Mich. Comp. Laws Ann. § 550.1406 - Regulations and guidelines regarding health care companies' protection of members' privacy

All health care corporations must use reasonable care when securing patients’ medical records to ensure the confidentiality of the information. Except for specified purposes, a health care corporation must not disclose any personal information associated with an identifiable patient without the prior and specific written informed consent of the patient. If a patient authorizes the disclosure of their information, the health care corporation must ensure the recipient agrees not to disclose the information to any other individual, unless the patient has authorized further disclosures. Health care corporations must make public disclosures of their privacy and confidentiality policies, and such policies must meet specified statutory requirements. Any health care corporation that violates this Section is guilty of a misdemeanor and subject to civil liability by the affected patient.