Michigan 2023-2024 Regular Session

Michigan House Bill HB5072 Compare Versions

Only one version of the bill is available at this time.
OldNewDifferences
11 HOUSE BILL NO. 5072 A bill to amend 1978 PA 368, entitled "Public health code," by amending sections 16213, 20175, and 20175a (MCL 333.16213, 333.20175, and 333.20175a), sections 16213 and 20175a as added and section 20175 as amended by 2006 PA 481. the people of the state of michigan enact: Sec. 16213. (1) An individual licensed under this article A licensee shall keep and maintain a record for each patient for whom he or she the licensee has provided medical services, including a full and complete record of tests and examinations performed, observations made, and treatments provided. Unless a longer retention period is otherwise required under federal or state laws or regulations or by generally accepted standards of medical practice, a licensee shall keep and retain each record for a minimum of 7 years from the date of service to which the record pertains. The records shall must be maintained in such a manner as to protect their integrity, to ensure their confidentiality and proper use, and to ensure their accessibility and availability to each patient or his or her the patient's authorized representative as required by law. A licensee may destroy a record that is less than 7 years old only if both of the following are satisfied: (a) The licensee sends a written notice to the patient at the last known address of that patient informing the patient that the record is about to be destroyed, offering the patient the opportunity to request a copy of that record, and requesting the patient's written authorization to destroy the record. (b) The licensee receives written authorization from the patient or his or her the patient's authorized representative agreeing to the destruction of the record. (2) If a licensee is unable to comply with this section, the licensee shall employ or contract, arrange, or enter into an agreement with another health care provider, a health facility or agency, or a medical records company to protect, maintain, and provide access to those records required under subsection (1). (3) If a licensee or registrant sells or closes his or her the licensee's practice, retires from practice, or otherwise ceases to practice under this article, the licensee or the personal representative of the licensee, if the licensee is deceased, shall not abandon the records required under this section and shall send a written notice to the department that specifies who will have custody of the medical records and how a patient may request access to or copies of his or her the patient's medical records and shall do either of the following: (a) Transfer the records required under subsection (1) to any of the following: (i) A successor licensee. (ii) If requested by the patient or his or her the patient's authorized representative, to the patient or a specific health facility or agency or other health care provider licensed under article 15. (iii) A health care provider, a health facility or agency, or a medical records company with which the licensee had contracted or entered into an agreement to protect, maintain, and provide access to those records required under subsection (1). (b) In accordance with subsection (1), as long as the licensee or the personal representative of the licensee, if the licensee is deceased, sends a written notice to the last known address of each patient for whom he or she the licensee has provided medical services and receives written authorization from the patient or his or her the patient's authorized representative, destroy the records required under subsection (1). The notice shall must provide the patient with 30 days to request a copy of his or her the patient's record or to designate where he or she the patient would like his or her the patient's medical records transferred and shall must request from the patient within 30 days written authorization for the destruction of his or her the patient's medical records. If the patient fails to request a copy or transfer of his or her the patient's medical records or to provide the licensee with written authorization for the destruction, then the licensee or the personal representative of the licensee shall not destroy those records that are less than 7 years old but may destroy, in accordance with subsection (4), those that are 7 years old or older. (4) Except as otherwise provided under this section or federal or state laws and regulations, records required to be maintained under subsection (1) may be destroyed or otherwise disposed of after being maintained for 7 years. If records maintained in accordance with this section are subsequently destroyed or otherwise disposed of, those records shall must be shredded, incinerated, electronically deleted, or otherwise disposed of in a manner that ensures continued confidentiality of the patient's health care information and any other personal information relating to the patient. If records are not destroyed or otherwise disposed of as provided under this subsection, the department may take action, including, but not limited to, contracting for or making other arrangements to ensure that those records and any other confidential identifying information related to the patient are properly destroyed or disposed of to protect the confidentiality of patient's health care information and any other personal information relating to the patient. Before the department takes action in accordance with this subsection, the