HIPAA compliance for independent medical practices in Michigan

Michigan treats HIPAA compliance as compliance with its own breach-notification statute, so covered independent medical practices meeting their federal obligations do not owe a separate state notification. Beyond that, Michigan has 9 recorded rules that apply to independent medical practices differently from other businesses in the state — set out below with their conditions and sources.

Michigan jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Michigan's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Medical practices that electronically submit claims, check eligibility, request authorization, or conduct another adopted transaction are HIPAA covered entities. That describes the overwhelming majority of modern medical practices. The duties below are required; an EHR does not perform them for the practice.

State — how Michigan law interacts with HIPAA

Michigan treats compliance with HIPAA as compliance with its own breach-notification statute. Independent medical practices that meet their federal obligations do not owe a separate state notification on top of them.

Full deemed compliance under § 445.72(10). A person or agency that is subject to and complies with HIPAA (Public Law 104-191) and with the regulations promulgated under that act, 45 CFR parts 160 and 164, for the prevention of unauthorized access to customer information and customer notice, is considered to be in compliance with this section. For a HIPAA-regulated dental, medical, behavioral-health, chiropractic, physical-therapy, or optometry practice operating in Michigan, this operates as a full opt-out — no residual state AG or consumer-reporting-agency notice survives independently.

What Michigan adds for independent medical practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Michigan's general breach law, which applies the same way to every business in the state.

Minor consent to treatment

Minor may consent

Subject to section 5133, consent to medical or surgical care, treatment or services by a hospital, clinic or physician executed by a minor who is or professes to be infected with a sexually transmitted infection or HIV is valid and binding as if the minor had achieved the age of majority. The consent is not subject to later disaffirmance by reason of minority, and the consent of any other person — including a spouse, parent, guardian or person in loco parentis — is not necessary.

Service: medical or surgical care, treatment or services for a sexually transmitted infection or HIV
Provider class: a hospital, clinic or physician

What this means operationally

The trigger is the minor being OR PROFESSING TO BE infected, so a practice does not need a confirmed diagnosis before the consent route opens; the patient's own statement is enough. There is no age floor. The route is expressly made subject to the HIV testing provisions of § 5133, which impose their own inform-and-offer-to-decline steps.

Applies when

The minor is or professes to be infected with a sexually transmitted infection or HIV

Exceptions

Subject to the HIV testing requirements of MCL 333.5133

State statuteMich. Comp. Laws § 333.5127(1)Minors of any age with, or professing, an STI or HIVVerified 2026-08-29

Payment liability

A spouse, parent, guardian or person in loco parentis of a minor is not financially responsible for surgical care, treatment or services provided under MCL 333.5127, and is not legally responsible for services provided under MCL 330.1264.

Service: STI or HIV care under § 5127, and substance use disorder care under § 330.1264

What this means operationally

Michigan relieves the adult flatly, with no participation or express-agreement exception of the kind California, Maryland and Massachusetts attach. That produces a tension the practice has to hold: under § 5127(2) the physician may tell the parent about the treatment over the minor's objection, but the parent still owes nothing for it. Notification and liability move independently here, so a disclosure decision cannot be used to establish a guarantor.

Applies when

Services were provided under MCL 333.5127 or MCL 330.1264

State statuteMich. Comp. Laws §§ 333.5127(3), 330.1264(3)Minors treated on their own consent under either sectionVerified 2026-08-29

Minor may consent

Consent to substance use disorder related medical or surgical care, treatment or services by a hospital, clinic or health professional authorized by law, executed by a minor who is or professes to be an individual with a substance use disorder, is valid and binding as if the minor had achieved the age of majority. The consent is not subject to later disaffirmance by reason of minority, and the consent of any other person — including a spouse, parent, guardian or person in loco parentis — is not necessary. For medical reasons the treating physician, and on that physician's advice and direction a member of the medical staff or other health professional, may but is not obliged to inform those persons of the treatment given or needed, and the information may be given or withheld without the minor's consent and notwithstanding the minor's express refusal.

