Artificial intelligence is finding its way into the everyday work of medical practices—from drafting visit notes and answering patient messages to suggesting billing codes and supporting clinical decisions. For physicians, practice administrators, and other healthcare professionals in Southeast Michigan, the question is not simply whether an AI tool saves time. It is whether the practice can use that tool without compromising patient privacy, clinical judgment, or compliance.

Existing legal obligations do not disappear when a practice introduces AI. HIPAA requirements, Michigan’s medical malpractice standards, and rules governing accurate claims submissions remain relevant to how these tools are selected, configured, and supervised.

Before your practice adopts an AI scribe, chatbot, or decision-support platform, consider the following legal concerns.

Patient Privacy and Vendor Access

An AI tool may receive much more patient information than a practice initially realizes. An ambient documentation system, for example, may process an entire conversation rather than just the final note. A patient-facing chatbot may collect symptoms, medication information, and appointment details.

When a vendor creates, receives, maintains, or transmits protected health information on behalf of a HIPAA-covered practice, it generally acts as a business associate. HHS specifically identifies certain third-party AI chatbots on patient portals as examples of business associates. A HIPAA-compliant business associate agreement, or BAA, is therefore an essential starting point—not an optional vendor add-on.

However, signing a BAA does not complete the practice’s compliance work. HHS also requires covered entities to assess risks associated with their cloud environment and implement appropriate safeguards for electronic protected health information.

Before allowing an AI vendor access to patient information, practices should examine:

• What information the system collects, including recordings, transcripts, prompts, and generated responses.
• Whether patient information is retained or used to train or improve models.
• Which subcontractors receive or store the information.
• How access, security incidents, data deletion, and contract termination are handled.
• Whether the vendor’s service agreement and privacy terms are consistent with the BAA.

A vendor’s use of patient information must remain within the permissions established by applicable law and the contractual relationship. Do not assume that a general promise of “HIPAA compliance” authorizes every secondary use of patient data.

As a practical safeguard, practices should prohibit staff from entering identifiable patient information into unapproved AI tools. They should also review recording, patient-notice, consent, and any applicable heightened confidentiality requirements before deploying tools that listen to clinical encounters. Those questions require a workflow-specific analysis rather than a blanket assumption that a BAA resolves them.

Clinical Judgment and Patient Safety

AI should support professional judgment—not become a substitute for it.

Michigan’s medical malpractice statute establishes standards applicable to general practitioners and specialists and requires proof of causation and injury. Adopting an AI system does not replace that statutory framework or establish that following the system’s recommendation meets the applicable standard of care.

Consider a hypothetical AI-generated visit note that omits a medication allergy mentioned during the appointment. If the clinician signs the note without checking it, the omission becomes part of the record that other professionals may rely on. A faster documentation process is not necessarily a safer one.

A sensible implementation policy should require clinicians to verify material facts, correct unsupported statements, and review recommendations against the patient’s actual condition. CMS’s responsible-use principles likewise emphasize human oversight and ongoing monitoring for accuracy and safety.

Regulatory status also matters. Some clinical decision-support software falls outside FDA’s medical-device definition, while other software functions remain subject to FDA oversight. One important consideration is whether the healthcare professional can independently review the basis for a recommendation rather than rely primarily on the software’s output.

Before adopting a clinical AI product, ask the vendor to explain its intended use, regulatory status, limitations, and validation. A tool appropriate for drafting administrative text may not be appropriate for diagnosis or treatment decisions.

Documentation, Billing, and Contracts

AI-generated documentation can create financial exposure when it supports claims that do not accurately reflect the care provided.

Practices remain responsible for ensuring that submitted claims are accurate and adequately supported, regardless of whether a person or an AI system generated the underlying note or code. Unsupported documentation can create overpayment concerns and, depending on the facts and the applicable knowledge requirements, potential False Claims Act exposure.