department, if able to identify the licensee responsible for the improper destruction or disposal of the medical records at issue, shall send a written notice to that licensee at his or her the licensee's last known address or place of business on file with the department and provide the licensee with an opportunity to properly destroy or dispose of those medical records as required under this subsection unless a delay in the proper destruction or disposal may compromise the patient's confidentiality. The department may assess the licensee with the costs incurred by the department to enforce this subsection. (5) If a licensee uses an off-site physical or virtual environment, including through a medical records company, to maintain the records required under subsection (1), the licensee shall ensure that the off-site physical or virtual environment is physically maintained in a province of Canada or a state. (6) (5) A person who that fails to comply with this section is subject to an administrative fine of not more than $10,000.00 if the failure was the result of gross negligence or willful and wanton misconduct. (7) (6) Nothing in this This section shall must not be construed to create or change the ownership rights to any medical records. (8) (7) As used in this section: (a) "Medical record" or "record" means information, oral or recorded in any form or medium, that pertains to a patient's health care, medical history, diagnosis, prognosis, or medical condition and that is maintained by a licensee in the process of providing medical services. (b) "Medical records company" means a person who that contracts for or agrees to protect, maintain, and provide access to medical records for a health care provider or health facility or agency in accordance with this section. (c) "Patient" means an individual who receives or has received health care from a health care provider or health facility or agency. Patient includes a guardian, if appointed, and a parent, guardian, or person acting in loco parentis, if the individual is a minor, unless the minor lawfully obtained health care without the consent or notification of a parent, guardian, or other person acting in loco parentis, in which case the minor has the exclusive right to exercise the rights of a patient under this section with respect to his or her the minor's medical records relating to that care. Sec. 20175. (1) A health facility or agency shall keep and maintain a record for each patient, including a full and complete record of tests and examinations performed, observations made, treatments provided, and in the case of a hospital, the purpose of hospitalization. Unless a longer retention period is otherwise required under federal or state laws or regulations or by generally accepted standards of medical practice, a health facility or agency shall keep and retain each record for a minimum of 7 years from the date of service to which the record pertains. A health facility or agency shall maintain the records in such a manner as to protect their integrity, to ensure their confidentiality and proper use, and to ensure their accessibility and availability to each patient or his or her the patient's authorized representative as required by law. A health facility or agency may destroy a record that is less than 7 years old only if both of the following are satisfied: (a) The health facility or agency sends a written notice to the patient at the last known address of that patient informing the patient that the record is about to be destroyed, offering the patient the opportunity to request a copy of that record, and requesting the patient's written authorization to destroy the record. (b) The health facility or agency receives written authorization from the patient or his or her the patient's authorized representative agreeing to the destruction of the record. Except as otherwise provided under federal or state laws and regulations, records required to be maintained under this subsection may be destroyed or otherwise disposed of after being maintained for 7 years. If records maintained in accordance with this section are subsequently destroyed or otherwise disposed of, those records shall must be shredded, incinerated, electronically deleted, or otherwise disposed of in a manner that ensures continued confidentiality of the patient's health care information and any other personal information relating to the patient. If records are not destroyed or otherwise disposed of as provided under this subsection, the department may take action, including, but not limited to, contracting for or making other arrangements to ensure that those records and any other confidential identifying information related to the patient are properly destroyed or disposed of to protect the confidentiality of patient's health care information and any other personal information relating to the patient. Before the department takes action in accordance with this subsection, the department, if able to identify the health facility or agency responsible for the improper destruction or disposal of the medical records at issue, shall send a written notice to that health facility or agency at the last known address on file with the department and provide the health facility or agency with an opportunity to properly destroy or dispose of those medical records as required under this subsection unless a delay in the proper destruction or disposal may compromise the patient's confidentiality. The department may assess the health facility or agency with the costs incurred by the department