Service: substance use disorder related medical or surgical care, treatment or services
Provider class: a hospital, clinic or health professional authorized by law

What this means operationally

No age floor and no diagnostic gate — professing a substance use disorder is enough. Set against Massachusetts, which requires a finding by TWO OR MORE physicians before a twelve-year-old can consent to drug-dependency care, this is the widest substance-use consent route in the corpus. The disclosure clause repeats the § 5127 formula verbatim, so a minor's express refusal does not bind the treating physician here either.

Applies when

The minor is or professes to be an individual with a substance use disorder

State statuteMich. Comp. Laws § 330.1264(1), (2)Minors of any age with, or professing, a substance use disorderVerified 2026-08-29

Minor may consent

If a minor consents to prenatal and pregnancy related health care, or to health care for a child of the minor, by a health facility or agency licensed under article 17 or a health professional licensed under article 15, the consent is valid and binding as if the minor had achieved the age of majority. It is not subject to later disaffirmance by reason of minority, and the consent of any other person — including the putative father of the child, a spouse, parent, guardian or person in loco parentis — is not necessary to authorize health care for the minor or for the minor's child.

Service: prenatal and pregnancy related health care, and health care for the minor's child
Provider class: a health facility or agency licensed under article 17, or a health professional licensed under article 15

What this means operationally

Two patients under one consent authority again, and Michigan adds a person the other jurisdictions do not name: the PUTATIVE FATHER, whose consent is expressly unnecessary and who is also a candidate to be notified under the same section. A practice treating a minor's baby is therefore dealing with an adult who has no consent role but may still receive information.

Applies when

The care is prenatal or pregnancy related, or is health care for the minor's child

State statuteMich. Comp. Laws § 333.9132(1)Pregnant minors, minor parents, and their childrenVerified 2026-08-29

Minor may consent

Emancipation occurs by operation of law for the purpose of consenting to routine, nonsurgical medical care or emergency medical treatment when a minor is in the custody of a law enforcement agency and the minor's parent or guardian cannot be promptly located; that emancipation ends on termination of the care or on release from custody, whichever occurs first, and the minor or the minor's parent remains responsible for the cost. Emancipation also occurs by operation of law for the purpose of consenting to the minor's own preventive health care or medical care including surgery, dental care or mental health care — except vasectomies or any procedure related to reproduction — while the minor is a prisoner committed to the jurisdiction of the department of corrections and housed in a state or youth correctional facility.

Setting: law enforcement custody, and state or youth correctional facilities
Service: routine nonsurgical or emergency care in custody; preventive and medical care including surgery, dental and mental health care for prisoners

What this means operationally

Michigan is the only jurisdiction closed so far that makes emancipation SETTING-DEPENDENT and time-limited: the custody emancipation switches on when the parent cannot be reached and switches off at release or at the end of the episode, whichever comes first. So the same patient can be able to consent on arrival and unable to consent at discharge, and the cost stays with the minor or the parent throughout — this is the one custody-related route in the corpus that does not relieve the family of payment.

Applies when

The minor is in law enforcement custody and the parent cannot be promptly located
Or the minor is a prisoner housed in a state or youth correctional facility

Exceptions

The custody emancipation ends on termination of care or release from custody, whichever occurs first
The corrections emancipation excludes vasectomies and any procedure related to reproduction

State statuteMich. Comp. Laws § 722.4(2)(d), (e)Minors in law enforcement custody or in correctional facilitiesVerified 2026-08-29

Provider disclosure to a parent

Provider may disclose

For medical reasons a treating physician, and on the advice and direction of the treating physician a physician, a member of the medical staff of a hospital or clinic, or other health professional, may inform the spouse, parent, guardian or person in loco parentis as to the treatment given or needed. The information may be given to or withheld from these persons without consent of the minor AND NOTWITHSTANDING THE EXPRESS REFUSAL OF THE MINOR to the providing of the information.