Before submitting claims based on AI-assisted work, practices should establish controls to verify:

• That the documented services were actually performed.
• That diagnoses and codes are supported by the medical record.
• That generated notes do not invent findings, counseling, or procedures.
• That recurring errors trigger investigation and correction rather than repeated submission.

The vendor contract deserves equal attention. A BAA addresses important privacy obligations, but practices should also negotiate commercial terms governing performance, support, responsibility, and remedies.

Useful contract-review questions include:

• Who bears responsibility for security incidents and third-party claims?
• Do liability caps leave the practice with substantial unrecoverable exposure?
• Can the vendor change data-use terms or model functionality unilaterally?
• Must the vendor disclose material updates and known safety limitations?
• Can the practice export its records and obtain appropriate data deletion when the relationship ends?
• Does the practice’s insurance cover the proposed AI-assisted activities?

These are negotiation and risk-allocation issues, not protections that should be assumed from a product demonstration or marketing statement.

Steps Before Launching AI

A practice does not need to reject AI to manage its legal risks. It needs a documented process for deciding which tools are appropriate and how they will be used.

A practical pre-launch review should include:

1. Inventory the proposed tools and identify their clinical, administrative, and billing functions.
2. Map where patient information travels and which organizations can access it.
3. Complete the appropriate privacy and security assessment and obtain required BAAs.
4. Review vendor contracts, intended uses, and relevant regulatory status.
5. Establish patient-notice and consent procedures appropriate to the workflow.
6. Train staff on approved uses, prohibited inputs, and required human review.
7. Test the system before broad deployment and monitor errors after implementation.
8. Assign responsibility for incident response, complaints, and decisions to suspend a tool.

These steps put privacy safeguards and meaningful human oversight into the implementation process rather than treating them as afterthoughts. HHS’s cloud guidance and CMS’s AI principles both emphasize those responsibilities.

Planning to introduce AI into your medical practice? Before signing a vendor agreement or allowing access to patient information, seek a legal review of the proposed arrangement.

Contact Szura & Delonis, PLC at (248) 716-3600 to discuss your practice’s AI-related privacy, contracting, and compliance concerns. The firm is located in Southfield and serves clients throughout Michigan, including Oakland, Wayne, and Macomb counties.

Please do not include patient information or other confidential details in an initial contact form, text message, or voicemail. Contacting the firm does not create an attorney-client relationship.

This post is intended for general informational purposes and does not constitute legal advice. The requirements applicable to a particular AI tool depend on its functions, data flows, contractual terms, and the circumstances of its use.

If you practice medicine in Southeast Michigan — whether in Detroit, Ann Arbor, Dearborn, Royal Oak, or anywhere across Wayne, Oakland, Macomb, or Washtenaw County — you already know that patient privacy isn’t just good practice. It’s federal law, backed by state statutes, and enforced with real financial and professional consequences.

Yet HIPAA compliance remains one of the most misunderstood areas of healthcare regulation. Physicians, practice administrators, and healthcare staff routinely ask the same questions: How do I properly respond to a medical records request? What counts as a reportable breach? Am I personally liable if my practice gets it wrong?

This post breaks down what HIPAA actually requires, how it interacts with Michigan-specific privacy rules, and where medical professionals most often run into trouble.

What HIPAA Actually Covers

The Health Insurance Portability and Accountability Act (HIPAA) sets the federal floor for protecting patient health information. Two rules matter most for day-to-day practice:

• The Privacy Rule governs how protected health information (PHI) can be used and disclosed, and gives patients’ rights over their own records.
• The Security Rule sets standards for safeguarding electronic PHI (ePHI) — think encryption, access controls, and audit logs.

A third piece, the Breach Notification Rule, requires covered entities to notify patients, the Department of Health and Human Services (HHS), and in some cases the media, when unsecured PHI is compromised.

If you’re a physician, dentist, therapist, hospital, clinic, or any business associate handling PHI on behalf of one, HIPAA almost certainly applies to you.

