Michigan Medical Records Retention Laws (2026 Guide)

Michigan requires licensed healthcare providers to retain patient medical records for a minimum of 7 years from the date of service under MCL 333.16213. Records involving certain sensitive examinations must be kept for 15 years. The statute does not set a separate retention period for minor patients' records; the same 7-year/15-year rule applies regardless of the patient's age.

Michigan has specific laws governing how long doctors, hospitals, and other healthcare providers must keep patient medical records. Whether you are a healthcare provider trying to stay compliant or a patient seeking access to your own files, understanding these requirements is essential.

This guide breaks down every aspect of Michigan medical records retention law, including the differences between individual practitioners and facilities, special rules for minors, federal overlay requirements from HIPAA and CMS, patient access rights, proper destruction methods, and what happens when a practice closes.

Michigan Medical Records Retention: The Core Statutes

Two primary statutes govern medical records retention in Michigan. Each applies to a different category of healthcare provider.

MCL 333.16213: Individual Licensed Practitioners

MCL 333.16213 applies to individually licensed healthcare professionals, including physicians, dentists, nurses, psychologists, physical therapists, and other practitioners licensed under Article 15 of the Michigan Public Health Code.

Under this statute, every licensee must keep and maintain a record for each patient. That record must include a full and complete account of all tests and examinations performed, observations made, and treatments provided.

The minimum retention period is 7 years from the date of service. This means each individual entry in a patient record must be retained for at least seven years from when that specific service occurred, not from the patient's last visit.

MCL 333.20175: Health Facilities and Agencies

MCL 333.20175 applies to licensed health facilities and agencies. This category includes hospitals, nursing homes, freestanding surgical outpatient facilities, hospices, home health agencies, and clinical laboratories.

The retention requirement for facilities mirrors the individual practitioner standard: a minimum of 7 years from the date of service. Facilities must also maintain records in a manner that protects their integrity, ensures confidentiality and proper use, and guarantees accessibility to patients or their authorized representatives.

Hospitals face an additional obligation. They must take precautions to ensure that patient records are not wrongfully altered or destroyed. A hospital that fails to comply with this safeguard requirement is subject to an administrative fine of $10,000.

The 15-Year Retention Rule for Sensitive Examinations

A 2023 amendment to Michigan law (2023 Act 62, effective October 10, 2023) added a longer retention requirement for certain types of medical records.

Records that document a medical service involving vaginal or anal penetration of the patient must be retained for 15 years from the date of service, rather than the standard seven years. This extended requirement applies under both MCL 333.16213 (individual practitioners) and MCL 333.20175 (health facilities).

The law defines specific exceptions where the standard 7-year period applies instead. The 15-year rule does not apply when the service primarily addresses:

• Urological health
• Gastrointestinal health
• Reproductive or gynecological health
• Sexual health
• Medical emergencies involving an immediate threat of serious risk to life or physical health
• Rectal administration of drugs or medicine
• Temperature measurement procedures

For records subject to the 15-year rule, providers must expressly state in the patient record that vaginal or anal penetration was performed.

A Second 15-Year Trigger That Applies Only to Facilities

MCL 333.20175(2)(b)(ii) adds a second 15-year retention trigger that has no counterpart in the practitioner statute. A health facility or agency must retain a patient's record for a minimum of 15 years from the date of service if the patient has filed a complaint with the facility alleging sexual misconduct by an individual who is employed by, under contract to, or granted privileges by that facility.

The statute defines "sexual misconduct" for this purpose by reference to specific sections of the Michigan Penal Code, and the trigger applies regardless of whether the conduct resulted in a criminal conviction. Hospitals, nursing homes, and other licensed facilities should therefore flag complaint files for the longer period, because MCL 333.16213 does not impose this trigger on individual licensees.

Penalties for Noncompliance with the 15-Year Rule

MCL 333.16213a establishes a tiered penalty structure for failing to properly document these sensitive examinations:

• First violation: Administrative fine up to $1,000
• Second violation: Administrative fine up to $2,500
• Third or subsequent violation: Misdemeanor punishable by up to 180 days imprisonment, a fine up to $5,000, or both
• Gross negligence: Misdemeanor with up to 180 days imprisonment, a fine up to $5,000, or both
• Intentional violation: Felony with up to 2 years imprisonment, a fine up to $7,500, or both

Retention Rules for Minor Patients

Michigan's medical records statute does not vary the retention period by a patient's age. The age of majority in Michigan is 18 under the Age of Majority Act, which is relevant to when a former minor patient gains full control over their own records, not to how long those records must be kept.

MCL 333.16213(2) exhaustively lists only two retention categories -- a 7-year minimum from the date of service, and 15 years for records of certain sensitive examinations -- and applies both the same way to every patient regardless of age. There is no statutory provision extending retention to a fixed age, such as 25, for minor patients. (MCL 333.20175(2), the parallel statute for health facilities, uses the same two-category structure of 7 years or 15 years, with no minor-age extension either.)

