Mich. Admin. Code R 567.11 — Confidentiality

Rule 11. (1) The auditor shall ensure that all nonpublic recor ds obtained from the state and
the person subject to examination are confidential records.
(2) Auditors shall not disclos e confidential information obta ined during the audit to any
person other than to the administ rator or his or her designee a nd, in the case of a multistate
examination, to authorized represe ntatives of a state participa ting in the examination but only to
the extent such confidential information relates to property th at may be subject to reporting in
such state.
(3) Auditors shall not use conf idential information obtained from the person subject to an
examination for any purpose other than for purposes of the exam ination. Auditors shall take all
reasonable steps to ensure that the confidential information pr ovided by the person subject to an
examination is securely maintained.
(4) An auditor and a person subject to examination may enter into a mutually agreeable
nondisclosure agreement. However, if the person and the auditor a r e u n a b l e t o e n t e r i n t o a
mutually agreeable nondisclosure agreement within 30 calendar d ays from the date the
agreement was first presented by the auditor to the person subj ect to the examination, then the
examination shall commence without an agreement in place subjec t to subrules (1) to (3) of this
rule.
(5) The auditor must promptly cure any deficiencies and comply with any applicable federal
and state laws and regulations pertaining to unauthorized discl osures. The administrator and the
auditor will cooperate to mitigate, to the extent practicable, the effects of any breach, intrusion,
or unauthorized use or disclosure. The auditor must report to the administrator in writing any use
or disclosure of confidential information, whether suspected or actual, other than as required by
the contract within 10 days of becoming aware of the use or disclosure or the shorter time period
as is reasonable under the circumstances.