HIPAA compliance for medical spas in Michigan

Michigan treats HIPAA compliance as compliance with its own breach-notification statute, so covered medical spas meeting their federal obligations do not owe a separate state notification. Patient Protect has not recorded any Michigan rule that applies to medical spas differently from other providers in the state — the statewide rules below are the ones that reach you.

Michigan jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Michigan's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Providing a medical service does not, by itself, complete the HIPAA classification. Map the legal entity, clinical components, management company, prescribers, billing activity, and vendor roles; determine whether an adopted transaction is conducted or Business Associate work is performed. Covered operations must complete the duties below, while state medical and consumer-health privacy rules may govern the rest.

State — how Michigan law interacts with HIPAA

Michigan treats compliance with HIPAA as compliance with its own breach-notification statute. Medical spas that meet their federal obligations do not owe a separate state notification on top of them.

Full deemed compliance under § 445.72(10). A person or agency that is subject to and complies with HIPAA (Public Law 104-191) and with the regulations promulgated under that act, 45 CFR parts 160 and 164, for the prevention of unauthorized access to customer information and customer notice, is considered to be in compliance with this section. For a HIPAA-regulated dental, medical, behavioral-health, chiropractic, physical-therapy, or optometry practice operating in Michigan, this operates as a full opt-out — no residual state AG or consumer-reporting-agency notice survives independently.

What Michigan adds for medical spas specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Michigan's general breach law, which applies the same way to every business in the state.

No verified intersection rules recorded

Patient Protect has not recorded any Michigan rule that applies to medical spas differently from any other practice in the state. Where that is the case, the federal obligations and the Michigan rules below are the whole picture, and the med spas guidance that applies nationally is the better starting point.

HIPAA compliance for medical spas→

Michigan breach obligations

These apply to businesses generally rather than to medical spas in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Michiganbreach data →

Individual notice deadline

Without unreasonable delay, subject to (i) delay reasonably necessary to determine the scope of the security breach and restore the reasonable integrity of the database, and (ii) law-enforcement delay. No numeric outer bound in the current text.

The statute sets no numeric outer bound. It is shown for context: a HIPAA covered entity is outside this section, so HIPAA's own 60-day individual-notice window is the operative deadline.

State regulator notice

Not required

None. § 445.72 does not impose an Attorney General notification obligation. The Attorney General and prosecuting attorneys have enforcement authority for civil fines under § 445.72(13), but there is no affirmative AG notice requirement in the section.

Source: Mich. Comp. Laws § 445.72(1), (4)

Statewide rules that also reach medical spas

Duty to keep an accurate record

A licensee shall keep and maintain a record for each patient for whom the licensee has provided medical services, including a full and complete record of tests and examinations performed, observations made, and treatments provided. Where a medical service involves the vaginal or anal penetration of the patient, the licensee shall expressly state in the record that vaginal or anal penetration was performed, unless the service falls within one of the four stated exclusions. Records must be maintained so as to protect their integrity, ensure their confidentiality and proper use, and ensure their accessibility and availability to each patient or the patient's authorized representative as required by law.

What this means operationally

Michigan states the duty to create the record and the standard it must be held to in one place, and both reach every professional licensed under article 15 — so this is the baseline a dentist, optometrist, physical therapist and physician all work from. The penetration-documentation requirement is an express content rule rather than a matter of clinical style: the record must SAY that penetration was performed, and the four exclusions are narrow and defined in the statute rather than left to judgment.

Applies when

A licensee has provided medical services to a patient

Exceptions

The penetration-documentation requirement does not apply to services primarily relating to urological, gastrointestinal, reproductive, gynecological or sexual health; services necessary and incident to a medical emergency; rectal administration of a drug; or measuring temperature

StatewideMich. Comp. Laws § 333.16213(1), (3)Patients of a Michigan licenseeVerified 2026-08-29

How long the record must be kept

Unless a longer retention period is otherwise required under federal or state law or regulation, or by generally accepted standards of medical practice, a licensee shall keep and retain each patient record for a minimum of 7 years FROM THE DATE OF SERVICE to which the record pertains.

What this means operationally

Michigan states both the duration and the trigger, which sets it apart from the Illinois dental and optometry rules that give a period and leave the clock-start unsaid. Measuring from the date of service rather than from last treatment means a long-running course of care produces records that age out at different times, so the destruction question is per-encounter rather than per-patient. Note the opening clause: seven years is a FLOOR that yields to any longer federal, state or professional-standard period.