Michigan Privacy Law in Addition to HIPAA

HIPAA is a floor, not a ceiling. Michigan law generally adds additional obligations that Southeast Michigan providers can’t ignore:

• Michigan’s Medical Records Access Act (MRAA) governs how quickly and in what format providers must furnish records to patients, and what they can charge for copies.
• The Michigan Mental Health Code imposes stricter confidentiality standards for mental health and substance use treatment records than HIPAA alone requires.
• Michigan’s Identity Theft Protection Act creates its own breach notification triggers and timelines, which can run alongside — not instead of — HIPAA’s federal requirements.

Where state law is more protective of patients than HIPAA, the stricter standard generally controls. Practices that comply with HIPAA alone, without checking Michigan-specific statutes, are often still out of compliance.

Responding to Medical Records Requests: Where Practices Get Tripped Up

Medical records requests are one of the most common — and most commonly mishandled — compliance touchpoints. A few recurring issues:

Missing the response deadline. Under HIPAA, covered entities generally must respond to a patient’s records request within 30 days, with one 30-day extension available if the patient is notified in writing. Michigan’s MRAA has its own timing and fee rules that can be stricter. Practices that default to “whenever we get to it” are exposed.

Overcharging for copies. Both HIPAA and Michigan law limit what you can charge for records. Flat per-page fees that don’t reflect actual labor and supply costs are a frequent source of complaints — and complaints often trigger broader compliance reviews.

Disclosing more than authorized. A records request for a specific date range or specific provider doesn’t authorize releasing the entire chart. Over-disclosure is a potential HIPAA violation even when the requester is the patient’s own attorney or insurer, if the authorization doesn’t cover the full scope released.

Third-party requests without proper authorization. Attorneys, family members, employers, and insurance companies frequently request records. Without a valid, specific HIPAA authorization — or an applicable exception — releasing records to these parties can constitute an impermissible disclosure.

Subpoenas versus authorizations. A subpoena alone is often not sufficient authority to release PHI under HIPAA. Providers served with subpoenas should understand the difference between a subpoena, a court order, and a qualified protective order before producing records.

Breach Notification: Know Your Triggers

Not every privacy incident is a reportable breach, but many providers either over-report out of caution or under-report out of uncertainty — both create problems. A breach analysis generally asks:

1. Was PHI actually acquired, accessed, used, or disclosed in violation of the Privacy Rule?
2. Does a recognized exception apply (e.g., good-faith unintentional access by an employee, acting within scope)?
3. Based on a documented risk assessment, is there a low probability the information was compromised?

If the answer to the risk assessment favors the patient, notification obligations follow — to the individual, and depending on scale, to HHS and potentially local media. Michigan’s breach notification statute may impose additional or overlapping requirements. Documentation of the risk assessment itself is critical; regulators scrutinize the analysis, not just the outcome.

Penalties: What’s Actually at Stake

HIPAA violations carry tiered civil penalties based on the level of culpability, ranging from a few hundred dollars per violation for unknowing violations to well over $1 million per year for uncorrected willful neglect. Beyond fines:

• Corrective action plans and years of OCR monitoring
• State licensing board referrals
• Civil liability exposure through related state-law claims
• Reputational harm that follows a practice long after the fine is paid

For an individual physician or a small Southeast Michigan practice, even a mid-tier penalty combined with legal fees and lost patient trust can be existential.

Business Associate Agreements Should Not Be Optional

Every vendor that touches PHI on your behalf — billing companies, IT support, cloud storage providers, transcription services, even some consultants — should have a signed Business Associate Agreement (BAA). Practices that skip this step, or that use outdated boilerplate BAAs, may remain liable when their vendor mishandles data. Reviewing BAAs should be a standing item in any compliance audit, not a one-time formality from when the practice opened.

