(1) A licensee shall keep and maintain a record for each patient for whom the licensee has provided medical services, including a full and complete record of tests and examinations performed, observations made, and treatments provided. If a medical service provided to a patient on or after the effective date of the amendatory act that added this sentence involves the vaginal or anal penetration of the patient, a licensee shall expressly state in the patient’s record that vaginal or anal penetration was performed unless the medical service meets any of the circumstances described in subsection (2)(b)(i), (ii), (iii), or (iv).

    (2) Unless a longer retention period is otherwise required under federal or state laws or regulations or by generally accepted standards of medical practice, a licensee shall keep and retain each record required under subsection (1) as follows:

    (a) Except as otherwise provided in subdivision (b), for a minimum of 7 years from the date of service to which the record pertains.

    (b) If the record is for a medical service performed on or after the effective date of the amendatory act that added this subdivision that involves the vaginal or anal penetration of a patient, for a minimum of 15 years from the date of service to which the record pertains. This subdivision does not apply to a record for any of the following:

    (i) A medical service that primarily relates to the patient’s urological, gastrointestinal, reproductive, gynecological, or sexual health.

    (ii) A medical service that is necessary and associated with or incident to a medical emergency. As used in this subparagraph, “medical emergency” means a circumstance that, in the licensee’s good-faith medical judgment, creates an immediate threat of serious risk to the life or physical health of the patient.

    (iii) A medical service performed for the purpose of rectally administering a drug or medicine.

    (iv) A medical service performed to measure a patient’s temperature.

    (3) The records required under subsection (1) must be maintained in such a manner as to protect their integrity, to ensure their confidentiality and proper use, and to ensure their accessibility and availability to each patient or the patient’s authorized representative as required by law.

    (4) Except as otherwise provided in subsection (7), a licensee may destroy a record required under subsection (1) that is less than 7 years old only if both of the following are satisfied:

    (a) The licensee sends a written notice to the patient at the last known address of that patient informing the patient that the record is about to be destroyed, offering the patient the opportunity to request a copy of that record, and requesting the patient’s written authorization to destroy the record.

    (b) The licensee receives written authorization from the patient or the patient’s authorized representative agreeing to the destruction of the record.

    (5) If a licensee is unable to comply with this section, the licensee shall employ or contract, arrange, or enter into an agreement with another health care provider, a health facility or agency, or a medical records company to protect, maintain, and provide access to those records required under subsection (1).

    (6) If a licensee or registrant sells or closes the licensee’s or registrant’s practice, retires from practice, or otherwise ceases to practice under this article, the licensee or the personal representative of the licensee, if the licensee is deceased, shall not abandon the records required under this section and shall send a written notice to the department that specifies who will have custody of the medical records and how a patient may request access to or copies of the patient’s medical records and shall do either of the following:

    (a) Transfer the records required under subsection (1) to any of the following:

    (i) A successor licensee.

    (ii) If requested by the patient or the patient’s authorized representative, to the patient or a specific health facility or agency or other health care provider licensed under article 15.

    (iii) A health care provider, a health facility or agency, or a medical records company with which the licensee had contracted or entered into an agreement to protect, maintain, and provide access to those records required under subsection (1).

    (b) Except as otherwise provided in subsection (7), and in accordance with subsections (1) to (4), as long as the licensee or the personal representative of the licensee, if the licensee is deceased, sends a written notice to the last known address of each patient for whom the licensee has provided medical services and receives written authorization from the patient or the patient’s authorized representative, destroy the records required under subsection (1). The notice must provide the patient with 30 days to request a copy of the patient’s records or to designate where the patient would like the patient’s medical records transferred and must request from the patient within 30 days written authorization for the destruction of the patient’s medical records. Except as otherwise provided in subsection (7), if the patient fails to request a copy or transfer of the patient’s medical records or to provide the licensee with written authorization for the destruction, then the licensee or the personal representative of the licensee shall not destroy those records that are less than 7 years old but may destroy, in accordance with subsection (8), those that are 7 years old or older.

    (7) A licensee or the personal representative of a licensee, if the licensee is deceased, shall only destroy a record described in subsection (2)(b) in accordance with subsection (8).

    (8) Except as otherwise provided under this section or federal or state laws and regulations, records required to be maintained under subsection (1), other than a record described in subsection (2)(b), may be destroyed or otherwise disposed of after being maintained for 7 years and records described in subsection (2)(b) may be destroyed or otherwise disposed of after being maintained for 15 years. If records maintained in accordance with this section are subsequently destroyed or otherwise disposed of, those records must be shredded, incinerated, electronically deleted, or otherwise disposed of in a manner that ensures continued confidentiality of the patient’s health care information and any other personal information relating to the patient. If records are not destroyed or otherwise disposed of as provided under this subsection, the department may take action, including, but not limited to, contracting for or making other arrangements to ensure that those records and any other confidential identifying information related to the patient are properly destroyed or disposed of to protect the confidentiality of patient’s health care information and any other personal information relating to the patient. Before the department takes action in accordance with this subsection, the department, if able to identify the licensee responsible for the improper destruction or disposal of the medical records at issue, shall send a written notice to that licensee at the licensee’s last known address or place of business on file with the department and provide the licensee with an opportunity to properly destroy or dispose of those medical records as required under this subsection unless a delay in the proper destruction or disposal may compromise the patient’s confidentiality. The department may assess the licensee with the costs incurred by the department to enforce this subsection.

    (9) Except as otherwise provided in section 16213a, a person that fails to comply with this section is subject to an administrative fine of not more than $10,000.00 if the failure was the result of gross negligence or willful and wanton misconduct.

    (10) Nothing in this section shall be construed to create or change the ownership rights to any medical records.

    (11) As used in this section:

    (a) “Medical record” or “record” means information, oral or recorded in any form or medium, that pertains to a patient’s health care, medical history, diagnosis, prognosis, or medical condition and that is maintained by a licensee in the process of providing medical services.

    (b) “Medical records company” means a person who contracts for or agrees to protect, maintain, and provide access to medical records for a health care provider or health facility or agency in accordance with this section.

    (c) “Patient” means an individual who receives or has received health care from a health care provider or health facility or agency. Patient includes a guardian, if appointed, and a parent, guardian, or person acting in loco parentis, if the individual is a minor, unless the minor lawfully obtained health care without the consent or notification of a parent, guardian, or other person acting in loco parentis, in which case the minor has the exclusive right to exercise the rights of a patient under this section with respect to the minor’s medical records relating to that care.