The statute does include a savings clause: retention runs "unless a longer retention period is otherwise required under federal or state laws or regulations or by generally accepted standards of medical practice." Because minors generally cannot bring their own legal claims until reaching the age of majority, many providers voluntarily retain pediatric records well beyond the 7-year statutory minimum as a matter of professional practice, even though Michigan law does not require it.

Minors who lawfully obtained healthcare without parental consent also have exclusive rights over the medical records related to that care. This means parents and guardians cannot access those specific records without the minor's authorization.

Hospital vs. Physician: Key Differences

While the baseline 7-year retention period is the same for both individual practitioners and health facilities, there are practical differences in how the rules apply.

Hospitals and Health Facilities

• Must maintain records that include the purpose of hospitalization in addition to standard documentation
• Must take affirmative precautions against wrongful alteration or destruction of records
• Face a $10,000 administrative fine specifically for failing to protect record integrity
• Must maintain records in a manner that ensures accessibility to patients or authorized representatives
• Must retain a record for 15 years when the patient has filed a sexual-misconduct complaint with the facility about someone it employs, contracts with, or has granted privileges (MCL 333.20175(2)(b)(ii)), a trigger the practitioner statute does not contain
• Closure duties, including the department notice and the transfer-or-destroy choice, come from MCL 333.20175a rather than MCL 333.20175
• Subject to facility licensing requirements that may impose additional documentation standards

Individual Physicians and Licensed Practitioners

• Must keep a full and complete record for each patient, including all tests, exams, observations, and treatments
• Subject to up to $10,000 in administrative fines for failure to comply due to gross negligence or willful misconduct
• Must comply with practice closure notification requirements under MCL 333.16213
• May face professional discipline through licensing board action in addition to statutory penalties

Federal Requirements: HIPAA and CMS

HIPAA (Health Insurance Portability and Accountability Act)

A common misconception is that HIPAA establishes a federal minimum retention period for medical records. It does not. According to the U.S. Department of Health and Human Services, the HIPAA Privacy Rule does not include medical record retention requirements. State laws govern how long medical records must be retained.

However, HIPAA does require that covered entities apply appropriate administrative, technical, and physical safeguards to protect medical records and other protected health information (PHI) for as long as those records are maintained. HIPAA also requires that covered entities retain their HIPAA-related policies, procedures, and documentation (such as authorizations and business associate agreements) for a minimum of 6 years from the date of creation or the date when the document was last in effect, whichever is later, under 45 CFR 164.530(j).

When a Michigan provider destroys medical records, HIPAA requires that the destruction renders the information unreadable, indecipherable, and unable to be reconstructed.

CMS (Centers for Medicare and Medicaid Services)

Providers who participate in Medicare or Medicaid face additional federal retention obligations. CMS requires that Medicare providers and suppliers retain medical records for a minimum of 7 years from the date of service. This aligns with Michigan's state requirement.

Medicare Part D sponsors face a longer obligation and must maintain records for a minimum of 10 years. Providers must also comply with audit and documentation requests from CMS and its contractors.

Since CMS and Michigan both require a 7-year minimum, most providers in the state satisfy both requirements simultaneously. However, providers participating in Medicare Part D or other specialized programs should verify whether the longer 10-year federal requirement applies to their specific records.

Patient Access Rights Under Michigan Law

Michigan's Medical Records Access Act (Act 47 of 2004) establishes the right of patients and their authorized representatives to examine or obtain copies of their medical records.

How to Request Records

A patient or authorized representative must submit a written, signed, and dated request to the healthcare provider or facility that maintains the record. The request must be dated no more than 60 days before submission.

Provider Response Timeline

Under MCL 333.26265(2), a health care provider or health facility must act on a written request as promptly as required under the circumstances, and in no event later than 30 days after receiving the request. If the medical record is not maintained or accessible on-site, the outer deadline is 60 days after receipt.

A provider that cannot act within that period may extend the response time by no more than 30 days, and only once per request. To claim the extension, it must give the patient a written statement of the reasons for the delay within the original response period under MCL 333.26265(3). A written explanation offered after the 30-day or 60-day deadline has already run does not satisfy the statute.

Fees for Copies

The Michigan Department of Health and Human Services publishes updated fee schedules annually, adjusted by the Detroit Consumer Price Index. As of recent fee schedules, providers may charge:

• An initial search and retrieval fee per request
• A per-page fee that decreases for larger requests (tiered pricing for the first 20 pages, pages 21 through 50, and pages 51 and beyond)
• Postage costs for mailed copies

A provider cannot charge a patient the initial fee for their own medical records. Additionally, medically indigent individuals are entitled to one free copy of their medical records.

HIPAA Right of Access

In addition to Michigan law, HIPAA gives patients a federal right to access their health information under 45 CFR 164.524. Providers must respond to HIPAA access requests within 30 days (with one 30-day extension permitted). HHS has actively enforced this right, reaching multiple settlement agreements with providers who failed to provide timely access.