Practical Compliance Steps for Southeast Michigan Practices

• Conduct an annual HIPAA risk assessment and document it
• Train staff on records-request procedures and PHI disclosure limits at onboarding and annually thereafter
• Maintain a written breach response protocol with clear roles and timelines
• Audit current Business Associate Agreements for gaps
• Confirm records-request fee schedules comply with both HIPAA and Michigan’s MRAA
• Designate a privacy officer, even in small practices, to field records requests and potential breach issues consistently

When to Talk to a Healthcare Law Attorney

Not every compliance question needs a lawyer, but certain situations warrant one before you act, not after:

• You’ve received a subpoena or third-party request for records and aren’t sure what you’re authorized to disclose
• You suspect a breach has occurred and need help with the risk assessment or notification timeline
• OCR or the Michigan Attorney General’s office has contacted your practice
• You’re negotiating or drafting Business Associate Agreements
• An employee has raised a compliance concern internally and you want to handle it correctly from the start

Southeast Michigan providers face the same federal scrutiny as anyone else in the country, layered with Michigan-specific statutes that out-of-state guidance often misses. A quick consult before responding to a records request or reporting a breach is almost always cheaper than untangling a mistake afterward.

Frequently Asked Questions

How long do I have to respond to a patient’s medical records request in Michigan? Generally, 30 days under HIPAA, with a possible 30-day extension if you notify the patient in writing. Michigan’s Medical Records Access Act imposes its own timing and fee requirements that can be more restrictive — check both before responding.

Can I charge whatever I want for copies of medical records? No. Both HIPAA and Michigan law limit fees to reasonable, cost-based amounts. Flat, high per-page charges are a common source of complaints.

Do I have to report every unauthorized access to PHI as a breach? Not necessarily. A documented risk assessment determines whether an incident meets the breach threshold or falls under a recognized exception. The key is documenting that analysis, not just reaching a conclusion.

What should I do if I receive a subpoena for a patient’s records? Don’t assume a subpoena alone authorizes disclosure. Confirm whether it’s accompanied by a valid authorization, court order, or qualified protective order before producing records — and when in doubt, get legal guidance first.

This post is intended for general informational purposes and does not constitute legal advice. Every provider’s compliance obligations depend on the specific facts. If you have questions about a records request, a potential breach, or a compliance concern involving your Southeast Michigan practice, consult a healthcare law attorney before taking action.

Running a pharmacy in Michigan means navigating one of the most tightly regulated healthcare environments in the country. Between the Michigan Public Health Code, Board of Pharmacy regulations, DEA oversight, and shifting federal rules on controlled substances and telehealth prescribing, compliance isn’t just good practice—it’s essential for survival.

Whether you operate an independent pharmacy or manage a chain location, even a minor oversight in recordkeeping, billing, or licensing can trigger investigations, costly penalties, or even professional discipline. At Szura & Delonis PLC, we help Michigan pharmacists and pharmacy owners protect their businesses, their licenses, and their reputations.Running a pharmacy in Michigan means navigating one of the most tightly regulated healthcare environments in the country. Between the Michigan Public Health Code, Board of Pharmacy regulations, DEA oversight, and shifting federal rules on controlled substances and telehealth prescribing, compliance isn’t just good practice—it’s essential for survival.

Whether you operate an independent pharmacy or manage a chain location, even a minor oversight in recordkeeping, billing, or licensing can trigger investigations, costly penalties, or even professional discipline. At Szura & Delonis PLC, we help Michigan pharmacists and pharmacy owners protect their businesses, their licenses, and their reputations.

The Growing Complexity of Pharmacy Compliance

The last few years have brought sweeping changes to how pharmacies must operate. The Michigan Department of Licensing and Regulatory Affairs (LARA) now expects heightened accountability in controlled substance dispensing, pharmacy technician supervision, compounding standards, and credential renewals. At the same time, federal regulators and insurers are cracking down on billing irregularities and documentation errors.

Common risk areas for Michigan pharmacies include:

• Inadequate controlled substance tracking or inventory reconciliation
• Billing or coding errors under Medicare, Medicaid, or private payers
• Failure to properly supervise technicians or interns
• Violations involving remote or off-site dispensing
• Recordkeeping deficiencies during board or DEA audits

Pharmacies often find themselves facing regulatory investigations, audit demands, or complaints without warning. By the time a notice arrives, the clock is already ticking—and what you say or submit in response can determine the outcome.

