(1) A health care facility must initiate and maintain a safe, secure, and confidential medical record for each patient, resident, or client.

(2) A health care facility, excluding a hospital, shall retain a patient's, resident's, or client's medical records for no less than six years following the date of the patient's, resident's, or client's discharge or death, or upon the closure of the facility.