to enforce this subsection. In addition to the sanctions set forth in section 20165, a hospital that fails to comply with this subsection is subject to an administrative fine of $10,000.00. (2) A hospital shall take precautions to assure ensure that the records required by subsection (1) are not wrongfully altered or destroyed. A hospital that fails to comply with this subsection is subject to an administrative fine of $10,000.00. (3) Unless otherwise provided by law, the licensing and certification records required by this article are public records. (4) Departmental officers and employees shall respect the confidentiality of patient clinical records and shall not divulge or disclose the contents of records in a manner that identifies an individual except pursuant to under court order or as otherwise authorized by law. (5) A health facility or agency that employs, contracts with, or grants privileges to a health professional licensed or registered under article 15 shall report the following to the department not more than 30 days after it occurs: (a) Disciplinary action taken by the health facility or agency against a health professional licensed or registered under article 15 based on the licensee's or registrant's professional competence, disciplinary action that results in a change of employment status, or disciplinary action based on conduct that adversely affects the licensee's or registrant's clinical privileges for a period of more than 15 days. As used in this subdivision, "adversely affects" means the reduction, restriction, suspension, revocation, denial, or failure to renew the clinical privileges of a licensee or registrant by a health facility or agency. (b) Restriction or acceptance of the surrender of the clinical privileges of a licensee or registrant under either of the following circumstances: (i) The licensee or registrant is under investigation by the health facility or agency. (ii) There is an agreement in which the health facility or agency agrees not to conduct an investigation into the licensee's or registrant's alleged professional incompetence or improper professional conduct. (c) A case in which a health professional resigns or terminates a contract or whose contract is not renewed instead of the health facility taking disciplinary action against the health professional. (6) Upon On request by another health facility or agency seeking a reference for purposes of changing or granting staff privileges, credentials, or employment, a health facility or agency that employs, contracts with, or grants privileges to health professionals licensed or registered under article 15 shall notify the requesting health facility or agency of any disciplinary or other action reportable under subsection (5) that it has taken against a health professional licensed or registered under article 15 and employed by, under contract to, or granted privileges by the health facility or agency. (7) For the purpose of reporting disciplinary actions under this section, a health facility or agency shall include only the following in the information provided: (a) The name of the licensee or registrant against whom disciplinary action has been taken. (b) A description of the disciplinary action taken. (c) The specific grounds for the disciplinary action taken. (d) The date of the incident that is the basis for the disciplinary action. (8) The records, data, and knowledge collected for or by individuals or committees assigned a professional review function in a health facility or agency, or an institution of higher education in this state that has colleges of osteopathic and human medicine, are confidential, shall must be used only for the purposes provided in this article, are not public records, and are not subject to court subpoena. Sec. 20175a. (1) If a health facility or agency is unable to comply with section 20175, the health facility or agency shall employ or contract, arrange, or enter into an agreement with another health facility or agency or a medical records company to protect, maintain, and provide access to those records required under section 20175(1). (2) If a health facility or agency closes or otherwise ceases operation, the health facility or agency shall not abandon the records required to be maintained under section 20175(1) and shall send a written notice to the department that specifies who will have custody of the medical records and how a patient may request access to or copies of his or her the patient's medical records and shall do either of the following: (a) Transfer the records required under section 20175(1) to any of the following: (i) A successor health facility or agency. (ii) If designated by the patient or his or her the patient's authorized representative, to the patient or a specific health facility or agency or a health care provider licensed or registered under article 15. (iii) A health facility or agency or a medical records company with which the health facility or agency had contracted or entered into an agreement to protect, maintain, and provide access to those records required under section 20175(1). (b) In accordance with section 20175(1), as long as the health facility or agency sends a written notice to the last known address of each patient for whom he or she the health facility or agency has provided medical services and receives written authorization from the patient or his or her the patient's authorized representative, destroy the records required under section 20175(1). The notice shall must provide the patient with 30 days to request a