Proper Destruction of Medical Records

Michigan law specifies both the timing and methods for destroying medical records.

When Records May Be Destroyed

Records may be destroyed after the applicable retention period has expired (7 years for standard records, 15 years for sensitive exam records; the statute applies these same periods to minor patients' records, with no separate age-based rule). Records less than 7 years old may not be destroyed without written patient notice and authorization.

Required Destruction Methods

Under both MCL 333.16213 and MCL 333.20175, records must be destroyed using methods that ensure continued confidentiality. Acceptable methods include:

• Shredding of paper records
• Incineration of paper records
• Electronic deletion that renders digital records unrecoverable
• Any other method that ensures the information cannot be reconstructed or accessed

Notice Requirements Before Destruction

Before destroying records that are less than 7 years old (which would only be permissible in specific circumstances), providers must:

1. Send written notice to the patient's last known address
2. Provide the patient 30 days to request copies or designate a transfer location
3. Obtain written authorization from the patient for destruction

If a provider fails to properly destroy records, the Michigan Department of Licensing and Regulatory Affairs (LARA) may intervene, including contracting with third parties to ensure proper disposal at the provider's expense.

Practice Closure and Record Transfer

When a Michigan healthcare provider sells a practice, retires, or otherwise stops practicing, the law prohibits abandoning patient records.

Required Steps for Practice Closure

Under MCL 333.16213, a closing practitioner or their personal representative must:

1. Notify the department in writing, specifying who will have custody of the records and how patients can request access
2. Transfer records to another licensed healthcare provider, health facility, or agency, or if requested by the patient, directly to the patient or a designated provider
3. If records will be destroyed rather than transferred, notify each patient at their last known address and provide 30 days to request copies or designate a transfer destination

Health Facility Closure

The facility-side rule is a separate section. MCL 333.20175a provides that if a health facility or agency closes or otherwise ceases operation, it shall not abandon the records required under MCL 333.20175(1) and shall send a written notice to the department specifying who will have custody of the medical records and how a patient may request access to or copies of them.

The closing facility must then do one of two things:

1. Transfer the records to a successor health facility or agency, to the patient or a specific provider the patient designates, or to a medical records company it had contracted with to maintain and provide access to the records
2. Destroy the records only after sending written notice to the last known address of each patient, giving the patient 30 days to request a copy or designate a transfer destination, and receiving written authorization to destroy. If the patient does not respond, records less than 7 years old may not be destroyed

A facility that fails to comply with MCL 333.20175a is subject to an administrative fine of up to $10,000 if the failure resulted from gross negligence or willful and wanton misconduct. The section does not apply to a health facility or agency that is a health maintenance organization.

Separately, under MCL 333.20175(5), the department may step in and arrange for proper destruction or disposal of records a facility mishandled, and may assess the facility for the costs of doing so.

Deceased Practitioners

If a licensee dies, the personal representative of their estate assumes responsibility for the medical records. The same notification and transfer or destruction requirements apply.

Penalties for Violations

Michigan imposes significant penalties for failing to comply with medical records retention requirements.

Administrative Fines

• Individual practitioners (MCL 333.16213): Up to $10,000 for failure to comply due to gross negligence or willful and wanton misconduct
• Hospitals (MCL 333.20175): $10,000 fine for failing to prevent wrongful alteration or destruction of records
• Facility closure (MCL 333.20175a): Up to $10,000 for failing to comply with the closure notice, transfer, and destruction rules due to gross negligence or willful and wanton misconduct
• Documentation violations (MCL 333.16213a): $1,000 for first violation, $2,500 for second violation

Criminal Penalties

• Third or subsequent documentation violation: Misdemeanor, up to 180 days imprisonment and/or $5,000 fine
• Gross negligence documentation violation: Misdemeanor, up to 180 days imprisonment and/or $5,000 fine
• Intentional documentation violation: Felony, up to 2 years imprisonment and/or $7,500 fine

Professional Discipline

Beyond statutory penalties, licensing boards and disciplinary subcommittees retain authority to impose additional professional sanctions, including license suspension or revocation.

Best Practices for Michigan Healthcare Providers

To maintain compliance with Michigan medical records retention laws, providers should consider the following practices:

• Adopt a retention schedule that accounts for the 7-year standard and the 15-year sensitive exam rule; consider retaining pediatric records longer than the statutory minimum as a matter of practice, since Michigan's statute does not set a separate age-based rule for minors
• Track retention dates per record entry rather than per patient, since the 7-year clock starts from each individual date of service
• Implement secure storage that protects records from unauthorized access, alteration, and accidental destruction for both paper and electronic formats
• Document destruction by maintaining a log of what records were destroyed, when, and by what method
• Develop a closure plan that addresses record transfer and patient notification well before retiring or closing a practice
• Stay current with annual fee schedule updates from the Michigan Department of Health and Human Services
• Consider longer retention voluntarily, since the statute of limitations for medical malpractice claims in Michigan can extend beyond the 7-year record retention minimum in some cases