Individual notice deadline
Without unreasonable delay, subject to (i) delay reasonably necessary to determine the scope of the security breach and restore the reasonable integrity of the database, and (ii) law-enforcement delay. No numeric outer bound in the current text.
The statute sets no numeric outer bound. It is shown for context: a HIPAA covered entity is outside this section, so HIPAA's own 60-day individual-notice window is the operative deadline.
Source: Mich. Comp. Laws § 445.72(1), (4)
Statewide rules that also reach dermatology practices
Duty to keep an accurate record
A licensee shall keep and maintain a record for each patient for whom the licensee has provided medical services, including a full and complete record of tests and examinations performed, observations made, and treatments provided. Where a medical service involves the vaginal or anal penetration of the patient, the licensee shall expressly state in the record that vaginal or anal penetration was performed, unless the service falls within one of the four stated exclusions. Records must be maintained so as to protect their integrity, ensure their confidentiality and proper use, and ensure their accessibility and availability to each patient or the patient's authorized representative as required by law.
What this means operationally
Michigan states the duty to create the record and the standard it must be held to in one place, and both reach every professional licensed under article 15 — so this is the baseline a dentist, optometrist, physical therapist and physician all work from. The penetration-documentation requirement is an express content rule rather than a matter of clinical style: the record must SAY that penetration was performed, and the four exclusions are narrow and defined in the statute rather than left to judgment.
Applies when
- A licensee has provided medical services to a patient
Exceptions
- The penetration-documentation requirement does not apply to services primarily relating to urological, gastrointestinal, reproductive, gynecological or sexual health; services necessary and incident to a medical emergency; rectal administration of a drug; or measuring temperature
How long the record must be kept
Unless a longer retention period is otherwise required under federal or state law or regulation, or by generally accepted standards of medical practice, a licensee shall keep and retain each patient record for a minimum of 7 years FROM THE DATE OF SERVICE to which the record pertains.
What this means operationally
Michigan states both the duration and the trigger, which sets it apart from the Illinois dental and optometry rules that give a period and leave the clock-start unsaid. Measuring from the date of service rather than from last treatment means a long-running course of care produces records that age out at different times, so the destruction question is per-encounter rather than per-patient. Note the opening clause: seven years is a FLOOR that yields to any longer federal, state or professional-standard period.
Applies when
- A licensee holds a patient record under § 16213(1)
Exceptions
- A longer period required by federal or state law or regulation, or by generally accepted standards of medical practice, prevails
- Records of services involving vaginal or anal penetration carry a 15-year period under § 16213(2)(b)
Parental right of access
Except as otherwise provided by law or regulation, a patient or the patient's authorized representative has the right to examine or obtain the patient's medical record. The requester must submit a WRITTEN request, signed and dated not more than 60 days before it is submitted, to the health care provider or health facility that maintains the record.
What this means operationally
The staleness rule on the request itself is the unusual feature and it cuts both ways: a request signed more than 60 days before it arrives does not meet the section, so a practice receiving an old form is entitled to ask for a fresh one — and a practice sending forms to patients should not expect them back indefinitely. Michigan puts access in a separate act from the retention duties, so a practice working only from the Public Health Code will not find this.
Applies when
- A patient or authorized representative submits a signed, dated written request
Exceptions
- Except as otherwise provided by law or regulation
Deadline to respond to an access request
On receipt of a request, the provider or facility shall, as promptly as required under the circumstances but not later than 30 days after receipt — or not later than 60 days where the record is not maintained or accessible on-site — do one or more of the following: make the record available for inspection or copying at its business location during regular business hours, or provide a copy as requested; transmit the request to a person or medical records company holding the records under contract and either retrieve the record or require that company to comply; inform the requester that the record does not exist or cannot be found; inform the requester that it does not hold the record and give the name and address, if known, of the provider or facility that does; or, where it determines that disclosure is likely to have an ADVERSE EFFECT on the patient, provide a clear statement supporting that determination and provide the record to another provider, facility or legal counsel designated by the patient or representative.
What this means operationally
Thirty days, extending to sixty only on a factual condition — the record not being maintained or accessible on-site — rather than on a request for more time. Michigan then enumerates five compliant responses, which is more useful than a bare deadline: telling the patient the record cannot be found, or that another provider holds it, are complete answers within the period. The adverse-effect route does not permit withholding; it redirects the record to a clinician or lawyer the PATIENT designates, and requires a clear written statement supporting the determination.