Provider class: the treating physician, and on that physician's advice and direction a physician, medical staff member or other health professional
Service: treatment for a sexually transmitted infection or HIV consented to by the minor

What this means operationally

Michigan's signature clause, and it repeats verbatim across the STI, substance use and pregnancy statutes. A minor's explicit objection does not bind the physician, which is the opposite of the Massachusetts and New York positions where the minor's consent or a court order is the only route out. Two limits keep it from being a free hand: the disclosure must be for MEDICAL reasons, and the decision belongs to the treating physician — other staff may act only on that physician's advice and direction, so this is not a front-desk call.

Applies when

The minor consented to STI or HIV treatment under § 5127
There are medical reasons for informing the adult

Exceptions

The judgment belongs to the treating physician; others act only on that physician's advice and direction

State statuteMich. Comp. Laws § 333.5127(2)Minors treated for an STI or HIV on their own consentVerified 2026-08-29

Provider must disclose

BEFORE providing health care to a minor under § 9132, a health facility or agency or a health professional shall inform the minor that the putative father of the child, or the minor's spouse, parent, guardian or person in loco parentis, may be notified under subsection (4). At the initial visit, permission shall be requested of the minor to contact the minor's parents for any additional medical information which may be necessary or helpful to the provision of proper health care.

Service: prenatal and pregnancy related health care consented to by the minor
Provider class: a health facility or agency, or a health professional

What this means operationally

The only advance-warning duty found anywhere in this corpus. Michigan does not merely permit disclosure over a minor's objection — it requires the minor to be TOLD IN ADVANCE that it may happen, before care begins. That converts a difficult conversation from a later surprise into an intake step, and it is a duty on the facility as well as the individual professional. The separate request for permission to contact the parents at the initial visit is about obtaining information rather than releasing it, and it is a request, not a condition of care.

Applies when

Health care is to be provided to a minor under § 9132

State statuteMich. Comp. Laws § 333.9132(2), (3)Minors receiving pregnancy related careVerified 2026-08-29

Provider may disclose

For medical reasons the treating physician, and on the advice and direction of the treating physician a member of the medical staff of a health facility or agency or other health professional, MAY BUT IS NOT OBLIGATED TO inform the putative father of the child, or the minor's spouse, parent, guardian or person in loco parentis, as to the health care given or needed. The information may be given to or withheld from these persons without the consent of the minor and notwithstanding the minor's express refusal.

Provider class: the treating physician, and on that physician's advice and direction a medical staff member or other health professional
Service: prenatal and pregnancy related health care consented to by the minor

What this means operationally

The third appearance of Michigan's standard disclosure formula, and the one with the widest audience — it reaches the PUTATIVE FATHER, an adult with no consent role at all under subsection (1). The section is explicit that this is a permission and not an obligation, which matters because the advance-warning duty at subsection (2) requires the minor to be told this MAY happen; telling them it will is a misstatement of the section.

Applies when

The minor consented to pregnancy related care under § 9132
There are medical reasons for informing the adult

Exceptions

The judgment belongs to the treating physician; others act only on that physician's advice and direction
There is no obligation to inform

State statuteMich. Comp. Laws § 333.9132(4)Minors receiving pregnancy related careVerified 2026-08-29

How long records must be kept

How long the record must be kept

Where the record is for a medical service that involves the vaginal or anal penetration of a patient, the licensee shall retain it for a minimum of 15 years from the date of service. This does not apply to a service that primarily relates to the patient's urological, gastrointestinal, reproductive, gynecological or sexual health; a service necessary and associated with or incident to a medical emergency, meaning a circumstance that in the licensee's good-faith medical judgment creates an immediate threat of serious risk to the patient's life or physical health; a service performed for the purpose of rectally administering a drug or medicine; or a service performed to measure a patient's temperature.

Service: a medical service involving the vaginal or anal penetration of the patient
Record class: the record of that service

What this means operationally

A record class that has to be identifiable in the system, because it carries more than double the ordinary period and cannot be destroyed early even with the patient's written authorization. The four exclusions are drawn tightly enough that most of the services a practice would intuitively place here — gynecological, urological, reproductive — are outside the longer period, so the rule bites on services where penetration is incidental to something else. That makes it a documentation-classification problem before it is a retention problem.

