Michigan Health Data Protection Requirements: 2026 Compliance Guide

This guide distills Michigan-specific expectations and federal rules into a practical playbook you can apply across programs and vendor relationships. You’ll find actionable steps for Electronic Visit Verification (EVV), breach notification, governance, confidentiality, HIPAA safeguards, behavioral health consent, and annual review—optimized for operations that handle electronic protected health information.

Electronic Visit Verification Implementation

Scope and applicability

EVV applies to Medicaid-funded personal care and home health services delivered in the community. If you bill Michigan Medicaid, verify your CHAMPS Provider Enrollment status, confirm which procedure codes are in scope, and map EVV capture points to your scheduling, payroll, and claims workflows.

Core data elements

• Type of service performed and service authorization reference.
• Individual receiving services and the caregiver delivering them.
• Date of service, check-in and check-out times, and visit location.
• Attestation of visit accuracy and audit trail (edits, overrides, reasons).

Implementation steps

• Governance: assign an EVV owner, privacy officer, and IT lead to define roles and escalation paths.
• Integration: connect EVV with claims and CHAMPS-facing processes so visit data supports adjudication and program integrity.
• Security: treat EVV records as ePHI; apply encryption in transit and at rest, role-based access, and device security controls.
• Quality controls: implement GPS/telephony validation, exception queues, and daily reconciliation between EVV, schedules, and claims.
• Training and monitoring: train direct care workers, run post-implementation audits, and publish KPIs (visit verification rate, late check-ins, unresolved exceptions).

Data Breach Notification Procedures

Immediate triage and risk assessment

Activate your incident response plan upon suspected exposure of PHI or personal information. Contain the event, preserve logs, and perform a documented risk assessment aligning with the HIPAA privacy rule breach analysis to determine whether notification is required.

Michigan Identity Theft Protection Act alignment

Michigan’s Identity Theft Protection Act sets expectations for notifying residents when certain personal information is compromised. Provide clear, concise notices without unreasonable delay, describe what happened, the types of information involved, steps you have taken, recommended protections for individuals, and how to reach your response team.

Regulatory and third‑party notifications

• Individuals: notify by mail or other permitted methods; use substitute notice if contact data is insufficient.
• Consumer reporting agencies: when a breach affects a large number of residents, provide appropriate notice to major CRAs.
• Michigan Attorney General data breach notification: align with published guidance for state residents and coordinate as applicable alongside your HIPAA reporting obligations.
• Business associates: ensure contractually required notifications flow between covered entities and vendors within agreed timelines.

Documentation

Retain your investigation record, risk assessment, copies of notices, distribution evidence, and corrective actions. Use lessons learned to update policies, access controls, vendor oversight, and training.

Data Privacy Oversight and Governance

Program structure

Establish a cross‑functional privacy and security council with a designated privacy officer, security officer, compliance lead, and operational data stewards. Meet routinely to review incidents, approve data uses, and track mitigation plans.

Data-sharing agreements

Use data-sharing agreements that define purpose, legal basis, minimum necessary data, access controls, retention, redisclosure limits, and audit rights. Pair DSAs with business associate agreements where vendors create, receive, maintain, or transmit PHI.

State alignment and analytics

Coordinate internal standards with statewide practices used by the Michigan Center for Data and Analytics to promote consistent definitions, high-quality data pipelines, and responsible analytics. Document how your governance policies apply when exchanging data with state programs and partners.

Health Data Confidentiality Standards

Foundational rules

Apply the HIPAA privacy rule’s minimum‑necessary standard to every disclosure. Maintain current Notices of Privacy Practices, workforce training, and sanction policies, and validate authorization forms before releasing records.

Protecting ePHI

Safeguard ePHI with multi‑factor authentication, least‑privilege access, encryption, continuous monitoring, and immutable logging. Implement secure backups, tested restoration, endpoint hardening, and safe decommissioning for devices and media.

Sensitive segments

Segment behavioral health and substance use disorder information to honor heightened protections and redisclosure limits. Use data labeling, access flags, and consent checks so specially protected data is only available to authorized recipients for permitted purposes.

HIPAA Compliance and Safeguards

Administrative, physical, and technical controls

• Administrative: enterprise risk analysis, policies and procedures, workforce training, sanction and discipline, vendor management, contingency planning.
• Physical: facility access controls, device and media controls, secure storage, and disposal practices.
• Technical: unique IDs, automatic logoff, audit controls, integrity checks, encryption, and secure transmission.

Operationalizing compliance

Map each safeguard to a control owner, implement dashboards for key metrics (access exceptions, patch cadence, failed logins, encryption coverage), and schedule quarterly control testing. Refresh business associate inventories and verify that vendors meet contractually required safeguards.

Behavioral Health Consent Requirements

Consent content and processes

Obtain written, informed consent before sharing behavioral health records unless a specific exception applies. The authorization should identify what information will be shared, with whom, for what purpose, its expiration, the right to revoke, and a clear redisclosure warning where required.

Special considerations

For substance use disorder records, ensure consents include the elements needed for specially protected information and avoid unauthorized redisclosure. Where minors or guardians are involved, verify who may consent and how revocation or expiration affects ongoing care coordination.

Technology enablement

Use a consent management process that supports granular permissions, segmentation, and auditable release decisions. Align data-sharing agreements and user access with the consent on file, and enable “break‑the‑glass” only for documented emergencies with post‑event review.

Data Integrity and Annual HIPAA Review

Strengthening data integrity

• Validate inputs and identities at capture; reconcile EVV records, clinical documentation, and claims daily.
• Use hashing, checksums, and versioning for critical datasets; enable tamper‑evident audit logs.
• Build exception workflows for duplicates, gaps, and time/location conflicts; measure and remediate trends.

Annual HIPAA cycle

• Conduct an enterprise security risk analysis and update risk treatment plans.
• Review and re‑approve policies, procedures, and retention schedules; refresh workforce training.
• Reassess business associate agreements, data-sharing agreements, and third‑party risk.
• Test disaster recovery, incident response, and breach notification through tabletop exercises.

Conclusion

Michigan compliance is achievable when you integrate EVV accuracy, prompt and thorough breach response, disciplined governance, rigorous confidentiality standards, robust HIPAA safeguards, and precise behavioral health consent. Build these elements into routine operations, measure them, and improve them annually.

FAQs

What agencies are required to use Electronic Visit Verification in Michigan?

Medicaid-enrolled providers that deliver in‑home personal care or home health services must use EVV. That typically includes home health agencies, personal care agencies, and fiscal intermediaries supporting self‑directed services when claims are submitted to Michigan Medicaid.

How must entities notify individuals following a data breach?

After confirming a reportable breach, notify affected individuals without unreasonable delay using a clear written notice that explains what happened, what information was involved, steps you are taking, recommended actions they can take, and how to contact you. When a large number of residents is involved, also follow consumer reporting agency notice requirements and coordinate with Michigan Attorney General data breach notification guidance as applicable.

Who oversees data privacy policies in Michigan health data?

Covered entities and business associates are responsible for their own HIPAA compliance, typically led by a designated privacy officer and security officer. State program requirements are set by the administering agencies, while enforcement of HIPAA rests with the federal Office for Civil Rights; Michigan’s Identity Theft Protection Act is enforced at the state level. For analytics and statewide standards, organizations often align practices with the Michigan Center for Data and Analytics and related state guidance.

What are the consent requirements for sharing behavioral health records?

You must obtain valid, written consent that specifies what information will be shared, with whom, for what purpose, its expiration, and the right to revoke. Include required redisclosure warnings for specially protected information and ensure your release processes and access controls honor the consent on file, including heightened protections for substance use disorder records.