Applies when

A licensee holds a patient record under § 16213(1)

Exceptions

A longer period required by federal or state law or regulation, or by generally accepted standards of medical practice, prevails
Records of services involving vaginal or anal penetration carry a 15-year period under § 16213(2)(b)

StatewideMich. Comp. Laws § 333.16213(2)(a)Patients of a Michigan licenseeVerified 2026-08-29

Parental right of access

Except as otherwise provided by law or regulation, a patient or the patient's authorized representative has the right to examine or obtain the patient's medical record. The requester must submit a WRITTEN request, signed and dated not more than 60 days before it is submitted, to the health care provider or health facility that maintains the record.

What this means operationally

The staleness rule on the request itself is the unusual feature and it cuts both ways: a request signed more than 60 days before it arrives does not meet the section, so a practice receiving an old form is entitled to ask for a fresh one — and a practice sending forms to patients should not expect them back indefinitely. Michigan puts access in a separate act from the retention duties, so a practice working only from the Public Health Code will not find this.

Applies when

A patient or authorized representative submits a signed, dated written request

Exceptions

Except as otherwise provided by law or regulation

StatewideMich. Comp. Laws § 333.26265(1), (2) first sentencePatients and their authorized representativesVerified 2026-08-29

Deadline to respond to an access request

On receipt of a request, the provider or facility shall, as promptly as required under the circumstances but not later than 30 days after receipt — or not later than 60 days where the record is not maintained or accessible on-site — do one or more of the following: make the record available for inspection or copying at its business location during regular business hours, or provide a copy as requested; transmit the request to a person or medical records company holding the records under contract and either retrieve the record or require that company to comply; inform the requester that the record does not exist or cannot be found; inform the requester that it does not hold the record and give the name and address, if known, of the provider or facility that does; or, where it determines that disclosure is likely to have an ADVERSE EFFECT on the patient, provide a clear statement supporting that determination and provide the record to another provider, facility or legal counsel designated by the patient or representative.

What this means operationally

Thirty days, extending to sixty only on a factual condition — the record not being maintained or accessible on-site — rather than on a request for more time. Michigan then enumerates five compliant responses, which is more useful than a bare deadline: telling the patient the record cannot be found, or that another provider holds it, are complete answers within the period. The adverse-effect route does not permit withholding; it redirects the record to a clinician or lawyer the PATIENT designates, and requires a clear written statement supporting the determination.

Applies when

A conforming written request has been received

Exceptions

60 days where the record is not maintained or accessible on-site

StatewideMich. Comp. Laws § 333.26265(2)(a)-(f)Patients and their authorized representativesVerified 2026-08-29

Limit on copy fees, format or delivery

A provider, facility or medical records company may charge no more than: an initial fee of $20.00 per request; paper copies at $1.00 per page for the first 20 pages, 50 cents for pages 21 to 50 and 20 cents for pages 51 and over; for a record in a form other than paper, the actual cost of preparing a duplicate; postage or shipping actually incurred; and actual costs of retrieving records 7 YEARS OLD OR OLDER that are not maintained or accessible on-site. It may refuse to retrieve or copy until the applicable fee is paid. No other fee for retrieving, copying or mailing may be charged. All fees must be WAIVED for a medically indigent individual, limited to one set of copies per provider, facility or company, with further requests subject to the ordinary fees. NOTWITHSTANDING the schedule, no initial fee may be charged to A PATIENT for the patient's own record. The department adjusts the amounts annually by the Detroit consumer price index.

What this means operationally

Two carve-outs sit inside the schedule and both favor the patient. The $20 initial fee cannot be charged to the patient for their own record at all — it survives only for other authorized requesters — and all fees are waived outright for a medically indigent individual, with proof of assistance permitted to be required. The retrieval charge is keyed to the record being seven years or older AND off-site, which lines up with the seven-year retention floor in the Public Health Code. Note the published figures are a floor for accuracy rather than the operative numbers: the department adjusts them annually for inflation.

Applies when

A copy of a medical record is requested under § 26265

Exceptions

No initial fee may be charged to the patient for the patient's own record
All fees waived for a medically indigent individual, limited to one set of copies
Amounts are adjusted annually by the department for the Detroit consumer price index

StatewideMich. Comp. Laws § 333.26269Patients and their authorized representativesVerified 2026-08-29

Destruction or disposition requirement

A licensee may destroy a patient record that is LESS THAN 7 YEARS OLD only if the licensee both sends written notice to the patient at the patient's last known address informing them that the record is about to be destroyed, offering the opportunity to request a copy, and requesting written authorization to destroy it, AND receives written authorization from the patient or the patient's authorized representative agreeing to the destruction. That route is not available at all for a record of a service within § 16213(2)(b). Records other than those may be destroyed or otherwise disposed of after being maintained for 7 years, and records within § 16213(2)(b) after 15 years. Where records are destroyed they must be shredded, incinerated, electronically deleted, or otherwise disposed of in a manner that ensures continued confidentiality of the patient's health care and personal information.

