Health record rights in Michigan: what state law adds
In Michigan, as of October 3, 2026, we found no law on health data held outside HIPAA; you get a free copy of your record in some cases; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices need not cover medical or health insurance information; and we found no law on AI in care. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
MCL full-text search found no consumer health data or comprehensive privacy law. SB 359 of 2025 was last referred to Committee of the Whole on 6/12/2025. HB 5769 of 2026 sits in committee. Neither is enacted.
How we searched (October 3, 2026): the official code search for "consumer health data", "sensitive data", "personal data", "data broker". Agency pages checked: michigan.gov.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Free copy element met: all fees waived for a medically indigent individual, which goes beyond HIPAA and 45 CFR 171.302. Deadline is 30 days, extendable once by 30 days, so no shorter deadline.
Deadline in the law: 30 days (not shorter than HIPAA's 30).
Free copy: Medically indigent individual (as defined in MCL 400.106): all fees waived, limited to 1 set of copies per provider, facility or medical records company (MCL 333.26269(3)-(4)).
Fee rule: Initial fee of $20.00 per request (MCL 333.26269(1)(a)), but subsection (5) says the holder 'shall not charge a patient an initial fee for his or her medical record.'
Fee rule: Paper copies: 'One dollar per page for the first 20 pages', 'Fifty cents per page for pages 21 through 50', 'Twenty cents for pages 51 and over' (MCL 333.26269(1)(b)).
Fee rule: Non-paper media: 'the actual cost of preparing a duplicate' (MCL 333.26269(1)(c)).
Fee rule: Postage or shipping costs, and actual retrieval costs for records 7 years old or older not kept on-site (MCL 333.26269(1)(d)-(e)).
Fee rule: Fees adjusted annually by the Detroit consumer price index (MCL 333.26269(6)).
Goes beyond the federal floor: yes.
Medical Records Access Act, fee. MCL 333.26269
In force · effective · read October 3, 2026 · source(legislature.mi.gov)
Except as otherwise provided in subsection (4), a health care provider, health facility, or medical records company shall waive all fees for a medically indigent individual.
Who it binds, in our words: health care provider, health facility, or medical records company
Medical Records Access Act, response time. MCL 333.26265(2)-(3)
In force · effective · read October 3, 2026 · source(legislature.mi.gov)
as promptly as required under the circumstances, but not later than 30 days after receipt of the request or if the medical record is not maintained or accessible on-site not later than 60 days after receipt of the request
Who it binds, in our words: a health care provider or health facility
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No MCL consent rule for HIE found. MDHHS page says MiHIN was designated the state HIE in 2010. Opt-out uses a notarized form and covers the LHR only. Policy says updated June 2025; day not stated.
Set by the published policy of the state-designated exchange; no state law sets the rule.
Designated exchange: Michigan Health Information Network Shared Services (MiHIN).
Some sensitive records need your consent even where routine records do not.
MiHIN Consumer Privacy Policy (updated June 2025). MiHIN Consumer Privacy Policy
In force · effective · read October 3, 2026 · source(mihin.org, reached from michigan.gov)
MiHIN facilitates opt out of health information exchange directly with patients in limited situations. We allow opt out of our community health record, which is oftentimes referred to as Longitudinal Health Record (LHR).
Who it binds, in our words: Longitudinal Health Record (LHR)
MiHIN Consumer Privacy Policy, specially protected information. MiHIN Consumer Privacy Policy
In force · effective · read October 3, 2026 · source(mihin.org, reached from michigan.gov)
For information that requires consent, such as specially protected information (SPI), the entity should not share with MiHIN unless they obtain the proper consent.
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
MCL 333.2835 abortion reporting was repealed by 2023 PA 209, effective 2024-02-13. HB 5769 of 2026, a reproductive health data privacy act, is in committee and not enacted.
Public Health Code, abortion informed consent, confidentiality. MCL 333.17015(19)
In force · effective · read October 3, 2026 · source(legislature.mi.gov)
The identity and address of a patient who is provided information or who consents to an abortion pursuant to this section is confidential and is subject to disclosure only with the consent of the patient or by judicial process.
