Michigan has taken the confidentiality of patient medical information very seriously.  Under Michigan law, health facilities, insurance companies, the Department of Public Health, and nursing homes are all required to maintain the confidential nature of patients’ medical records.1  The law allows disclosure of patient medical records only to authorized individuals.2  The law also imposes confidentiality requirements for Medicaid records that must be followed.3  While there is a physician-patient privilege to maintain the confidentiality of treatment under the law, this privilege is waived if the patient brings a malpractice action against the physician.4  In addition, the law provides for the exchange and disclosure of all relevant medical records over the course of a medical malpractice claim.5  Similarly, Michigan allows the disclosure of information related to a patient’s condition and quality of care to a peer review organization.6

There is also special protection for the confidentiality of mental health information, and limited instances where mental health records may be disclosed.7  Michigan has enacted laws that govern the disclosure and use of confidential substance abuse and treatment records.  Those records may be disclosed with the individual’s authorization, or without the person’s written consent for limited purposes.8  There are also laws that grant the governing agency access to confidential, patient medical records for specific purposes.  For example, mental health providers must provide mental health records to caseworkers in order to confirm allegations of child abuse or neglect if there is a compelling need.9  State gun registration laws require that an applicant gives consent to allow the licensing board access to mental and medical health records, and that the records be kept confidential.10  All such disclosures must maintain the confidentiality of the information and may not identify the patient.11

Health information pertaining to drug prescriptions is also confidential according to Michigan law.  Electronic systems used to transmit prescriptions must maintain the confidentiality of the information being transmitted as well as protect the patient’s identity.12  An electronic system must also be put in place to monitor the dispensing of certain controlled substances.  The Department of Community Health may disclose information contained in the electronic system to licensing boards, the state’s Medicaid agency, government official, health care provider, or law enforcement, unless the information is protected by patient-practitioner privilege.13  However, the privacy protections afforded to the information contained in the controlled substance electronic system do not apply to an individual who has fraudulently obtained a controlled substance or a prescription for a controlled substance.14

For insurance companies, the confidentiality provisions require that even inactive medical records be safely and securely stored.15 Also, insurance companies are required to establish an information security program that ensures the confidentiality of consumer information.16  Health insurers are also required to provide consumers with an authorization that allows the insurer to disclose confidential health information.17  Health insurers providing health benefits to public employers must provide cost and utilization data to the employers, but in doing so, must ensure that the information is de-identified and complies with HIPAA.18  In addition, Michigan’s Health Information Technology Commission must take steps to ensure the privacy of health information, including measures to prevent unauthorized access to the information.19

The Department of Public Health is also required to establish procedures to protect the confidentiality of records by identifying data that cannot be disclosed until patient identifying data is removed.20 The Department is required to keep any information obtained during the course of medical research confidential.  However, this information can be used for statistical, scientific, or research purposes.21  While the state does maintain a Freedom of Information Act, the Act provides exemptions from disclosure for records protected by patient-physician privilege and protected health information that identifies the individual who is the subject of the information.22

The Department of Community Health must have policies and procedures in place that ensure the confidentiality of the information it receives.23  Specifically, HIV related reports and records must be kept confidential, but may be disclosed in limited circumstances enumerated in the law.24  Additionally, abortion reports that are required by the Department must remain confidential, and may not contain any identifying information of the woman.25  Notably, the Department does not have explicit authority to demand the release of medical records from providers, unless it is provided for specifically by law.26

All registry information is also subject to confidentiality requirements under Michigan law.  Specifically, the Cancer Registry, Birth Defect Registry, Immunization Registry, Care Improvement Registry, and Donor Registry all have protections in place to ensure the confidentiality of information that is provided.27  However, individually identifiable information in the Cancer, Donor, and Immunization Registries may be released to the subject of the information or his or her parent/guardian upon a signed, written request.28