Michigan Hospital Security Privacy Laws: A Guide for Security Departments

What privacy rules govern patient information in Michigan hospitals?

Hospital security work can expose you to patient names, room locations, medical conditions, conversations, records, and images. The main federal framework is HIPAA’s Privacy Rule and Security Rule. Michigan’s Public Health Code also requires health facilities to maintain patient records in a way that protects their integrity, confidentiality, proper use, and availability to patients or authorized representatives. See HHS’s HIPAA Privacy Rule summary, HHS’s HIPAA Security Rule summary, and Michigan Public Health Code § 333.20175.

For security departments, the practical rule is to handle patient information only for authorized work purposes and to avoid unnecessary access or disclosure. The HIPAA minimum necessary standard generally requires covered entities to take reasonable steps to limit uses, disclosures, and requests for protected health information (PHI) to what is needed for the purpose. It does not apply to every HIPAA use or disclosure—for example, it does not apply to disclosures to the individual or disclosures made under a valid authorization. HHS guidance on the minimum necessary requirement explains the standard and its exceptions.

Michigan has additional confidentiality protections for mental health records. The Mental Health Code generally treats information in a recipient’s record, and information acquired while providing mental health services, as confidential; disclosures are allowed only under the circumstances and conditions specified by law. Michigan Mental Health Code § 330.1748 sets out those rules. Security staff should route questions about such records to the hospital’s privacy office or authorized clinical leadership rather than decide independently whether disclosure is permitted.

When can security officers access or disclose patient information?

Security officers do not receive general access to patient records merely because they are investigating an incident. Access should be tied to assigned duties and hospital policy. HIPAA requires covered entities to define which workforce members need access to PHI, the categories of information they need, and the conditions for access. A security officer may need a limited detail—such as a patient’s location or a safety-related warning—without needing the full chart.

When security needs information, request it through an authorized clinician, supervisor, or privacy contact and ask only for what is needed to address the incident. Do not browse a chart out of curiosity or use another person’s login. The hospital should document role-based access and apply the minimum necessary standard where it applies. HHS minimum-necessary guidance describes role-based internal access and the limits for routine and non-routine requests.

Disclosure outside the hospital requires a permitted basis under HIPAA or a valid authorization. A protected health information disclosure authorization generally must meet HIPAA’s requirements; a patient’s informal request or a security officer’s judgment alone is not a substitute. HIPAA allows certain law-enforcement disclosures in defined circumstances, such as disclosures required by law or disclosures about a crime that occurred on the hospital’s premises, subject to the applicable conditions. A request from police does not automatically authorize release of an entire record. Refer requests for records or footage to the hospital’s privacy or legal office. See HHS’s law-enforcement disclosure guidance and 45 C.F.R. § 164.508.

HIPAA also permits certain disclosures to avert a serious and imminent threat when the covered entity, in good faith, believes the disclosure is necessary and directs it to someone reasonably able to lessen the threat. This is a limited permission, not a general security-investigation exception. HHS’s guidance on serious threats explains the conditions.

How should hospitals manage surveillance footage and patient images?

Video, photographs, and audio can reveal a person’s identity, presence at a hospital, care setting, or health information. When an image or recording identifies a patient and relates to care or another aspect of the person’s health information, it may be PHI. Treat footage from patient-care areas as sensitive, restrict viewing to authorized purposes, and prevent casual sharing, personal-phone recording, or posting online. HIPAA requires reasonable safeguards against impermissible access and disclosure; see HHS guidance on privacy safeguards.

For psychiatric hospitals, Michigan law specifically permits video surveillance for safety, security, and quality-improvement purposes only in common areas of the psychiatric unit, such as hallways, nursing-station areas, and social-activity areas. Before starting surveillance, the hospital must adopt written procedures that address notice, authorized viewers, permitted viewing, safeguards, duplication and distribution, documentation of access and disclosure, retrieval of distributed recordings, and retention. The statute generally allows archived footage to be kept for up to 30 days, with longer retention when an identified investigation requires it. It also says those surveillance images must not be maintained as part of the recipient’s clinical record. These requirements are specific to the statutory setting; do not assume the same retention period governs every hospital camera system. See Michigan Mental Health Code § 330.1724(9).

