Artificial intelligence is finding its way into the everyday work of medical practices—from drafting visit notes and answering patient messages to suggesting billing codes and supporting clinical decisions. For physicians, practice administrators, and other healthcare professionals in Southeast Michigan, the question is not simply whether an AI tool saves time. It is whether the practice can use that tool without compromising patient privacy, clinical judgment, or compliance.

Existing legal obligations do not disappear when a practice introduces AI. HIPAA requirements, Michigan’s medical malpractice standards, and rules governing accurate claims submissions remain relevant to how these tools are selected, configured, and supervised.

Before your practice adopts an AI scribe, chatbot, or decision-support platform, consider the following legal concerns.

Patient Privacy and Vendor Access

An AI tool may receive much more patient information than a practice initially realizes. An ambient documentation system, for example, may process an entire conversation rather than just the final note. A patient-facing chatbot may collect symptoms, medication information, and appointment details.

When a vendor creates, receives, maintains, or transmits protected health information on behalf of a HIPAA-covered practice, it generally acts as a business associate. HHS specifically identifies certain third-party AI chatbots on patient portals as examples of business associates. A HIPAA-compliant business associate agreement, or BAA, is therefore an essential starting point—not an optional vendor add-on.

However, signing a BAA does not complete the practice’s compliance work. HHS also requires covered entities to assess risks associated with their cloud environment and implement appropriate safeguards for electronic protected health information.

Before allowing an AI vendor access to patient information, practices should examine:

• What information the system collects, including recordings, transcripts, prompts, and generated responses.
• Whether patient information is retained or used to train or improve models.
• Which subcontractors receive or store the information.
• How access, security incidents, data deletion, and contract termination are handled.
• Whether the vendor’s service agreement and privacy terms are consistent with the BAA.

A vendor’s use of patient information must remain within the permissions established by applicable law and the contractual relationship. Do not assume that a general promise of “HIPAA compliance” authorizes every secondary use of patient data.

As a practical safeguard, practices should prohibit staff from entering identifiable patient information into unapproved AI tools. They should also review recording, patient-notice, consent, and any applicable heightened confidentiality requirements before deploying tools that listen to clinical encounters. Those questions require a workflow-specific analysis rather than a blanket assumption that a BAA resolves them.

Clinical Judgment and Patient Safety

AI should support professional judgment—not become a substitute for it.

Michigan’s medical malpractice statute establishes standards applicable to general practitioners and specialists and requires proof of causation and injury. Adopting an AI system does not replace that statutory framework or establish that following the system’s recommendation meets the applicable standard of care.

Consider a hypothetical AI-generated visit note that omits a medication allergy mentioned during the appointment. If the clinician signs the note without checking it, the omission becomes part of the record that other professionals may rely on. A faster documentation process is not necessarily a safer one.

A sensible implementation policy should require clinicians to verify material facts, correct unsupported statements, and review recommendations against the patient’s actual condition. CMS’s responsible-use principles likewise emphasize human oversight and ongoing monitoring for accuracy and safety.

Regulatory status also matters. Some clinical decision-support software falls outside FDA’s medical-device definition, while other software functions remain subject to FDA oversight. One important consideration is whether the healthcare professional can independently review the basis for a recommendation rather than rely primarily on the software’s output.

Before adopting a clinical AI product, ask the vendor to explain its intended use, regulatory status, limitations, and validation. A tool appropriate for drafting administrative text may not be appropriate for diagnosis or treatment decisions.

Documentation, Billing, and Contracts

AI-generated documentation can create financial exposure when it supports claims that do not accurately reflect the care provided.

Practices remain responsible for ensuring that submitted claims are accurate and adequately supported, regardless of whether a person or an AI system generated the underlying note or code. Unsupported documentation can create overpayment concerns and, depending on the facts and the applicable knowledge requirements, potential False Claims Act exposure.

Before submitting claims based on AI-assisted work, practices should establish controls to verify:

• That the documented services were actually performed.
• That diagnoses and codes are supported by the medical record.
• That generated notes do not invent findings, counseling, or procedures.
• That recurring errors trigger investigation and correction rather than repeated submission.

The vendor contract deserves equal attention. A BAA addresses important privacy obligations, but practices should also negotiate commercial terms governing performance, support, responsibility, and remedies.

Useful contract-review questions include:

• Who bears responsibility for security incidents and third-party claims?
• Do liability caps leave the practice with substantial unrecoverable exposure?
• Can the vendor change data-use terms or model functionality unilaterally?
• Must the vendor disclose material updates and known safety limitations?
• Can the practice export its records and obtain appropriate data deletion when the relationship ends?
• Does the practice’s insurance cover the proposed AI-assisted activities?