What this means operationally

One of the few jurisdictions that legislates destruction rather than leaving it to be inferred from a retention period ending — and the two halves point in opposite directions. Early destruction is possible but only with the patient's WRITTEN authorization actually received; silence does not suffice, so a notice sent and ignored leaves the record in place. After the period runs, destruction is permitted rather than required, and the METHOD is prescribed: shredding, incineration, electronic deletion or an equivalent that preserves confidentiality. The department can step in where disposal was improper and assess its costs against the licensee.

Applies when

A licensee proposes to destroy or dispose of a patient record

Exceptions

The early-destruction route is unavailable for records of services within § 16213(2)(b)
A longer period required by other law or by generally accepted standards of medical practice prevails

StatewideMich. Comp. Laws § 333.16213(4), (7), (8)Patients whose records are proposed for destructionVerified 2026-08-29

Custody on closure or transfer

If a licensee sells or closes their practice, retires, or otherwise ceases to practice under article 15, the licensee — or the personal representative if the licensee is deceased — SHALL NOT ABANDON the records, and shall send written notice to the department specifying who will have custody of the medical records and how a patient may request access to or copies of them. The licensee shall also either transfer the records to a successor licensee, or at the patient's request to the patient or a specified health facility or other licensed provider, or to a provider, facility or medical records company under a records agreement; OR destroy them, having sent written notice to the last known address of each patient giving the patient 30 DAYS to request a copy or designate a transfer destination and requesting written authorization for destruction. If the patient does not respond, records less than 7 years old may not be destroyed, though records 7 years or older may be destroyed under § 16213(8).

What this means operationally

Michigan is unusually complete on closure and it binds the estate as well as the practitioner — the personal representative of a deceased licensee carries the same duty, which is the case most practices never plan for. Two obligations run together: a notice to the DEPARTMENT naming the custodian and the route to records, and a disposition of the records themselves. The patient-notice branch gives 30 days and treats silence conservatively: no response means the records survive if they are under seven years old. Note the notice to the department is about custody rather than closure, so it has to name a person or entity who will actually hold the records.

Applies when

A licensee sells or closes the practice, retires, or otherwise ceases to practice under article 15
Or the licensee has died and a personal representative is acting

Exceptions

Records within § 16213(2)(b) may be destroyed only in accordance with § 16213(8)

StatewideMich. Comp. Laws § 333.16213(6)Patients of a closing, sold or discontinued practiceVerified 2026-08-29

Custody on closure or transfer

If a licensee is unable to comply with § 16213, the licensee shall employ, or contract, arrange or enter into an agreement with, another health care provider, a health facility or agency, or a medical records company to protect, maintain and provide access to the records required under § 16213(1).

What this means operationally

A standing obligation rather than a closure step, and the one that quietly makes the rest of the section workable for a small practice: inability to hold records to the statutory standard is not a defense, it is a trigger to arrange custody with someone who can. It also supplies the third-party custodian that § 16213(6) later lets a closing practice transfer to, so a practice that has this arrangement already has its closure route.

Applies when

A licensee is unable to comply with the § 16213 record duties

StatewideMich. Comp. Laws § 333.16213(5)Patients whose records a licensee cannot maintainVerified 2026-08-29

What applies to medical spas everywhere

Calling an operation a spa, studio, or wellness business does not answer whether HIPAA and state medical-privacy laws apply. The practice must document its medical services, legal entities, electronic transactions, clinical recordkeeping, workforce, and data relationships. When HIPAA applies, the medical spa carries the full compliance obligation.

The EHR or practice-management system, scheduling, intake, consent, payment, and patient-communication platforms

Clinical consultations, injectables, prescription services, IV therapy, weight-loss, hormone, laser, and other medically directed services

Before-and-after photographs and videos from capture through upload, storage, access, treatment use, marketing use, retention, and deletion

Personal phones, tablets, cameras, shared devices, automatic cloud synchronization, and social-media workflows

Telehealth, e-prescribing, laboratory, pharmacy, medical-director, referral, and clinical-support relationships

Marketing agencies, social-media managers, website forms, advertising platforms, influencers, affiliates, analytics, and lead-generation systems receiving health-related information

Full med spascompliance guide →

Federal obligations still have to be evidenced for medical spas in Michigan.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Michigan rules on this page.

Start the risk assessment