Michigan Compiled Laws, Chapter 333. Health § 333.2637

Sec. 2637. (1) The department shall establish procedures pursuant to section 2678  1 to protect the confidentiality of, and regulate the disclosure of, data and records contained in a departmental data system or system of records.

(2) The procedures established under subsection (1) shall be consistent with the policy established under sections 2611 and 2613.  2

(3) Except as provided in section 2640,  3 the procedures established under subsection (1) shall specify the data contained in a departmental data system or system of records that shall not be disclosed unless items identifying a person by name, address, number, symbol, or any other identifying particular are deleted.

(4) The procedures established under subsection (1) shall regulate the use and disclosure of data contained in a departmental data system or system of records released to researchers, other persons, including designated medical research projects as described in section 2631,  4 or governmental entities. A person who receives data pursuant to this section shall not disclose an item of information contained in the data except in conformance with the authority granted by the department and with the purpose for which the data was originally requested by the researcher. The director may contract with researchers or other persons to implement and enforce this subsection. A contract made pursuant to this subsection shall do both of the following:

(5) An officer or employee of the department shall not disclose data contained in a departmental data system or system of records except as authorized in the procedures adopted pursuant to this section.

(6) The department periodically shall review the procedures adopted under this section.

(7) A person whose contract is terminated pursuant to subsection (4)(b) is not eligible to make a subsequent contract with the department.