These are negotiation and risk-allocation issues, not protections that should be assumed from a product demonstration or marketing statement.

Steps Before Launching AI

A practice does not need to reject AI to manage its legal risks. It needs a documented process for deciding which tools are appropriate and how they will be used.

A practical pre-launch review should include:

1. Inventory the proposed tools and identify their clinical, administrative, and billing functions.
2. Map where patient information travels and which organizations can access it.
3. Complete the appropriate privacy and security assessment and obtain required BAAs.
4. Review vendor contracts, intended uses, and relevant regulatory status.
5. Establish patient-notice and consent procedures appropriate to the workflow.
6. Train staff on approved uses, prohibited inputs, and required human review.
7. Test the system before broad deployment and monitor errors after implementation.
8. Assign responsibility for incident response, complaints, and decisions to suspend a tool.

These steps put privacy safeguards and meaningful human oversight into the implementation process rather than treating them as afterthoughts. HHS’s cloud guidance and CMS’s AI principles both emphasize those responsibilities.

Planning to introduce AI into your medical practice? Before signing a vendor agreement or allowing access to patient information, seek a legal review of the proposed arrangement.

Contact Szura & Delonis, PLC at (248) 716-3600 to discuss your practice’s AI-related privacy, contracting, and compliance concerns. The firm is located in Southfield and serves clients throughout Michigan, including Oakland, Wayne, and Macomb counties.

Please do not include patient information or other confidential details in an initial contact form, text message, or voicemail. Contacting the firm does not create an attorney-client relationship.

This post is intended for general informational purposes and does not constitute legal advice. The requirements applicable to a particular AI tool depend on its functions, data flows, contractual terms, and the circumstances of its use.

If you practice medicine in Southeast Michigan — whether in Detroit, Ann Arbor, Dearborn, Royal Oak, or anywhere across Wayne, Oakland, Macomb, or Washtenaw County — you already know that patient privacy isn’t just good practice. It’s federal law, backed by state statutes, and enforced with real financial and professional consequences.

Yet HIPAA compliance remains one of the most misunderstood areas of healthcare regulation. Physicians, practice administrators, and healthcare staff routinely ask the same questions: How do I properly respond to a medical records request? What counts as a reportable breach? Am I personally liable if my practice gets it wrong?

This post breaks down what HIPAA actually requires, how it interacts with Michigan-specific privacy rules, and where medical professionals most often run into trouble.

What HIPAA Actually Covers

The Health Insurance Portability and Accountability Act (HIPAA) sets the federal floor for protecting patient health information. Two rules matter most for day-to-day practice:

• The Privacy Rule governs how protected health information (PHI) can be used and disclosed, and gives patients’ rights over their own records.
• The Security Rule sets standards for safeguarding electronic PHI (ePHI) — think encryption, access controls, and audit logs.

A third piece, the Breach Notification Rule, requires covered entities to notify patients, the Department of Health and Human Services (HHS), and in some cases the media, when unsecured PHI is compromised.

If you’re a physician, dentist, therapist, hospital, clinic, or any business associate handling PHI on behalf of one, HIPAA almost certainly applies to you.

Michigan Privacy Law in Addition to HIPAA

HIPAA is a floor, not a ceiling. Michigan law generally adds additional obligations that Southeast Michigan providers can’t ignore:

• Michigan’s Medical Records Access Act (MRAA) governs how quickly and in what format providers must furnish records to patients, and what they can charge for copies.
• The Michigan Mental Health Code imposes stricter confidentiality standards for mental health and substance use treatment records than HIPAA alone requires.
• Michigan’s Identity Theft Protection Act creates its own breach notification triggers and timelines, which can run alongside — not instead of — HIPAA’s federal requirements.

Where state law is more protective of patients than HIPAA, the stricter standard generally controls. Practices that comply with HIPAA alone, without checking Michigan-specific statutes, are often still out of compliance.

Responding to Medical Records Requests: Where Practices Get Tripped Up

Medical records requests are one of the most common — and most commonly mishandled — compliance touchpoints. A few recurring issues:

Missing the response deadline. Under HIPAA, covered entities generally must respond to a patient’s records request within 30 days, with one 30-day extension available if the patient is notified in writing. Michigan’s MRAA has its own timing and fee rules that can be stricter. Practices that default to “whenever we get to it” are exposed.

Overcharging for copies. Both HIPAA and Michigan law limit what you can charge for records. Flat per-page fees that don’t reflect actual labor and supply costs are a frequent source of complaints — and complaints often trigger broader compliance reviews.

