Starting October 1, 2025, the Council will elect its own chair every two years instead of the Attorney General serving as chair. The bill adds specific membership requirements, including five cybersecurity company representatives (with at least three from small companies under 50 employees), four business association representatives, and up to ten higher education representatives. This directly affects small cybersecurity firms, business associations, and educational institutions that will now have formal representation on the Council.

Maddy summarySB 357 creates a process for Maryland's Prescription Drug Affordability Board to set price limits ("upper payment limits") on prescription drugs causing affordability challenges for Marylanders. The Board must consider costs like administration and delivery when setting limits, and must reconsider or suspend limits if a drug faces a shortage (defined as appearing on the federal shortage list or determined by the Board). The bill prohibits applying these limits to drugs on federal shortage lists, Medicare Part C/D reimbursements, or pharmacy dispensing fees. This directly affects all Maryland residents using prescription drugs, insurers, and health plans through changes to how drug costs are managed in the state.

Maddy summarySB 369, the "Raymono A. Russell Act," requires public libraries in Maryland (excluding school libraries) to place an automated external defibrillator (AED) in a visible, accessible location, maintain its functionality, and ensure a staff member trained in AED use is present during all open hours starting January 1, 2026. The bill specifically includes state libraries, regional systems (like Enoch Pratt in Baltimore), and specialized libraries (e.g., for the blind or deaf), but explicitly excludes school library media programs. It also grants legal immunity to libraries and trained individuals for using AEDs under the law’s requirements. This is a direct safety mandate targeting public library operators, not a procedural or commemorative measure.

Maddy summarySB 691 requires Maryland healthcare entities - including hospitals, health information exchanges, and freestanding medical facilities - to adopt strong cybersecurity standards (including a "zero-trust" approach), undergo third-party audits every two years starting in 2026, and report incidents to the state's Security Operations Center. It mandates the Maryland Health Care Commission to hire a cybersecurity expert and convene two workgroups focused on reviewing threats, responses to disruptions, and making recommendations for improvement. The law applies specifically to defined "healthcare ecosystem entities" but excludes insurance carriers and pharmacy benefits managers. These requirements aim to strengthen cybersecurity practices across critical healthcare infrastructure.