How Szura & Delonis Helps Michigan Pharmacies

Our attorneys represent pharmacies and pharmacists across Michigan in all stages of regulatory compliance, investigation, and defense. With decades of combined experience in healthcare law and administrative proceedings, we understand how regulators think and what actions protect your license.

Our services include:

• Proactive compliance audits and policy development
• Defense of pharmacy license complaints before LARA and the Board of Pharmacy
• Response strategies for DEA, auditor, or Department of Health investigations
• Risk management advice tailored to Michigan pharmacy operations
• Training for staff on documentation and regulatory communication

We know that every pharmacy operates differently, so our guidance is designed to fit your specific operations and risk profile. When you need experienced counsel, you want a team that understands both the letter of the law and the realities of running a modern pharmacy.

Take Action Before Problems Arise

Too often, pharmacies reach out only after receiving a subpoena, audit letter, or notice of violation. By then, options can be more limited. Taking proactive steps now—reviewing your policies, conducting internal audits, and shoring up documentation—is one of the most cost-effective ways to secure your business and license.

If your Michigan pharmacy has questions about compliance, licensing, or pending investigations, don’t wait to seek experienced legal guidance.

Contact Szura & Delonis PLC today to schedule a confidential consultation. Call us to learn how we can help your pharmacy stay protected, compliant, and successful in 2026 and beyond.

Step 1: The LARA Investigation

The process often begins when LARA’s Bureau of Professional Licensing (BPL) receives a complaint — sometimes from a patient, colleague, hospital, or insurance company. That report starts an investigation, during which state investigators may request records, interview witnesses or attempt to interview you directly.

At this early stage, mistakes are common. It may feel natural to respond directly to the investigator, but even a harmless, well-meaning or incomplete statement may be used against you later. Our first role as your legal counsel is to step in immediately — to manage communications, understand how those communications affect the complaint, and control the flow of information so that we can protect you from unnecessary exposure.

Step 2: The Administrative Complaint

If LARA believes the investigation uncovered a violation of the Michigan Public Health Code, LARA or the Michigan Attorney General’s office will issue an Administrative Complaint. This is the formal document that sets out the specific allegations and Michigan Public Health Code rules that were allegedly violated.

From the day that complaint is served, a license holder has 30 days to file a written answer, request a compliance conference and/or demand an administrative hearing. Missing this deadline can result in serve penalties such as a default judgment leading to disciplinary action. We will carefully review the complaint’s language, examining both the factual accuracy and the legal support for each charge. We will then discuss and prepare a strategic response that protects your rights and seeks the best path forward.

Step 3: The Compliance Conference

Once the answer is filed, we may decide to request a compliance conference — essentially a settlement discussion that happens before the case proceeds to a full hearing. This is an opportunity to provide your side of the story. A representative from LARA or the Attorney General’s office, and sometimes a member (conferee) of the licensing board may attend. These are typically done over the phone or video conference.

This meeting is a crucial opportunity to present mitigating evidence, clarify misunderstandings, and explore resolution options. With thorough preparation, we have been able to negotiate outcomes such as dismissal, reduced sanctions, or agreements that allow my clients to continue practicing under reasonable conditions.

Step 4: Administrative Hearing

If the case isn’t resolved through negotiation, it moves to a formal administrative hearing before an Administrative Law Judge (ALJ). This stage is very similar to a court trial — witnesses testify, evidence is introduced, and both sides make legal arguments during the hearing and through briefs.

In the courtroom, we present a robust defense — using expert testimony, medical records, and procedural arguments to show that there was no violation of the Michigan Public Health Code, professional standards were satisfied or that the alleged violation doesn’t warrant discipline. The ALJ then issues a Proposal for Decision (PFD), we provide a response the PFD and then it goes to the appropriate licensing board to either approve or deny the proposal.

