Michigan Medical Records Retention Laws (2026 Guide)

Michigan has specific laws governing how long doctors, hospitals, and other healthcare providers must keep patient medical records. Whether you are a healthcare provider trying to stay compliant or a patient seeking access to your own files, understanding these requirements is essential.

This guide breaks down every aspect of Michigan medical records retention law, including the differences between individual practitioners and facilities, special rules for minors, federal overlay requirements from HIPAA and CMS, patient access rights, proper destruction methods, and what happens when a practice closes.

Michigan Medical Records Retention: The Core Statutes

Two primary statutes govern medical records retention in Michigan. Each applies to a different category of healthcare provider.

MCL 333.16213: Individual Licensed Practitioners

MCL 333.16213 applies to individually licensed healthcare professionals, including physicians, dentists, nurses, psychologists, physical therapists, and other practitioners licensed under Article 15 of the Michigan Public Health Code.

Under this statute, every licensee must keep and maintain a record for each patient. That record must include a full and complete account of all tests and examinations performed, observations made, and treatments provided.

The minimum retention period is 7 years from the date of service. This means each individual entry in a patient record must be retained for at least seven years from when that specific service occurred, not from the patient's last visit.

MCL 333.20175: Health Facilities and Agencies

MCL 333.20175 applies to licensed health facilities and agencies. This category includes hospitals, nursing homes, freestanding surgical outpatient facilities, hospices, home health agencies, and clinical laboratories.

The retention requirement for facilities mirrors the individual practitioner standard: a minimum of 7 years from the date of service. Facilities must also maintain records in a manner that protects their integrity, ensures confidentiality and proper use, and guarantees accessibility to patients or their authorized representatives.

Hospitals face an additional obligation. They must take precautions to ensure that patient records are not wrongfully altered or destroyed. A hospital that fails to comply with this safeguard requirement is subject to an administrative fine of $10,000.

The 15-Year Retention Rule for Sensitive Examinations

A 2023 amendment to Michigan law (2023 Act 62, effective October 10, 2023) added a longer retention requirement for certain types of medical records.

Records that document a medical service involving vaginal or anal penetration of the patient must be retained for 15 years from the date of service, rather than the standard seven years. This extended requirement applies under both MCL 333.16213 (individual practitioners) and MCL 333.20175 (health facilities).

The law defines specific exceptions where the standard 7-year period applies instead. The 15-year rule does not apply when the service primarily addresses:

• Urological health
• Gastrointestinal health
• Reproductive or gynecological health
• Sexual health
• Medical emergencies involving an immediate threat of serious risk to life or physical health
• Rectal administration of drugs or medicine
• Temperature measurement procedures

For records subject to the 15-year rule, providers must expressly state in the patient record that vaginal or anal penetration was performed.

Penalties for Noncompliance with the 15-Year Rule

MCL 333.16213a establishes a tiered penalty structure for failing to properly document these sensitive examinations:

• First violation: Administrative fine up to $1,000
• Second violation: Administrative fine up to $2,500
• Third or subsequent violation: Misdemeanor punishable by up to 180 days imprisonment, a fine up to $5,000, or both
• Gross negligence: Misdemeanor with up to 180 days imprisonment, a fine up to $5,000, or both
• Intentional violation: Felony with up to 2 years imprisonment, a fine up to $7,500, or both

Retention Rules for Minor Patients

Michigan law provides additional protections for medical records of patients who were minors at the time of treatment. The age of majority in Michigan is 18 under the Age of Majority Act.

Healthcare providers must retain medical records of minor patients until the patient turns 25 years old. This effectively provides seven years of protection beyond the age of majority, ensuring that young adults have access to their complete childhood medical history well into adulthood.

For example, if a child receives treatment at age 10, the standard 7-year retention period would expire when the child is 17. The minor protection rule extends that deadline to age 25, adding an extra eight years of required retention.