Outside those specific psychiatric-hospital provisions, hospitals should set and follow written rules for camera placement, notice, access approval, review logs, evidence preservation, secure transfer, retention, and deletion. Before footage leaves the hospital, confirm the recipient, purpose, legal basis, and scope. Disclosing footage to law enforcement, a patient, an attorney, or another outside party can raise different legal and policy questions; send requests to the privacy or legal office rather than releasing recordings informally.

Michigan’s eavesdropping statute addresses recording private discourse without the permission of all persons engaged in the discourse, and separately restricts installing or using a device to observe or record sounds or events in a private place without consent of the person or persons entitled to privacy there. Michigan Penal Code §§ 750.539a–750.539d provides the definitions and restrictions. Michigan also prohibits specified surveillance or capture of intimate images where a person has a reasonable expectation of privacy. Michigan Penal Code § 750.539j covers those prohibited images. Hospital policies should therefore prohibit recording in patient rooms, bathrooms, changing areas, and other private places unless the hospital has confirmed that recording is lawful and appropriately authorized.

What access-control procedures should hospital security departments document?

HIPAA’s Security Rule requires administrative, physical, and technical safeguards for electronic PHI. Its technical-safeguard provisions include access controls, unique user identification, emergency-access procedures, automatic logoff, and audit controls. The rule sets safeguards; it does not require a particular badge system or a specific “proxy card” technology. See 45 C.F.R. § 164.312 and 45 C.F.R. § 164.310.

Document procedures that make those safeguards workable in the hospital, including:

• Which job roles may enter each area, and who approves, issues, changes, and removes access.
• How identity is verified and how lost, shared, borrowed, or suspected-compromised badges and credentials are handled.
• How staff access is reviewed, how exceptions are approved, and how access is promptly disabled when a role changes or employment ends.
• How entry logs, electronic access logs, and video review are protected, retained, and audited.
• How emergency access is authorized and recorded, and how visitors, contractors, and vendors are escorted or otherwise controlled.

A hospital proxy card access control process can support physical access management when it uses individually assigned credentials, defined permissions, prompt deactivation, and reviewable logs. Treat the card as a credential, not as proof that the person has a legitimate need to view patient information. Keep door-entry permissions separate from clinical-record permissions.

For psychiatric hospitals using surveillance under the Mental Health Code, the written procedures and access documentation described in § 330.1724(9) are specific statutory requirements. Other suggested access-control documentation above is a practical way to implement safeguards and hospital policy; it should not be misrepresented as a single checklist prescribed by HIPAA.

When may licensed hospital security officers make misdemeanor arrests?

Michigan distinguishes ordinary private security guards from properly licensed private security police officers. Under the Private Security Business and Security Alarm Act, a properly licensed private security police officer may make a warrantless arrest under the circumstances provided for public peace officers in Michigan’s Code of Criminal Procedure, but only while on the employer’s premises, during the officer’s employment hours, within the employer’s property boundaries, and in the employer’s full uniform. A security guard without that status should not assume the same statutory authority. See MCL 338.1080.

The incorporated arrest provisions include a misdemeanor committed in the officer’s presence and other circumstances specified by statute. They do not give licensed hospital security police unlimited arrest powers, nor do they expand authority beyond the employer’s premises or the statutory employment and uniform conditions. For the full list of circumstances, review MCL 764.15 together with MCL 338.1080. Arrest decisions should follow hospital policy, training, and coordination procedures with local law enforcement.

Michigan law also requires applicants for licensure as private security police, or their employees, to comply with training requirements prescribed by the department. The specific arrest authority and required training apply to the licensed private security police status described by statute—not automatically to every hospital security employee. See MCL 338.1079–338.1081.

What does Michigan law prohibit when recording in private places?