Applies when

The service involved vaginal or anal penetration of the patient
None of the four statutory exclusions applies

Exceptions

Services primarily relating to urological, gastrointestinal, reproductive, gynecological or sexual health
Services necessary and incident to a medical emergency
Rectal administration of a drug or medicine
Measuring a patient's temperature

State statuteMich. Comp. Laws § 333.16213(2)(b)Patients receiving a service within the defined classVerified 2026-08-29

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Michigan breach obligations

These apply to businesses generally rather than to independent medical practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Michiganbreach data →

Individual notice deadline

Without unreasonable delay, subject to (i) delay reasonably necessary to determine the scope of the security breach and restore the reasonable integrity of the database, and (ii) law-enforcement delay. No numeric outer bound in the current text.

The statute sets no numeric outer bound. It is shown for context: a HIPAA covered entity is outside this section, so HIPAA's own 60-day individual-notice window is the operative deadline.

State regulator notice

Not required

None. § 445.72 does not impose an Attorney General notification obligation. The Attorney General and prosecuting attorneys have enforcement authority for civil fines under § 445.72(13), but there is no affirmative AG notice requirement in the section.

Source: Mich. Comp. Laws § 445.72(1), (4)

Statewide rules that also reach independent medical practices

Duty to keep an accurate record

A licensee shall keep and maintain a record for each patient for whom the licensee has provided medical services, including a full and complete record of tests and examinations performed, observations made, and treatments provided. Where a medical service involves the vaginal or anal penetration of the patient, the licensee shall expressly state in the record that vaginal or anal penetration was performed, unless the service falls within one of the four stated exclusions. Records must be maintained so as to protect their integrity, ensure their confidentiality and proper use, and ensure their accessibility and availability to each patient or the patient's authorized representative as required by law.

What this means operationally

Michigan states the duty to create the record and the standard it must be held to in one place, and both reach every professional licensed under article 15 — so this is the baseline a dentist, optometrist, physical therapist and physician all work from. The penetration-documentation requirement is an express content rule rather than a matter of clinical style: the record must SAY that penetration was performed, and the four exclusions are narrow and defined in the statute rather than left to judgment.

Applies when

A licensee has provided medical services to a patient

Exceptions

The penetration-documentation requirement does not apply to services primarily relating to urological, gastrointestinal, reproductive, gynecological or sexual health; services necessary and incident to a medical emergency; rectal administration of a drug; or measuring temperature

StatewideMich. Comp. Laws § 333.16213(1), (3)Patients of a Michigan licenseeVerified 2026-08-29

How long the record must be kept

Unless a longer retention period is otherwise required under federal or state law or regulation, or by generally accepted standards of medical practice, a licensee shall keep and retain each patient record for a minimum of 7 years FROM THE DATE OF SERVICE to which the record pertains.

What this means operationally

Michigan states both the duration and the trigger, which sets it apart from the Illinois dental and optometry rules that give a period and leave the clock-start unsaid. Measuring from the date of service rather than from last treatment means a long-running course of care produces records that age out at different times, so the destruction question is per-encounter rather than per-patient. Note the opening clause: seven years is a FLOOR that yields to any longer federal, state or professional-standard period.

Applies when

A licensee holds a patient record under § 16213(1)

Exceptions

A longer period required by federal or state law or regulation, or by generally accepted standards of medical practice, prevails
Records of services involving vaginal or anal penetration carry a 15-year period under § 16213(2)(b)

StatewideMich. Comp. Laws § 333.16213(2)(a)Patients of a Michigan licenseeVerified 2026-08-29

Parental right of access

Except as otherwise provided by law or regulation, a patient or the patient's authorized representative has the right to examine or obtain the patient's medical record. The requester must submit a WRITTEN request, signed and dated not more than 60 days before it is submitted, to the health care provider or health facility that maintains the record.

What this means operationally

The staleness rule on the request itself is the unusual feature and it cuts both ways: a request signed more than 60 days before it arrives does not meet the section, so a practice receiving an old form is entitled to ask for a fresh one — and a practice sending forms to patients should not expect them back indefinitely. Michigan puts access in a separate act from the retention duties, so a practice working only from the Public Health Code will not find this.

