Pending bills to recheck
- MI SB 359. As of Oct 22, 2026: SB 359 has been in the Committee of the Whole since 2025-06-12. It is not law.
What a provider can and can't say in Michigan
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 333.16221(e)(ii); no board order located |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | 333.16221(e)(ii); no board order located |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 333.16221(e)(ii); no board order located |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 333.16221(e)(ii); no board order located |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No (cosmetologists/estheticians are not Article 15 health licensees) | 333.16221(e)(ii); no board order located |
- Consumer privacy and health data law: Michigan has no comprehensive consumer privacy law in force as of October 22, 2026. Status of proposals: SB 359 in Committee of the Whole since 2025-06-12. Bills are not law. [MI-005]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Entities that comply with HIPAA are deemed compliant. [MI-004]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules. [MI-001]
- Patient confidentiality duties: Board discipline for confidentiality breaches rests on a general professional-conduct ground (333.16221(e)(ii)). [MI-001]
- Research notes and gaps: Whether patients have a private right to sue was not researched for this jurisdiction (a gap). [U-98]
- Research notes and gaps: Whether Michigan has a likeness statute was not researched (a gap). [U-98]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (Procedure rules (binding delegation statute) plus guidance). [MI-002, MI-003]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists. [MI-001, U-97]
Sources:
- [MI-001] MCL 333.16221(d)(i), (e)(ii); 333.16226(1) (https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-333-16221)
- [MI-002] MCL 333.16215(1)-(2) (https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-333-16215)
- [MI-003] LARA / MDCH Position Statement on use of laser equipment (https://www.michigan.gov/lara/bureau-list/cscl/corps/corporations/intro/use-of-laser-equipment-by-health-professionals/mdch-position-statement)
- [MI-004] MCL 445.63(r); 445.72(4), (10) (https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-72)
- [MI-005] n/a (https://legislature.mi.gov/Bills/Bill?ObjectName=2025-SB-0359)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Michigan (MI) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Public Health Code 333.16221(e)(ii) (betrayal of professional confidence; all licensees) | Yes - applies to licensed providers regardless of HIPAA status | None in force (SB 359 pending) | 445.72: medical info NOT covered; without unreasonable delay; HIPAA-compliant deemed compliant | 333.16221(e)(ii); no board order located | HIPAA if covered; (e)(ii) betrayal of confidence; likeness law not researched | None statutory located (common law not researched) | None statutory located (common law not researched) | LARA Bureau of Professional Licensing (boards of medicine, osteopathic medicine, dentistry, nursing), AG | License sanctions incl. fine (amounts not verified) | E4 | Medium-High | 2026-10-22 |
| Michigan (MI) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Public Health Code 333.16221(e)(ii) (betrayal of professional confidence; all licensees) | Yes - applies to licensed providers regardless of HIPAA status | None in force (SB 359 pending) | 445.72: medical info NOT covered; without unreasonable delay; HIPAA-compliant deemed compliant | 333.16221(e)(ii); no board order located | HIPAA if covered; (e)(ii) betrayal of confidence; likeness law not researched | None statutory located (common law not researched) | None statutory located (common law not researched) | LARA Bureau of Professional Licensing (boards of medicine, osteopathic medicine, dentistry, nursing), AG | License sanctions incl. fine (amounts not verified) | E4 | Medium-High | 2026-10-22 |
| Michigan (MI) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Public Health Code 333.16221(e)(ii) (betrayal of professional confidence; all licensees) | Yes - applies to licensed providers regardless of HIPAA status | None in force (SB 359 pending) | 445.72: medical info NOT covered; without unreasonable delay; HIPAA-compliant deemed compliant | 333.16221(e)(ii); no board order located | HIPAA if covered; (e)(ii) betrayal of confidence; likeness law not researched | None statutory located (common law not researched) | None statutory located (common law not researched) | LARA Bureau of Professional Licensing (boards of medicine, osteopathic medicine, dentistry, nursing), AG | License sanctions incl. fine (amounts not verified) | E4 | Medium-High | 2026-10-22 |
| Michigan (MI) | Medical med spa | Depends; cash-only med spas often not covered | Public Health Code 333.16221(e)(ii) (betrayal of professional confidence; all licensees) | Yes - applies to licensed providers regardless of HIPAA status | None in force (SB 359 pending) | 445.72: medical info NOT covered; without unreasonable delay; HIPAA-compliant deemed compliant | 333.16221(e)(ii); no board order located | HIPAA if covered; (e)(ii) betrayal of confidence; likeness law not researched | None statutory located (common law not researched) | None statutory located (common law not researched) | LARA Bureau of Professional Licensing (boards of medicine, osteopathic medicine, dentistry, nursing), AG | License sanctions incl. fine (amounts not verified) | E4 | Medium-High | 2026-10-22 |
| Michigan (MI) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Public Health Code 333.16221(e)(ii) (betrayal of professional confidence; all licensees) | No (cosmetologists/estheticians are not Article 15 health licensees) | None in force (SB 359 pending) | 445.72: medical info NOT covered; without unreasonable delay; HIPAA-compliant deemed compliant | 333.16221(e)(ii); no board order located | HIPAA if covered; (e)(ii) betrayal of confidence; likeness law not researched | None statutory located (common law not researched) | None statutory located (common law not researched) | LARA Bureau of Professional Licensing (boards of medicine, osteopathic medicine, dentistry, nursing), AG | License sanctions incl. fine (amounts not verified) | E4 | Medium-High | 2026-10-22 |
Related pages
Topics
Healthcare industry
Sources
MI-005. n/a
Michigan has no comprehensive consumer privacy law in force; the Personal Data Privacy Act (SB 359) remains pending.
Search result (negative) · Per secondary tracker · High · Official history read 2026-10-22 (V-029): referred to Committee of the Whole 2025-06-12, no later action. Proposed bills are not law.
https://legislature.mi.gov/Bills/Bill?ObjectName=2025-SB-0359
MI-004. MCL 445.63(r); 445.72(4), (10)
Identity Theft Protection Act breach notice: 'personal information' = name plus SSN, driver's license/state ID, or financial account with code; medical information is NOT covered. Notice without unreasonable delay. A person subject to and complying with HIPAA is considered in compliance.
Statute · Explicit · High · HIPAA deemed-compliance verified.
https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-72
MI-001. MCL 333.16221(d)(i), (e)(ii); 333.16226(1)
Public Health Code: 'betrayal of a professional confidence' is unprofessional conduct for every health-profession licensee (physicians, dentists, nurses and others); false or misleading advertising is an unethical business practice. Sanctions for (e)(ii) include reprimand, probation, suspension, revocation, restitution, denial or fine.
Statute · Explicit · High · No Michigan board order applying (e)(ii) to an online review or photo was located (E4).
https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-333-16221
MI-002. MCL 333.16215(1)-(2)
Delegation: a licensee may delegate selected acts to a licensed or unlicensed individual qualified by education, training or experience, under supervision, but not acts requiring the licensee's own level of judgment; physicians may delegate procedures using surgical instrumentation only to licensees (narrow exceptions require physical presence).
Statute · Explicit · High · No med spa statute located.
https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-333-16215
MI-003. LARA / MDCH Position Statement on use of laser equipment
LARA (former MDCH) position statement: physicians and dentists may delegate laser use to licensed or unlicensed individuals under supervision, meaning acknowledged training, continuous availability of direct communication, regularly scheduled availability to review records and practice, and written procedures.
Guidance · Explicit · Medium-High · Guidance, not law.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All