copy of his or her the patient's record or to designate where he or she the patient would like his or her the patient's medical records transferred and shall must request from the patient within 30 days written authorization for the destruction of his or her the patient's medical records. If the patient fails to request a copy or transfer of his or her the patient's medical records or to provide the health facility or agency with written authorization for the destruction, then the health facility or agency shall not destroy those records that are less than 7 years old but may destroy, in accordance with section 20175(1), those that are 7 years old or older. (3) If a health facility or agency uses an off-site physical or virtual environment, including through a medical records company, to maintain the records required under section 20175(1), the health facility or agency shall ensure that the off-site physical or virtual environment is physically maintained in a province of Canada or a state. (4) (3) Nothing in this This section shall must not be conducted construed to create or change the ownership rights to any medical records. (5) (4) A person that fails to comply with this section is subject to an administrative fine of not more than $10,000.00 if the failure was the result of gross negligence or willful and wanton misconduct. (6) (5) As used in this section and section 20175: (a) "Medical record" or "record" means information, oral or recorded in any form or medium, that pertains to a patient's health care, medical history, diagnosis, prognosis, or medical condition and that is maintained by a licensee in the process of providing medical services. (b) "Medical records company" means a person who that contracts for or agrees to protect, maintain, and provide access to medical records for a health facility or agency in accordance with section 20175. (c) "Patient" means an individual who receives or has received health care from a health care provider or health facility or agency. Patient includes a guardian, if appointed, and a parent, guardian, or person acting in loco parentis, if the individual is a minor, unless the minor lawfully obtained health care without the consent or notification of a parent, guardian, or other person acting in loco parentis, in which case the minor has the exclusive right to exercise the rights of a patient under this section with respect to his or her the minor's medical records relating to that care.
22
33
44
55
66
77
88
99
1010
1111
1212
1313
1414
1515
1616
1717
1818
1919
2020
2121
2222
2323 HOUSE BILL NO. 5072
2424
2525
2626
2727 A bill to amend 1978 PA 368, entitled
2828
2929 "Public health code,"
3030
3131 by amending sections 16213, 20175, and 20175a (MCL 333.16213, 333.20175, and 333.20175a), sections 16213 and 20175a as added and section 20175 as amended by 2006 PA 481.
3232
3333 the people of the state of michigan enact:
3434
3535 Sec. 16213. (1) An individual licensed under this article A licensee shall keep and maintain a record for each patient for whom he or she the licensee has provided medical services, including a full and complete record of tests and examinations performed, observations made, and treatments provided. Unless a longer retention period is otherwise required under federal or state laws or regulations or by generally accepted standards of medical practice, a licensee shall keep and retain each record for a minimum of 7 years from the date of service to which the record pertains. The records shall must be maintained in such a manner as to protect their integrity, to ensure their confidentiality and proper use, and to ensure their accessibility and availability to each patient or his or her the patient's authorized representative as required by law. A licensee may destroy a record that is less than 7 years old only if both of the following are satisfied:
3636
3737 (a) The licensee sends a written notice to the patient at the last known address of that patient informing the patient that the record is about to be destroyed, offering the patient the opportunity to request a copy of that record, and requesting the patient's written authorization to destroy the record.
3838
3939 (b) The licensee receives written authorization from the patient or his or her the patient's authorized representative agreeing to the destruction of the record.
4040
4141 (2) If a licensee is unable to comply with this section, the licensee shall employ or contract, arrange, or enter into an agreement with another health care provider, a health facility or agency, or a medical records company to protect, maintain, and provide access to those records required under subsection (1).
4242
4343 (3) If a licensee or registrant sells or closes his or her the licensee's practice, retires from practice, or otherwise ceases to practice under this article, the licensee or the personal representative of the licensee, if the licensee is deceased, shall not abandon the records required under this section and shall send a written notice to the department that specifies who will have custody of the medical records and how a patient may request access to or copies of his or her the patient's medical records and shall do either of the following:
4444
4545 (a) Transfer the records required under subsection (1) to any of the following:
4646
4747 (i) A successor licensee.
4848
4949 (ii) If requested by the patient or his or her the patient's authorized representative, to the patient or a specific health facility or agency or other health care provider licensed under article 15.