Applies when

A patient or authorized representative submits a signed, dated written request

Exceptions

Except as otherwise provided by law or regulation

StatewideMich. Comp. Laws § 333.26265(1), (2) first sentencePatients and their authorized representativesVerified 2026-08-29

Deadline to respond to an access request

On receipt of a request, the provider or facility shall, as promptly as required under the circumstances but not later than 30 days after receipt — or not later than 60 days where the record is not maintained or accessible on-site — do one or more of the following: make the record available for inspection or copying at its business location during regular business hours, or provide a copy as requested; transmit the request to a person or medical records company holding the records under contract and either retrieve the record or require that company to comply; inform the requester that the record does not exist or cannot be found; inform the requester that it does not hold the record and give the name and address, if known, of the provider or facility that does; or, where it determines that disclosure is likely to have an ADVERSE EFFECT on the patient, provide a clear statement supporting that determination and provide the record to another provider, facility or legal counsel designated by the patient or representative.

What this means operationally

Thirty days, extending to sixty only on a factual condition — the record not being maintained or accessible on-site — rather than on a request for more time. Michigan then enumerates five compliant responses, which is more useful than a bare deadline: telling the patient the record cannot be found, or that another provider holds it, are complete answers within the period. The adverse-effect route does not permit withholding; it redirects the record to a clinician or lawyer the PATIENT designates, and requires a clear written statement supporting the determination.

Applies when

A conforming written request has been received

Exceptions

60 days where the record is not maintained or accessible on-site

StatewideMich. Comp. Laws § 333.26265(2)(a)-(f)Patients and their authorized representativesVerified 2026-08-29

Limit on copy fees, format or delivery

A provider, facility or medical records company may charge no more than: an initial fee of $20.00 per request; paper copies at $1.00 per page for the first 20 pages, 50 cents for pages 21 to 50 and 20 cents for pages 51 and over; for a record in a form other than paper, the actual cost of preparing a duplicate; postage or shipping actually incurred; and actual costs of retrieving records 7 YEARS OLD OR OLDER that are not maintained or accessible on-site. It may refuse to retrieve or copy until the applicable fee is paid. No other fee for retrieving, copying or mailing may be charged. All fees must be WAIVED for a medically indigent individual, limited to one set of copies per provider, facility or company, with further requests subject to the ordinary fees. NOTWITHSTANDING the schedule, no initial fee may be charged to A PATIENT for the patient's own record. The department adjusts the amounts annually by the Detroit consumer price index.

What this means operationally

Two carve-outs sit inside the schedule and both favor the patient. The $20 initial fee cannot be charged to the patient for their own record at all — it survives only for other authorized requesters — and all fees are waived outright for a medically indigent individual, with proof of assistance permitted to be required. The retrieval charge is keyed to the record being seven years or older AND off-site, which lines up with the seven-year retention floor in the Public Health Code. Note the published figures are a floor for accuracy rather than the operative numbers: the department adjusts them annually for inflation.

Applies when

A copy of a medical record is requested under § 26265

Exceptions

No initial fee may be charged to the patient for the patient's own record
All fees waived for a medically indigent individual, limited to one set of copies
Amounts are adjusted annually by the department for the Detroit consumer price index

StatewideMich. Comp. Laws § 333.26269Patients and their authorized representativesVerified 2026-08-29

Destruction or disposition requirement

A licensee may destroy a patient record that is LESS THAN 7 YEARS OLD only if the licensee both sends written notice to the patient at the patient's last known address informing them that the record is about to be destroyed, offering the opportunity to request a copy, and requesting written authorization to destroy it, AND receives written authorization from the patient or the patient's authorized representative agreeing to the destruction. That route is not available at all for a record of a service within § 16213(2)(b). Records other than those may be destroyed or otherwise disposed of after being maintained for 7 years, and records within § 16213(2)(b) after 15 years. Where records are destroyed they must be shredded, incinerated, electronically deleted, or otherwise disposed of in a manner that ensures continued confidentiality of the patient's health care and personal information.