Disclosing more than authorized. A records request for a specific date range or specific provider doesn’t authorize releasing the entire chart. Over-disclosure is a potential HIPAA violation even when the requester is the patient’s own attorney or insurer, if the authorization doesn’t cover the full scope released.

Third-party requests without proper authorization. Attorneys, family members, employers, and insurance companies frequently request records. Without a valid, specific HIPAA authorization — or an applicable exception — releasing records to these parties can constitute an impermissible disclosure.

Subpoenas versus authorizations. A subpoena alone is often not sufficient authority to release PHI under HIPAA. Providers served with subpoenas should understand the difference between a subpoena, a court order, and a qualified protective order before producing records.

Breach Notification: Know Your Triggers

Not every privacy incident is a reportable breach, but many providers either over-report out of caution or under-report out of uncertainty — both create problems. A breach analysis generally asks:

1. Was PHI actually acquired, accessed, used, or disclosed in violation of the Privacy Rule?
2. Does a recognized exception apply (e.g., good-faith unintentional access by an employee, acting within scope)?
3. Based on a documented risk assessment, is there a low probability the information was compromised?

If the answer to the risk assessment favors the patient, notification obligations follow — to the individual, and depending on scale, to HHS and potentially local media. Michigan’s breach notification statute may impose additional or overlapping requirements. Documentation of the risk assessment itself is critical; regulators scrutinize the analysis, not just the outcome.

Penalties: What’s Actually at Stake

HIPAA violations carry tiered civil penalties based on the level of culpability, ranging from a few hundred dollars per violation for unknowing violations to well over $1 million per year for uncorrected willful neglect. Beyond fines:

• Corrective action plans and years of OCR monitoring
• State licensing board referrals
• Civil liability exposure through related state-law claims
• Reputational harm that follows a practice long after the fine is paid

For an individual physician or a small Southeast Michigan practice, even a mid-tier penalty combined with legal fees and lost patient trust can be existential.

Business Associate Agreements Should Not Be Optional

Every vendor that touches PHI on your behalf — billing companies, IT support, cloud storage providers, transcription services, even some consultants — should have a signed Business Associate Agreement (BAA). Practices that skip this step, or that use outdated boilerplate BAAs, may remain liable when their vendor mishandles data. Reviewing BAAs should be a standing item in any compliance audit, not a one-time formality from when the practice opened.

Practical Compliance Steps for Southeast Michigan Practices

• Conduct an annual HIPAA risk assessment and document it
• Train staff on records-request procedures and PHI disclosure limits at onboarding and annually thereafter
• Maintain a written breach response protocol with clear roles and timelines
• Audit current Business Associate Agreements for gaps
• Confirm records-request fee schedules comply with both HIPAA and Michigan’s MRAA
• Designate a privacy officer, even in small practices, to field records requests and potential breach issues consistently

When to Talk to a Healthcare Law Attorney

Not every compliance question needs a lawyer, but certain situations warrant one before you act, not after:

• You’ve received a subpoena or third-party request for records and aren’t sure what you’re authorized to disclose
• You suspect a breach has occurred and need help with the risk assessment or notification timeline
• OCR or the Michigan Attorney General’s office has contacted your practice
• You’re negotiating or drafting Business Associate Agreements
• An employee has raised a compliance concern internally and you want to handle it correctly from the start

Southeast Michigan providers face the same federal scrutiny as anyone else in the country, layered with Michigan-specific statutes that out-of-state guidance often misses. A quick consult before responding to a records request or reporting a breach is almost always cheaper than untangling a mistake afterward.

Frequently Asked Questions

How long do I have to respond to a patient’s medical records request in Michigan? Generally, 30 days under HIPAA, with a possible 30-day extension if you notify the patient in writing. Michigan’s Medical Records Access Act imposes its own timing and fee requirements that can be more restrictive — check both before responding.

Can I charge whatever I want for copies of medical records? No. Both HIPAA and Michigan law limit fees to reasonable, cost-based amounts. Flat, high per-page charges are a common source of complaints.

Do I have to report every unauthorized access to PHI as a breach? Not necessarily. A documented risk assessment determines whether an incident meets the breach threshold or falls under a recognized exception. The key is documenting that analysis, not just reaching a conclusion.

What should I do if I receive a subpoena for a patient’s records? Don’t assume a subpoena alone authorizes disclosure. Confirm whether it’s accompanied by a valid authorization, court order, or qualified protective order before producing records — and when in doubt, get legal guidance first.

This post is intended for general informational purposes and does not constitute legal advice. Every provider’s compliance obligations depend on the specific facts. If you have questions about a records request, a potential breach, or a compliance concern involving your Southeast Michigan practice, consult a healthcare law attorney before taking action.