Minors who lawfully obtained healthcare without parental consent also have exclusive rights over the medical records related to that care. This means parents and guardians cannot access those specific records without the minor's authorization.

Hospital vs. Physician: Key Differences

While the baseline 7-year retention period is the same for both individual practitioners and health facilities, there are practical differences in how the rules apply.

Hospitals and Health Facilities

• Must maintain records that include the purpose of hospitalization in addition to standard documentation
• Must take affirmative precautions against wrongful alteration or destruction of records
• Face a $10,000 administrative fine specifically for failing to protect record integrity
• Must maintain records in a manner that ensures accessibility to patients or authorized representatives
• Subject to facility licensing requirements that may impose additional documentation standards

Individual Physicians and Licensed Practitioners

• Must keep a full and complete record for each patient, including all tests, exams, observations, and treatments
• Subject to up to $10,000 in administrative fines for failure to comply due to gross negligence or willful misconduct
• Must comply with practice closure notification requirements under MCL 333.16213
• May face professional discipline through licensing board action in addition to statutory penalties

Federal Requirements: HIPAA and CMS

HIPAA (Health Insurance Portability and Accountability Act)

A common misconception is that HIPAA establishes a federal minimum retention period for medical records. It does not. According to the U.S. Department of Health and Human Services, the HIPAA Privacy Rule does not include medical record retention requirements. State laws govern how long medical records must be retained.

However, HIPAA does require that covered entities apply appropriate administrative, technical, and physical safeguards to protect medical records and other protected health information (PHI) for as long as those records are maintained. HIPAA also requires that covered entities retain their HIPAA-related policies, procedures, and documentation (such as authorizations and business associate agreements) for a minimum of 6 years from the date of creation or the date when the document was last in effect, whichever is later, under 45 CFR 164.530(j).

When a Michigan provider destroys medical records, HIPAA requires that the destruction renders the information unreadable, indecipherable, and unable to be reconstructed.

CMS (Centers for Medicare and Medicaid Services)

Providers who participate in Medicare or Medicaid face additional federal retention obligations. CMS requires that Medicare providers and suppliers retain medical records for a minimum of 7 years from the date of service. This aligns with Michigan's state requirement.

Medicare Part D sponsors face a longer obligation and must maintain records for a minimum of 10 years. Providers must also comply with audit and documentation requests from CMS and its contractors.

Since CMS and Michigan both require a 7-year minimum, most providers in the state satisfy both requirements simultaneously. However, providers participating in Medicare Part D or other specialized programs should verify whether the longer 10-year federal requirement applies to their specific records.

Patient Access Rights Under Michigan Law

Michigan's Medical Records Access Act (Act 47 of 2004) establishes the right of patients and their authorized representatives to examine or obtain copies of their medical records.

How to Request Records

A patient or authorized representative must submit a written, signed, and dated request to the healthcare provider or facility that maintains the record. The request must be dated no more than 60 days before submission.

Provider Response Timeline

Healthcare providers and facilities must respond to a records request within a reasonable time. If a provider cannot comply promptly, they may request a single extension of up to 30 days, but must provide a written explanation for the delay.

Fees for Copies

The Michigan Department of Health and Human Services publishes updated fee schedules annually, adjusted by the Detroit Consumer Price Index. As of recent fee schedules, providers may charge:

• An initial search and retrieval fee per request
• A per-page fee that decreases for larger requests (tiered pricing for the first 20 pages, pages 21 through 50, and pages 51 and beyond)
• Postage costs for mailed copies

A provider cannot charge a patient the initial fee for their own medical records. Additionally, medically indigent individuals are entitled to one free copy of their medical records.

HIPAA Right of Access

In addition to Michigan law, HIPAA gives patients a federal right to access their health information under 45 CFR 164.524. Providers must respond to HIPAA access requests within 30 days (with one 30-day extension permitted). HHS has actively enforced this right, reaching multiple settlement agreements with providers who failed to provide timely access.