5050
5151 (iii) A health care provider, a health facility or agency, or a medical records company with which the licensee had contracted or entered into an agreement to protect, maintain, and provide access to those records required under subsection (1).
5252
5353 (b) In accordance with subsection (1), as long as the licensee or the personal representative of the licensee, if the licensee is deceased, sends a written notice to the last known address of each patient for whom he or she the licensee has provided medical services and receives written authorization from the patient or his or her the patient's authorized representative, destroy the records required under subsection (1). The notice shall must provide the patient with 30 days to request a copy of his or her the patient's record or to designate where he or she the patient would like his or her the patient's medical records transferred and shall must request from the patient within 30 days written authorization for the destruction of his or her the patient's medical records. If the patient fails to request a copy or transfer of his or her the patient's medical records or to provide the licensee with written authorization for the destruction, then the licensee or the personal representative of the licensee shall not destroy those records that are less than 7 years old but may destroy, in accordance with subsection (4), those that are 7 years old or older.
5454
5555 (4) Except as otherwise provided under this section or federal or state laws and regulations, records required to be maintained under subsection (1) may be destroyed or otherwise disposed of after being maintained for 7 years. If records maintained in accordance with this section are subsequently destroyed or otherwise disposed of, those records shall must be shredded, incinerated, electronically deleted, or otherwise disposed of in a manner that ensures continued confidentiality of the patient's health care information and any other personal information relating to the patient. If records are not destroyed or otherwise disposed of as provided under this subsection, the department may take action, including, but not limited to, contracting for or making other arrangements to ensure that those records and any other confidential identifying information related to the patient are properly destroyed or disposed of to protect the confidentiality of patient's health care information and any other personal information relating to the patient. Before the department takes action in accordance with this subsection, the department, if able to identify the licensee responsible for the improper destruction or disposal of the medical records at issue, shall send a written notice to that licensee at his or her the licensee's last known address or place of business on file with the department and provide the licensee with an opportunity to properly destroy or dispose of those medical records as required under this subsection unless a delay in the proper destruction or disposal may compromise the patient's confidentiality. The department may assess the licensee with the costs incurred by the department to enforce this subsection.
5656
5757 (5) If a licensee uses an off-site physical or virtual environment, including through a medical records company, to maintain the records required under subsection (1), the licensee shall ensure that the off-site physical or virtual environment is physically maintained in a province of Canada or a state.
5858
5959 (6) (5) A person who that fails to comply with this section is subject to an administrative fine of not more than $10,000.00 if the failure was the result of gross negligence or willful and wanton misconduct.
6060
6161 (7) (6) Nothing in this This section shall must not be construed to create or change the ownership rights to any medical records.
6262
6363 (8) (7) As used in this section:
6464
6565 (a) "Medical record" or "record" means information, oral or recorded in any form or medium, that pertains to a patient's health care, medical history, diagnosis, prognosis, or medical condition and that is maintained by a licensee in the process of providing medical services.
6666
6767 (b) "Medical records company" means a person who that contracts for or agrees to protect, maintain, and provide access to medical records for a health care provider or health facility or agency in accordance with this section.
6868
6969 (c) "Patient" means an individual who receives or has received health care from a health care provider or health facility or agency. Patient includes a guardian, if appointed, and a parent, guardian, or person acting in loco parentis, if the individual is a minor, unless the minor lawfully obtained health care without the consent or notification of a parent, guardian, or other person acting in loco parentis, in which case the minor has the exclusive right to exercise the rights of a patient under this section with respect to his or her the minor's medical records relating to that care.