Parental Rights Restoration Act, waiver proceedings. MCL 722.904(2)(g)
In force · effective · read October 3, 2026 · source(legislature.mi.gov)
All records of proceedings related to the petition for waiver of parental consent under this act are confidential.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure is allowed only as set out in sections 748 and 748a. Section 748(4) gives an adult recipient access within 30 days.
Mental Health Code, confidentiality of recipient records. MCL 330.1748(1)
In force · effective · read October 3, 2026 · source(legislature.mi.gov)
Information in the record of a recipient, and other information acquired in the course of providing mental health services to a recipient, shall be kept confidential and is not open to public inspection.
Who it binds, in our words: department, community mental health services program, licensed facility, or contract provider
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Section 5131 also sets limits on disclosure in response to court orders and subpoenas.
Public Health Code, HIV and AIDS confidentiality. MCL 333.5131(1)
In force · effective · read October 3, 2026 · source(legislature.mi.gov)
All reports, records, and data pertaining to testing, care, treatment, reporting, and research, and information pertaining to partner notification under section 5114a, that are associated with HIV infection and acquired immunodeficiency syndrome are confidential.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Health insurers may not require disclosure of genetic test results. Physicians must get written consent covering who will access genetic test information.
Insurance Code, genetic testing and disclosure. MCL 500.3407b(1)(b)
In force · effective · read October 3, 2026 · source(legislature.mi.gov)
Disclose whether genetic testing has been conducted or the results of genetic testing or genetic information.
Who it binds, in our words: An insurer that delivers, issues for delivery, or renews in this state a health insurance policy shall not require an insured or his or her dependent or an asymptomatic applicant for insurance or his or her asymptomatic dependent to do either of the following:
Public Health Code, genetic test informed consent. MCL 333.17020(2)(f)
In force · effective · read October 3, 2026 · source(legislature.mi.gov)
Who will have access to the sample taken from the test subject in order to conduct the presymptomatic or predictive genetic test and the information obtained from the presymptomatic or predictive genetic test, and the test subject's right to confidential treatment of the sample and the information.
Who it binds, in our words: presymptomatic or predictive genetic test ordered by a physician
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The only private right found is for HIV records, one narrow category. The Medical Records Access Act and breach law name no private action. Breach fines are enforced by the attorney general or a prosecutor.
Damages a court may award: Actual damages or $1,000.00, whichever is greater, plus costs and reasonable attorney fees (HIV records, MCL 333.5131(8)).
Public Health Code, HIV confidentiality violations. MCL 333.5131(8)
In force · effective · read October 3, 2026 · source(legislature.mi.gov)
is liable in a civil action for actual damages or $1,000.00, whichever is greater, and costs and reasonable attorney fees.
Who it binds, in our words: A person who violates this section, and the employer of that person unless reasonable precautions were in effect
In force · effective · read October 3, 2026 · source(legislature.mi.gov)
The attorney general or a prosecuting attorney may bring an action to recover a civil fine under this section.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Personal information lists only Social Security, driver license or state ID, and financial account numbers. No medical or health insurance data. Notice goes to consumer reporting agencies, not the attorney general.
Deadline to tell people: without unreasonable delay.
No duty found to tell the attorney general or a regulator.
A business that follows HIPAA's breach rules is treated as following this law.
In force · effective · read October 3, 2026 · source(legislature.mi.gov)
for the prevention of unauthorized access to customer information and customer notice is considered to be in compliance with this section.
Who it binds, in our words: A person or agency that is subject to and complies with the health insurance portability and accountability act of 1996
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
MCL AI hits cover elections and schools only. HB 4536 was re-referred to committee on 3/19/2026. DIFS Bulletin 2024-20-INS is guidance, not a statute or rule.
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
6.2%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
93.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
87.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
9.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$68,505 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
5.0%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
7.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
9.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
12.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