Step 5: Appeals and Reinstatement

If discipline is imposed, you still have options. You can appeal the board’s decision to the Michigan Court of Appeals, or, if necessary, petition for reinstatement of your license after fulfilling the required conditions. We work with providers throughout this process to demonstrate remediation, continuing education, and compliance with prior orders — steps that help rebuild professional standing.

Protecting Your License and Your Future

Facing a LARA license investigation or Administrative Complaint can be an intimidating experience, but early and well-informed action makes all the difference. As attorneys who focus on Michigan medical license defense, our goal is to ensure that one complaint doesn’t erase years of hard work and dedication.

If you’ve received a notice from LARA or the Board of Medicine, don’t wait to see what happens next. Contact an experienced healthcare defense attorney to preserve your rights and take control of the process before it escalates.

Szura, a founding partner of Southfield law firm Szura & Delonis, P.L.C., was selected during the HCLS Annual Meeting on September 20th.

The Health Care Law Section is one of the largest sections of the State Bar of Michigan with approximately 1,000 members. The HCLS’s numerous committees and programs provide valuable educational resources for its members around the state. Those resources include webinars and publications on emerging issues in health care law, as well in-person programs at its Annual Meeting and the annual Health Law Institute, which it co-sponsors with the Institute of Continuing Legal Education. In addition, the HCLS seeks to “serve the health care community and advocate on behalf of its interests concerning state and federal legislation and public policy which affect the practice of health care law and related issues.”

Szura’s previous experience with the Health Care Law Section includes service as Chair of its Publications Committee, service as Chair-Elect and as an active Council Member. Szura has also presented on numerous health law topics at HCLS events. He is also an active member of the Medical/Legal Committee of the Oakland County Bar Association.

Szura is a 2003 graduate of Cornell Law School, with a concentration in Business Law and Regulation. He received his undergraduate degree from the University of Michigan, He has been repeatedly selected as a Michigan Super Lawyer Rising Star, among other distinctions.

Szura represents and counsels health care clients on many aspects of their business, including complex health care regulations, such as the Stark Law, the Anti-Kickback Statute, and HIPAA. He also advises on licensing issues, telemedicine, medical staff and peer review matters, and employment matters, among other areas. In addition, Szura has represented health care clients in a wide variety of matters in state and federal courts and in administrative hearings.

Szura & Delonis, P.L.C. is a firm of Michigan business lawyers who provide legal counsel for small and medium-sized businesses with a particular focus on health care law, real estate and labor and employment law.

However, earlier this month the Centers for Medicare and Medicaid Services (CMS) proposed significant changes in government reimbursement for telehealth services in the 2019 Physician Fee Schedule and Quality Payment Program.

Specifically, CMS is proposing new codes for remote patient monitoring services. The new codes will reduce some of the burden on practice groups. They will require less treatment time for a service to be reimbursed (20 minutes a month instead of 30 minutes). They provide separate reimbursement for set-up and patient education of the system. Finally, and perhaps most importantly, they allow other staff professionals (e.g., RNs) to be reimbursed for such services. These new codes might be the difference in the decision whether to provide remote patient monitoring.

CMS is also seeking to increase access to qualified health professionals by advancing virtual care services. CMS is proposing new codes for virtual check-ins, evaluations of forwarded images and videos, and peer-to-peer online consultations. Importantly, those codes would not require the use of live, interactive audio-video technology and would not require the patient be located in a rural area or a specific qualifying originating site. The originating site requirements and the live face-to-face requirements have been major hurdles in adopting or expanding telehealth services. The fact that CMS is proposing to remove those requirements in this area indicates the requirements may be losing favor. That would be good news for those who have been stopped by those hurdles when deciding whether to expand their telehealth services.

These changes are only proposals at this time. CMS is currently accepting comments on these changes up to September 10, 2018. However, it is likely that they will be adopted in some form for the 2019 fee schedule. That would be good news for providers seeking to expand their practice and good news for patients who have trouble traveling to a qualified provider for the treatment they need.