7070
7171 Sec. 20175. (1) A health facility or agency shall keep and maintain a record for each patient, including a full and complete record of tests and examinations performed, observations made, treatments provided, and in the case of a hospital, the purpose of hospitalization. Unless a longer retention period is otherwise required under federal or state laws or regulations or by generally accepted standards of medical practice, a health facility or agency shall keep and retain each record for a minimum of 7 years from the date of service to which the record pertains. A health facility or agency shall maintain the records in such a manner as to protect their integrity, to ensure their confidentiality and proper use, and to ensure their accessibility and availability to each patient or his or her the patient's authorized representative as required by law. A health facility or agency may destroy a record that is less than 7 years old only if both of the following are satisfied:
7272
7373 (a) The health facility or agency sends a written notice to the patient at the last known address of that patient informing the patient that the record is about to be destroyed, offering the patient the opportunity to request a copy of that record, and requesting the patient's written authorization to destroy the record.
7474
7575 (b) The health facility or agency receives written authorization from the patient or his or her the patient's authorized representative agreeing to the destruction of the record. Except as otherwise provided under federal or state laws and regulations, records required to be maintained under this subsection may be destroyed or otherwise disposed of after being maintained for 7 years. If records maintained in accordance with this section are subsequently destroyed or otherwise disposed of, those records shall must be shredded, incinerated, electronically deleted, or otherwise disposed of in a manner that ensures continued confidentiality of the patient's health care information and any other personal information relating to the patient. If records are not destroyed or otherwise disposed of as provided under this subsection, the department may take action, including, but not limited to, contracting for or making other arrangements to ensure that those records and any other confidential identifying information related to the patient are properly destroyed or disposed of to protect the confidentiality of patient's health care information and any other personal information relating to the patient. Before the department takes action in accordance with this subsection, the department, if able to identify the health facility or agency responsible for the improper destruction or disposal of the medical records at issue, shall send a written notice to that health facility or agency at the last known address on file with the department and provide the health facility or agency with an opportunity to properly destroy or dispose of those medical records as required under this subsection unless a delay in the proper destruction or disposal may compromise the patient's confidentiality. The department may assess the health facility or agency with the costs incurred by the department to enforce this subsection. In addition to the sanctions set forth in section 20165, a hospital that fails to comply with this subsection is subject to an administrative fine of $10,000.00.
7676
7777 (2) A hospital shall take precautions to assure ensure that the records required by subsection (1) are not wrongfully altered or destroyed. A hospital that fails to comply with this subsection is subject to an administrative fine of $10,000.00.
7878
7979 (3) Unless otherwise provided by law, the licensing and certification records required by this article are public records.
8080
8181 (4) Departmental officers and employees shall respect the confidentiality of patient clinical records and shall not divulge or disclose the contents of records in a manner that identifies an individual except pursuant to under court order or as otherwise authorized by law.
8282
8383 (5) A health facility or agency that employs, contracts with, or grants privileges to a health professional licensed or registered under article 15 shall report the following to the department not more than 30 days after it occurs:
8484
8585 (a) Disciplinary action taken by the health facility or agency against a health professional licensed or registered under article 15 based on the licensee's or registrant's professional competence, disciplinary action that results in a change of employment status, or disciplinary action based on conduct that adversely affects the licensee's or registrant's clinical privileges for a period of more than 15 days. As used in this subdivision, "adversely affects" means the reduction, restriction, suspension, revocation, denial, or failure to renew the clinical privileges of a licensee or registrant by a health facility or agency.
8686
8787 (b) Restriction or acceptance of the surrender of the clinical privileges of a licensee or registrant under either of the following circumstances:
8888
8989 (i) The licensee or registrant is under investigation by the health facility or agency.
9090
9191 (ii) There is an agreement in which the health facility or agency agrees not to conduct an investigation into the licensee's or registrant's alleged professional incompetence or improper professional conduct.
9292
9393 (c) A case in which a health professional resigns or terminates a contract or whose contract is not renewed instead of the health facility taking disciplinary action against the health professional.
9494
9595 (6) Upon On request by another health facility or agency seeking a reference for purposes of changing or granting staff privileges, credentials, or employment, a health facility or agency that employs, contracts with, or grants privileges to health professionals licensed or registered under article 15 shall notify the requesting health facility or agency of any disciplinary or other action reportable under subsection (5) that it has taken against a health professional licensed or registered under article 15 and employed by, under contract to, or granted privileges by the health facility or agency.