Michigan defines a “private place” as a place where someone may reasonably expect to be safe from casual or hostile intrusion or surveillance, excluding places open to the public or a substantial group of the public. The Michigan eavesdropping statute prohibits specified recording or observation devices in a private place without consent from the person or persons entitled to privacy there. Its rules also address private conversations and eavesdropping. Michigan Penal Code §§ 750.539a–750.539d sets out the definitions and prohibitions.

Hospitals should not treat a security purpose, a posted camera notice, or access to a room as blanket permission to record private activity or conversations. Room context, the people present, the type of recording, and the circumstances may matter. The law also separately prohibits specified surveillance or recording of intimate images where a person reasonably expects privacy. Michigan Penal Code § 750.539j addresses that conduct. Because statutory application can depend on the facts, consult hospital counsel before recording in patient rooms or other private areas.

How should hospitals protect electronic information and maintain confidentiality?

Hospitals should limit electronic access by role, assign unique user IDs, use audit controls, protect devices and workstations, and maintain procedures for responding to suspected unauthorized access. The HIPAA Security Rule requires a risk-based program of administrative, physical, and technical safeguards for electronic PHI. Its standards apply to covered entities and business associates; the hospital should document how its own policies and systems meet the applicable requirements. See HHS’s HIPAA Security Rule summary and 45 C.F.R. Part 164, Subpart C.

Provide workforce training on the hospital’s privacy and security policies as appropriate to their functions, including how security staff should handle patient identifiers, requests from police, incident reports, recordings, and suspected breaches. HIPAA requires workforce training on the policies and procedures relevant to their functions; it does not establish a universal federal rule requiring every employee to renew a training certificate annually. Hospital-specific policy may set its own training schedule. See 45 C.F.R. § 164.530(b).

Michigan’s Insurance Code includes a written information security program requirement with administrative, technical, and physical safeguards for certain insurance licensees’ nonpublic information. It is not a blanket requirement that applies to every hospital simply because the organization handles patient information. If an entity is subject to that provision as a licensee, its security program must be assessed under the statute’s scope and requirements. See MCL 500.555. Hospitals should not confuse that sector-specific requirement with HIPAA’s broader safeguards for electronic PHI or claim that “nonpublic information physical safeguards” rules apply to every hospital.

In practice, hospital security departments should restrict access to information and footage by role, document approvals and review activity, preserve evidence through approved channels, and refer uncertain disclosures or recording requests to the privacy or legal office. These controls help protect patient confidentiality while allowing security staff to carry out legitimate safety and investigative duties.

FAQs

Can hospital security officers access patient records during an investigation?

Only when access is authorized and needed for the officer’s assigned duties under hospital policy. An investigation by itself does not grant blanket access to the patient’s chart. Security should request the specific information needed through an authorized clinician, supervisor, or privacy contact, and the hospital should apply the HIPAA minimum necessary standard where it applies.

When can hospital surveillance footage be shared outside the hospital?

Footage may be shared only when the disclosure is authorized by the patient or permitted or required under applicable law and hospital policy. HIPAA permits certain law-enforcement disclosures under defined circumstances, but a request alone does not automatically justify releasing all footage or patient information. Refer requests to the hospital’s privacy or legal office, and preserve or limit footage according to the approved process. Special rules apply to video surveillance in psychiatric hospitals under Michigan Mental Health Code § 330.1724(9).

Can security officers record patients in private areas without consent?

Do not assume they can. Michigan law restricts recording devices in private places without consent of the person or persons entitled to privacy, and separately prohibits specified surveillance or capture of intimate images where a person reasonably expects privacy. HIPAA and hospital policy may add further restrictions when recordings reveal patient information. Consult hospital counsel before recording in patient rooms, bathrooms, changing areas, or similar private spaces.

What training and conditions apply to misdemeanor arrests by licensed hospital security officers?

A properly licensed private security police officer must comply with the training requirements prescribed by the department. The officer’s warrantless arrest authority is limited to the circumstances in MCL 764.15 and is subject to MCL 338.1080’s conditions: the officer must be on the employer’s premises, within the employer’s property boundaries, during the officer’s employment hours, and in the employer’s full uniform. The special authority does not automatically apply to every hospital security guard.