COMAR 10.07.05 Residential Service Agency Requirements

To operate a residential service agency in Maryland, you need a three-year license from the Department of Health’s Office of Health Care Quality, and you have to keep meeting the Maryland residential service agency requirements set out in COMAR 10.07.05 for as long as you hold that license. The rules cover ownership, staffing, training, client assessments, clinical records, inspections, and the penalties for getting any of it wrong.

Who Needs an RSA License

A residential service agency is any nongovernmental business that employs or contracts with people to provide home health care, for compensation, to an unrelated sick or disabled person in that person’s home.¹ That covers agencies that hire caregivers directly and agencies that contract with independent providers.

Some operations are excluded and licensed under different frameworks: licensed home health agencies under Subtitle 4, hospice programs, hospitals, nursing referral service agencies, and individual practitioners authorized under the Health Occupations Article.¹ If you fit one of those, you need a different license, not this one.

What the License Application Requires

COMAR 10.07.05.04 lays out the application package. You file on the Department’s form and submit:

Identification of every individual or corporate owner with a 25 percent or greater interest, plus additional ownership details on a Department addendum.
Disclosure of any prior license denial, suspension, or revocation, and any criminal charges, convictions, or Medicare or Medicaid findings against the applicant or owners.
A one-year operating budget, a marketing plan identifying the populations you intend to serve, and a description of the services the agency will provide.
Copies of the agency’s internal policies and procedures.
Proof of workers’ compensation coverage for all employees.

The applicant or corporate representative must be at least 21. You also have to disclose any health occupation license or certification you hold and any prior experience running a similar health care program.²

The Fee Question

The regulation text sets a nonrefundable license fee of $1,000 for a three-year license.² The Department’s current application form, updated in April 2026, states there is no fee to apply.³ Because the two sources conflict, confirm the current fee with the Office of Health Care Quality before you file.

Who Can’t Get Licensed

If an applicant, owner, or anyone holding a 25 percent or greater interest has had a license suspended or revoked by the Department, that person is barred from owning, operating, or managing another agency for 10 years. After the 10 years pass, the applicant still has to show evidence of the ability to operate within the law. The Department can also deny licensure based on a history of regulatory violations or a criminal history it determines could harm clients.²

Existing licensees that have had sanctions imposed within the past two years can’t apply to open additional locations until they are fully compliant.²

License Term and Renewal

The license runs three years from the date of issuance, unless it’s surrendered, suspended, or revoked, or unless the Department issues a provisional license with a shorter term. Renewal takes a renewal application and a nonrefundable $1,000 renewal fee for the next three years.² File the renewal before the license expires. Continuing to operate on a lapsed license exposes the agency to the civil and criminal penalties described below.

Personnel and Background Checks

Every agency needs a designated administrator responsible for day-to-day operations and compliance. Agencies providing skilled care must have a registered nurse who assesses each new client needing skilled services, participates in the care plan, assigns appropriate personnel, and helps train the people delivering care.⁴

Every employee, independent contractor, and contractual employee who works with clients has to undergo a state criminal history records check. The check is fingerprint-based, processed through the Criminal Justice Information System, and maintained in state and FBI databases.⁵ Keep the background check record, along with the rest of the employment file, at the agency’s business office.⁶

Caregiver Training Minimums

Before referring anyone to a client’s home, the agency has to train them in at least the following areas:

Personal care skills, with instruction and supervised practice.
Recognizing changes in a client’s condition serious enough to require a registered nurse.
CPR certification.
Standard infection-control precautions.
Identifying and preventing abuse and neglect.
Documentation, ethics, and confidentiality.

⁷

You can use outside training sources, but only with written approval from the Office of Health Care Quality. Each caregiver has to complete a skills assessment and demonstrate competency before being sent to a client, and the training record goes in the personnel file.⁷

Client Assessments and Care Plans

Every client needs a plan of care built on an assessment of health, functional ability, and psychosocial condition. For clients needing skilled services or help with activities of daily living, a registered nurse must do the initial assessment. The care plan has to spell out the services provided, the schedule and frequency, who delivers them, short- and long-range goals, and safety measures.⁴

Assessments usually have to be finished before services start. For complex care like wound treatment, ventilator services, or infusion therapy, the assessment must be done within 48 hours of when services start. Reassess at least once a year, whenever the client or client representative asks, and whenever the client’s condition changes significantly.⁴

A competent adult client, or a client representative with legal authority to make health care decisions, may consent to changes in the recommended plan.⁴