Applies when
- A conforming written request has been received
Exceptions
- 60 days where the record is not maintained or accessible on-site
Limit on copy fees, format or delivery
A provider, facility or medical records company may charge no more than: an initial fee of $20.00 per request; paper copies at $1.00 per page for the first 20 pages, 50 cents for pages 21 to 50 and 20 cents for pages 51 and over; for a record in a form other than paper, the actual cost of preparing a duplicate; postage or shipping actually incurred; and actual costs of retrieving records 7 YEARS OLD OR OLDER that are not maintained or accessible on-site. It may refuse to retrieve or copy until the applicable fee is paid. No other fee for retrieving, copying or mailing may be charged. All fees must be WAIVED for a medically indigent individual, limited to one set of copies per provider, facility or company, with further requests subject to the ordinary fees. NOTWITHSTANDING the schedule, no initial fee may be charged to A PATIENT for the patient's own record. The department adjusts the amounts annually by the Detroit consumer price index.
What this means operationally
Two carve-outs sit inside the schedule and both favor the patient. The $20 initial fee cannot be charged to the patient for their own record at all — it survives only for other authorized requesters — and all fees are waived outright for a medically indigent individual, with proof of assistance permitted to be required. The retrieval charge is keyed to the record being seven years or older AND off-site, which lines up with the seven-year retention floor in the Public Health Code. Note the published figures are a floor for accuracy rather than the operative numbers: the department adjusts them annually for inflation.
Applies when
- A copy of a medical record is requested under § 26265
Exceptions
- No initial fee may be charged to the patient for the patient's own record
- All fees waived for a medically indigent individual, limited to one set of copies
- Amounts are adjusted annually by the department for the Detroit consumer price index
Destruction or disposition requirement
A licensee may destroy a patient record that is LESS THAN 7 YEARS OLD only if the licensee both sends written notice to the patient at the patient's last known address informing them that the record is about to be destroyed, offering the opportunity to request a copy, and requesting written authorization to destroy it, AND receives written authorization from the patient or the patient's authorized representative agreeing to the destruction. That route is not available at all for a record of a service within § 16213(2)(b). Records other than those may be destroyed or otherwise disposed of after being maintained for 7 years, and records within § 16213(2)(b) after 15 years. Where records are destroyed they must be shredded, incinerated, electronically deleted, or otherwise disposed of in a manner that ensures continued confidentiality of the patient's health care and personal information.
What this means operationally
One of the few jurisdictions that legislates destruction rather than leaving it to be inferred from a retention period ending — and the two halves point in opposite directions. Early destruction is possible but only with the patient's WRITTEN authorization actually received; silence does not suffice, so a notice sent and ignored leaves the record in place. After the period runs, destruction is permitted rather than required, and the METHOD is prescribed: shredding, incineration, electronic deletion or an equivalent that preserves confidentiality. The department can step in where disposal was improper and assess its costs against the licensee.
Applies when
- A licensee proposes to destroy or dispose of a patient record
Exceptions
- The early-destruction route is unavailable for records of services within § 16213(2)(b)
- A longer period required by other law or by generally accepted standards of medical practice prevails
Custody on closure or transfer
If a licensee sells or closes their practice, retires, or otherwise ceases to practice under article 15, the licensee — or the personal representative if the licensee is deceased — SHALL NOT ABANDON the records, and shall send written notice to the department specifying who will have custody of the medical records and how a patient may request access to or copies of them. The licensee shall also either transfer the records to a successor licensee, or at the patient's request to the patient or a specified health facility or other licensed provider, or to a provider, facility or medical records company under a records agreement; OR destroy them, having sent written notice to the last known address of each patient giving the patient 30 DAYS to request a copy or designate a transfer destination and requesting written authorization for destruction. If the patient does not respond, records less than 7 years old may not be destroyed, though records 7 years or older may be destroyed under § 16213(8).
What this means operationally
Michigan is unusually complete on closure and it binds the estate as well as the practitioner — the personal representative of a deceased licensee carries the same duty, which is the case most practices never plan for. Two obligations run together: a notice to the DEPARTMENT naming the custodian and the route to records, and a disposition of the records themselves. The patient-notice branch gives 30 days and treats silence conservatively: no response means the records survive if they are under seven years old. Note the notice to the department is about custody rather than closure, so it has to name a person or entity who will actually hold the records.
Applies when
- A licensee sells or closes the practice, retires, or otherwise ceases to practice under article 15
- Or the licensee has died and a personal representative is acting
Exceptions
- Records within § 16213(2)(b) may be destroyed only in accordance with § 16213(8)
Custody on closure or transfer
If a licensee is unable to comply with § 16213, the licensee shall employ, or contract, arrange or enter into an agreement with, another health care provider, a health facility or agency, or a medical records company to protect, maintain and provide access to the records required under § 16213(1).
What this means operationally
A standing obligation rather than a closure step, and the one that quietly makes the rest of the section workable for a small practice: inability to hold records to the statutory standard is not a defense, it is a trigger to arrange custody with someone who can. It also supplies the third-party custodian that § 16213(6) later lets a closing practice transfer to, so a practice that has this arrangement already has its closure route.
Applies when
- A licensee is unable to comply with the § 16213 record duties