What this means operationally

One of the few jurisdictions that legislates destruction rather than leaving it to be inferred from a retention period ending — and the two halves point in opposite directions. Early destruction is possible but only with the patient's WRITTEN authorization actually received; silence does not suffice, so a notice sent and ignored leaves the record in place. After the period runs, destruction is permitted rather than required, and the METHOD is prescribed: shredding, incineration, electronic deletion or an equivalent that preserves confidentiality. The department can step in where disposal was improper and assess its costs against the licensee.

Applies when

A licensee proposes to destroy or dispose of a patient record

Exceptions

The early-destruction route is unavailable for records of services within § 16213(2)(b)
A longer period required by other law or by generally accepted standards of medical practice prevails

StatewideMich. Comp. Laws § 333.16213(4), (7), (8)Patients whose records are proposed for destructionVerified 2026-08-29

Custody on closure or transfer

If a licensee sells or closes their practice, retires, or otherwise ceases to practice under article 15, the licensee — or the personal representative if the licensee is deceased — SHALL NOT ABANDON the records, and shall send written notice to the department specifying who will have custody of the medical records and how a patient may request access to or copies of them. The licensee shall also either transfer the records to a successor licensee, or at the patient's request to the patient or a specified health facility or other licensed provider, or to a provider, facility or medical records company under a records agreement; OR destroy them, having sent written notice to the last known address of each patient giving the patient 30 DAYS to request a copy or designate a transfer destination and requesting written authorization for destruction. If the patient does not respond, records less than 7 years old may not be destroyed, though records 7 years or older may be destroyed under § 16213(8).

What this means operationally

Michigan is unusually complete on closure and it binds the estate as well as the practitioner — the personal representative of a deceased licensee carries the same duty, which is the case most practices never plan for. Two obligations run together: a notice to the DEPARTMENT naming the custodian and the route to records, and a disposition of the records themselves. The patient-notice branch gives 30 days and treats silence conservatively: no response means the records survive if they are under seven years old. Note the notice to the department is about custody rather than closure, so it has to name a person or entity who will actually hold the records.

Applies when

A licensee sells or closes the practice, retires, or otherwise ceases to practice under article 15
Or the licensee has died and a personal representative is acting

Exceptions

Records within § 16213(2)(b) may be destroyed only in accordance with § 16213(8)

StatewideMich. Comp. Laws § 333.16213(6)Patients of a closing, sold or discontinued practiceVerified 2026-08-29

Custody on closure or transfer

If a licensee is unable to comply with § 16213, the licensee shall employ, or contract, arrange or enter into an agreement with, another health care provider, a health facility or agency, or a medical records company to protect, maintain and provide access to the records required under § 16213(1).

What this means operationally

A standing obligation rather than a closure step, and the one that quietly makes the rest of the section workable for a small practice: inability to hold records to the statutory standard is not a defense, it is a trigger to arrange custody with someone who can. It also supplies the third-party custodian that § 16213(6) later lets a closing practice transfer to, so a practice that has this arrangement already has its closure route.

Applies when

A licensee is unable to comply with the § 16213 record duties

StatewideMich. Comp. Laws § 333.16213(5)Patients whose records a licensee cannot maintainVerified 2026-08-29

What applies to independent medical practices everywhere

Independent medical practices often have the broadest technology and data surface: EHRs, portals, laboratories, e-prescribing, imaging, claims, referrals, fax, remote access, and dozens of vendors. The SRA must cover the whole environment — not merely the primary EHR.

The complete inventory of systems that create, receive, maintain, or transmit ePHI

EHR access, administrative privileges, audit logging, integrations, APIs, and patient-portal connections

Laboratory, imaging, e-prescribing, pharmacy, hospital, specialist, and referral data flows

Claims, eligibility, prior authorization, clearinghouse, billing, and payment workflows

Email, text, e-fax, forms, telehealth, call recording, voicemail, and patient messaging

Workstations, servers, laptops, tablets, phones, network equipment, remote access, cloud storage, and backup

Full medical practicescompliance guide →

Knowing the Michigan rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Michigan rules on this page.

Start the risk assessment