Client Representatives

Agencies have to recognize the authority of guardians of the person or property, individuals designated under an advance directive or power of attorney, surrogate decision makers, representative payees, and any other person a competent client designates. The authority isn’t unlimited. If the person tries to act beyond the scope of the legal instrument or beyond what state law allows, the agency can’t recognize the action. Document the representative’s name in the client’s record along with the supporting legal paperwork.⁸

Clinical Records and Retention

Every client needs a clinical record kept secure and confidential. For clients receiving skilled services, the record must contain the nurse’s assessment, current health care orders, rehabilitation plans if any, medication details (dosage, route, and frequency), allergy and sensitivity history, dietary plans, the active care plan, care notes written at admission and at least weekly (plus on any significant change), contact information for the client’s physicians and representative, discharge directions, and a discharge summary with the reason for discharge.⁹

For clients who don’t need certified caregivers or skilled services, the record is shorter but still requires a nursing assessment, plan of care, service documentation, and notes on any significant change. Notes have to be detailed, legible, chronological, dated, and signed with the name and title of whoever provided the service.⁹

Records must be kept for five years after discharge. For a client under 18, keep the record until the client turns 21 or for five years after the record was created, whichever is later. Release medical records or information only with written consent from the client or client representative, or as otherwise permitted under Maryland’s health information privacy statutes. Safeguard records against loss, destruction, and unauthorized use. If the agency closes, either return records to the client or client representative or retain them for the full period.¹⁰

Discharged records must be completed within 30 days. Current client files, files for clients discharged within the past 12 months, current and recently departed staff files, and quality assurance records all stay on site. Other records can live off site but have to be produced for Department review within 24 hours.¹⁰

Inspections

After you apply, the Department conducts an on-site survey to verify readiness. Inspectors review records, staffing documentation, policies, and the physical office. All records and reports must be open to inspection, and you have to provide copies immediately on request.¹⁰ If the agency fails to comply during the pre-licensure visit and the Department has to come back for additional visits, it may deny the license outright.²

Sanctions and Penalties

The Secretary may suspend or revoke a license when a licensee violates a condition or requirement of an imposed sanction. In emergencies where public health, safety, or welfare is at immediate risk, the Secretary may suspend a license without prior notice. The Secretary may also deny, revoke, or refuse to reissue any license for cause, including inability or failure to comply with the chapter.¹¹

Making changes that affect the operating license without following the notification process in COMAR 10.07.05.05 costs up to $500 per violation.¹¹

Operating Without a License

Unlicensed operation carries the steepest penalties. The Department may impose a civil penalty of up to $10,000 per violation. Unlicensed operation is also a misdemeanor, with a criminal fine of up to $1,000 for the first offense and up to $10,000 for each subsequent offense. Each day the violation continues after the first conviction counts as a separate offense.¹¹

Federal Rules That Also Apply

Agencies participating in Medicare or Medicaid have to meet federal conditions of participation as well, including the Home Health Quality Reporting Program, the Home Health Value-Based Purchasing model, and compliance with the Outcome and Assessment Information Set for standardized patient assessments.¹²

Federal emergency-preparedness rules require participating agencies to maintain an emergency plan, a communication plan, written policies and procedures for disaster response, and a testing program, coordinated with federal, state, and local emergency systems.¹³

HIPAA covers agencies handling electronic protected health information. The Security Rule calls for risk assessments, IT asset inventories, patching known software vulnerabilities, and security measures that bring identified risks down to a reasonable level.¹⁴ Those obligations overlap directly with COMAR’s demand for safeguards against loss, destruction, and unauthorized access to clinical records.

1
Maryland General Assembly. Maryland Health-General Code Section 19-4A-01 – Definitions
2
Library of Maryland Regulations. COMAR 10.07.05.04 – Licensing Procedures
3
Maryland Department of Health. Application for a Residential Service Agency License
4
Legal Information Institute. Maryland Code of Regulations 10.07.05.12 – Services Provided
5
Maryland Board of Nursing. Criminal History Records Check
6
Code of Maryland Regulations. COMAR 10.07.05.10 – Employee, Independent Contractor, and Contractual Employee Requirements
7
Legal Information Institute. Maryland Code of Regulations 10.07.05.11 – Training
8
Legal Information Institute. Maryland Code of Regulations 10.07.05.13 – Client Representative
9
Legal Information Institute. Maryland Code of Regulations 10.07.05.14 – Clinical Records
10
Library of Maryland Regulations. COMAR 10.07.05.15 – Maintenance of Records
11
Library of Maryland Regulations. Chapter 05 Residential Service Agencies
12
Centers for Medicare & Medicaid Services. Home Health Agency Center
13
Centers for Medicare & Medicaid Services. Emergency Preparedness Rule
14
U.S. Department of Health & Human Services. January 2026 OCR Cybersecurity Newsletter