9696
9797 (7) For the purpose of reporting disciplinary actions under this section, a health facility or agency shall include only the following in the information provided:
9898
9999 (a) The name of the licensee or registrant against whom disciplinary action has been taken.
100100
101101 (b) A description of the disciplinary action taken.
102102
103103 (c) The specific grounds for the disciplinary action taken.
104104
105105 (d) The date of the incident that is the basis for the disciplinary action.
106106
107107 (8) The records, data, and knowledge collected for or by individuals or committees assigned a professional review function in a health facility or agency, or an institution of higher education in this state that has colleges of osteopathic and human medicine, are confidential, shall must be used only for the purposes provided in this article, are not public records, and are not subject to court subpoena.
108108
109109 Sec. 20175a. (1) If a health facility or agency is unable to comply with section 20175, the health facility or agency shall employ or contract, arrange, or enter into an agreement with another health facility or agency or a medical records company to protect, maintain, and provide access to those records required under section 20175(1).
110110
111111 (2) If a health facility or agency closes or otherwise ceases operation, the health facility or agency shall not abandon the records required to be maintained under section 20175(1) and shall send a written notice to the department that specifies who will have custody of the medical records and how a patient may request access to or copies of his or her the patient's medical records and shall do either of the following:
112112
113113 (a) Transfer the records required under section 20175(1) to any of the following:
114114
115115 (i) A successor health facility or agency.
116116
117117 (ii) If designated by the patient or his or her the patient's authorized representative, to the patient or a specific health facility or agency or a health care provider licensed or registered under article 15.
118118
119119 (iii) A health facility or agency or a medical records company with which the health facility or agency had contracted or entered into an agreement to protect, maintain, and provide access to those records required under section 20175(1).
120120
121121 (b) In accordance with section 20175(1), as long as the health facility or agency sends a written notice to the last known address of each patient for whom he or she the health facility or agency has provided medical services and receives written authorization from the patient or his or her the patient's authorized representative, destroy the records required under section 20175(1). The notice shall must provide the patient with 30 days to request a copy of his or her the patient's record or to designate where he or she the patient would like his or her the patient's medical records transferred and shall must request from the patient within 30 days written authorization for the destruction of his or her the patient's medical records. If the patient fails to request a copy or transfer of his or her the patient's medical records or to provide the health facility or agency with written authorization for the destruction, then the health facility or agency shall not destroy those records that are less than 7 years old but may destroy, in accordance with section 20175(1), those that are 7 years old or older.
122122
123123 (3) If a health facility or agency uses an off-site physical or virtual environment, including through a medical records company, to maintain the records required under section 20175(1), the health facility or agency shall ensure that the off-site physical or virtual environment is physically maintained in a province of Canada or a state.
124124
125125 (4) (3) Nothing in this This section shall must not be conducted construed to create or change the ownership rights to any medical records.
126126
127127 (5) (4) A person that fails to comply with this section is subject to an administrative fine of not more than $10,000.00 if the failure was the result of gross negligence or willful and wanton misconduct.
128128
129129 (6) (5) As used in this section and section 20175:
130130
131131 (a) "Medical record" or "record" means information, oral or recorded in any form or medium, that pertains to a patient's health care, medical history, diagnosis, prognosis, or medical condition and that is maintained by a licensee in the process of providing medical services.
132132
133133 (b) "Medical records company" means a person who that contracts for or agrees to protect, maintain, and provide access to medical records for a health facility or agency in accordance with section 20175.
134134
135135 (c) "Patient" means an individual who receives or has received health care from a health care provider or health facility or agency. Patient includes a guardian, if appointed, and a parent, guardian, or person acting in loco parentis, if the individual is a minor, unless the minor lawfully obtained health care without the consent or notification of a parent, guardian, or other person acting in loco parentis, in which case the minor has the exclusive right to exercise the rights of a patient under this section with respect to his or her the minor's medical records relating to that care.