Proper Destruction of Medical Records

Michigan law specifies both the timing and methods for destroying medical records.

When Records May Be Destroyed

Records may be destroyed after the applicable retention period has expired (7 years for standard records, 15 years for sensitive exam records, or age 25 for minor patients, whichever is longest). Records less than 7 years old may not be destroyed without written patient notice and authorization.

Required Destruction Methods

Under both MCL 333.16213 and MCL 333.20175, records must be destroyed using methods that ensure continued confidentiality. Acceptable methods include:

• Shredding of paper records
• Incineration of paper records
• Electronic deletion that renders digital records unrecoverable
• Any other method that ensures the information cannot be reconstructed or accessed

Notice Requirements Before Destruction

Before destroying records that are less than 7 years old (which would only be permissible in specific circumstances), providers must:

1. Send written notice to the patient's last known address
2. Provide the patient 30 days to request copies or designate a transfer location
3. Obtain written authorization from the patient for destruction

If a provider fails to properly destroy records, the Michigan Department of Licensing and Regulatory Affairs (LARA) may intervene, including contracting with third parties to ensure proper disposal at the provider's expense.

Practice Closure and Record Transfer

When a Michigan healthcare provider sells a practice, retires, or otherwise stops practicing, the law prohibits abandoning patient records.

Required Steps for Practice Closure

Under MCL 333.16213, a closing practitioner or their personal representative must:

1. Notify the department in writing, specifying who will have custody of the records and how patients can request access
2. Transfer records to another licensed healthcare provider, health facility, or agency, or if requested by the patient, directly to the patient or a designated provider
3. If records will be destroyed rather than transferred, notify each patient at their last known address and provide 30 days to request copies or designate a transfer destination

Health Facility Closure

Under MCL 333.20175, health facilities and agencies face the same prohibition against abandoning records. A closing facility must notify the department and arrange for continued custody and patient access. The department retains authority to step in and ensure records are properly handled if a facility fails to comply.

Deceased Practitioners

If a licensee dies, the personal representative of their estate assumes responsibility for the medical records. The same notification and transfer or destruction requirements apply.

Penalties for Violations

Michigan imposes significant penalties for failing to comply with medical records retention requirements.

Administrative Fines

• Individual practitioners (MCL 333.16213): Up to $10,000 for failure to comply due to gross negligence or willful and wanton misconduct
• Hospitals (MCL 333.20175): $10,000 fine for failing to prevent wrongful alteration or destruction of records
• Documentation violations (MCL 333.16213a): $1,000 for first violation, $2,500 for second violation

Criminal Penalties

• Third or subsequent documentation violation: Misdemeanor, up to 180 days imprisonment and/or $5,000 fine
• Gross negligence documentation violation: Misdemeanor, up to 180 days imprisonment and/or $5,000 fine
• Intentional documentation violation: Felony, up to 2 years imprisonment and/or $7,500 fine

Professional Discipline

Beyond statutory penalties, licensing boards and disciplinary subcommittees retain authority to impose additional professional sanctions, including license suspension or revocation.

Best Practices for Michigan Healthcare Providers

To maintain compliance with Michigan medical records retention laws, providers should consider the following practices:

• Adopt a retention schedule that accounts for the 7-year standard, the 15-year sensitive exam rule, and the age-25 rule for minors, and apply whichever period is longest
• Track retention dates per record entry rather than per patient, since the 7-year clock starts from each individual date of service
• Implement secure storage that protects records from unauthorized access, alteration, and accidental destruction for both paper and electronic formats
• Document destruction by maintaining a log of what records were destroyed, when, and by what method
• Develop a closure plan that addresses record transfer and patient notification well before retiring or closing a practice
• Stay current with annual fee schedule updates from the Michigan Department of Health and Human Services
• Consider longer retention voluntarily, since the statute of limitations for medical malpractice claims in Michigan can extend beyond the 7-year record retention minimum in some cases