Each agency licensed by the department to provide any behavioral health service must:

(1) Maintain a comprehensive clinical record system that includes policies and procedures that protect an individual's personal health information;

(2) Ensure that the individual's personal health information is shared or released only in compliance with applicable state and federal law;

(3) If maintaining electronic individual clinical records:

(a) Provide secure, limited access through means that prevent modification or deletion after initial preparation;

(b) Provide for a backup of records in the event of equipment, media, or human error; and

(c) Provide for protection from unauthorized access, including network and internet access;

(4) Retain an individual's clinical record, including an electronic record, for a minimum of six years after the discharge or transfer of any individual;

(5) Retain a youth's or child's individual clinical record, including an electronic record, for at least six years after the most recent discharge, or at least three years following the youth's or child's eighteenth birthday; and

(6) Meet the access to clinical records requirements in WAC 246-341-0650.