(1) A health facility or agency shall keep and maintain a record for each patient, including a full and complete record of tests and examinations performed, observations made, treatments provided, and in the case of a hospital, the purpose of hospitalization. If a medical service provided to a patient on or after the effective date of the amendatory act that added this sentence involves the vaginal or anal penetration of the patient, a health facility or agency shall ensure that the patient's medical record expressly states that vaginal or anal penetration was performed unless the medical service meets any of the circumstances described in subsection (2)(b)(i)(A), (B), (C), or (D).

    (2) Unless a longer retention period is otherwise required under federal or state laws or regulations or by generally accepted standards of medical practice, a health facility or agency shall keep and retain each record required under subsection (1) as follows:

    (a) Except as otherwise provided in subdivision (b), for a minimum of 7 years from the date of service to which the record pertains.

    (b) For a minimum of 15 years from the date of service to which the record pertains if the service is performed on or after the effective date of the amendatory act that added this subdivision and 1 of the following applies:

    (i) The record includes a medical service involving the vaginal or anal penetration of a patient. This subparagraph does not apply to a record for any of the following:

    (A) A medical service that primarily relates to the patient's urological, gastrointestinal, reproductive, gynecological, or sexual health.

    (B) A medical service that is necessary and associated with or incident to a medical emergency. As used in this sub-subparagraph, "medical emergency" means a circumstance that, in the good-faith medical judgment of a health professional who is licensed under article 15, creates an immediate threat of serious risk to the life or physical health of the patient.

    (C) A medical service performed for the purpose of rectally administering a drug or medicine.

    (D) A medical service performed to measure a patient's temperature.

    (ii) The patient has filed a complaint with the health facility or agency alleging sexual misconduct by an individual who is employed by, under contract to, or granted privileges by the health facility or agency. As used in this subparagraph, "sexual misconduct" means the conduct described in section 90, 136, 145a, 145b, 145c, 520b, 520c, 520d, 520e, or 520g of the Michigan penal code, 1931 PA 328, MCL 750.90, 750.136, 750.145a, 750.145b, 750.145c, 750.520b, 750.520c, 750.520d, 750.520e, or 750.520g, regardless of whether the conduct resulted in a criminal conviction.

    (3) A health facility or agency shall maintain the records required under subsection (1) in such a manner as to protect their integrity, to ensure their confidentiality and proper use, and to ensure their accessibility and availability to each patient or the patient's authorized representative as required by law.

    (4) Except as otherwise provided in subsection (6), a health facility or agency may destroy a record required under subsection (1) that is less than 7 years old only if both of the following are satisfied:

    (a) The health facility or agency sends a written notice to the patient at the last known address of that patient informing the patient that the record is about to be destroyed, offering the patient the opportunity to request a copy of that record, and requesting the patient's written authorization to destroy the record.

    (b) The health facility or agency receives written authorization from the patient or the patient's authorized representative agreeing to the destruction of the record.

    (5) Except as otherwise provided under federal or state laws and regulations, records required to be maintained under subsection (1), other than a record described in subsection (2)(b), may be destroyed or otherwise disposed of after being maintained for 7 years, and records described in subsection (2)(b) may be destroyed or otherwise disposed of after being maintained for 15 years. If records maintained in accordance with this section are subsequently destroyed or otherwise disposed of, those records must be shredded, incinerated, electronically deleted, or otherwise disposed of in a manner that ensures continued confidentiality of the patient's health care information and any other personal information relating to the patient. If records are not destroyed or otherwise disposed of as provided under this subsection or subsection (4), the department may take action, including, but not limited to, contracting for or making other arrangements to ensure that those records and any other confidential identifying information related to the patient are properly destroyed or disposed of to protect the confidentiality of patient's health care information and any other personal information relating to the patient. Before the department takes action in accordance with this subsection, the department, if able to identify the health facility or agency responsible for the improper destruction or disposal of the medical records at issue, shall send a written notice to that health facility or agency at the last known address on file with the department and provide the health facility or agency with an opportunity to properly destroy or dispose of those medical records as required under this subsection or subsection (4), unless a delay in the proper destruction or disposal may compromise the patient's confidentiality. The department may assess the health facility or agency with the costs incurred by the department to enforce this subsection. In addition to the sanctions set forth in section 20165, a hospital that fails to comply with this subsection or subsection (4) is subject to an administrative fine of $10,000.00.

    (6) A health facility or agency shall only destroy a record described in subsection (2)(b) in accordance with subsection (5).

    (7) A hospital shall take precautions to ensure that the records required under subsection (1) are not wrongfully altered or destroyed. A hospital that fails to comply with this subsection is subject to an administrative fine of $10,000.00.

    (8) Unless otherwise provided by law, the licensing and certification records required by this article are public records.

    (9) Departmental officers and employees shall respect the confidentiality of patient clinical records and shall not divulge or disclose the contents of records in a manner that identifies an individual except pursuant to court order or as otherwise authorized by law.

    (10) A health facility or agency that employs, contracts with, or grants privileges to a health professional licensed or registered under article 15 shall report the following to the department not more than 30 days after it occurs:

    (a) Disciplinary action taken by the health facility or agency against a health professional licensed or registered under article 15 based on the licensee's or registrant's professional competence, disciplinary action that results in a change of employment status, or disciplinary action based on conduct that adversely affects the licensee's or registrant's clinical privileges for a period of more than 15 days. As used in this subdivision, "adversely affects" means the reduction, restriction, suspension, revocation, denial, or failure to renew the clinical privileges of a licensee or registrant by a health facility or agency.

    (b) Restriction or acceptance of the surrender of the clinical privileges of a licensee or registrant under either of the following circumstances:

    (i) The licensee or registrant is under investigation by the health facility or agency.

    (ii) There is an agreement in which the health facility or agency agrees not to conduct an investigation into the licensee's or registrant's alleged professional incompetence or improper professional conduct.

    (c) A case in which a health professional resigns or terminates a contract or whose contract is not renewed instead of the health facility or agency taking disciplinary action against the health professional.

    (11) Upon request by another health facility or agency seeking a reference for purposes of changing or granting staff privileges, credentials, or employment, a health facility or agency that employs, contracts with, or grants privileges to health professionals licensed or registered under article 15 shall notify the requesting health facility or agency of any disciplinary or other action reportable under subsection (10) that it has taken against a health professional licensed or registered under article 15 and employed by, under contract to, or granted privileges by the health facility or agency.

    (12) For the purpose of reporting disciplinary actions under this section, a health facility or agency shall include only the following in the information provided:

    (a) The name of the licensee or registrant against whom disciplinary action has been taken.

    (b) A description of the disciplinary action taken.

    (c) The specific grounds for the disciplinary action taken.

    (d) The date of the incident that is the basis for the disciplinary action.

    (13) The records, data, and knowledge collected for or by individuals or committees assigned a professional review function in a health facility or agency, or an institution of higher education in this state that has colleges of osteopathic and human medicine, are confidential, must be used only for the purposes provided in this article, are not public records, and are not subject to court subpoena.

    (14) This section does not apply to a health facility or agency that is a health maintenance organization.