(1) A massage therapist who treats clients or patients eighteen years of age and older must keep client or patient records for at least three years from the date of last treatment.

(2) A massage therapist who treats clients or patients under the age of eighteen years old must keep client or patient records for at least three years after the client or patient reaches eighteen years old.

(3) A massage therapist must also comply with record retention requirements of chapter 70.02 RCW.

(4) All records must be secured with properly limited access in compliance with chapter 70.02 RCW and the Health Insurance Portability and Accountability Act (HIPAA).

(5) After the retention period, the massage therapist may dispose of the record. Disposal must be done in a secure and confidential manner in compliance with chapter 70.02 RCW and HIPAA and must include as appropriate:

(a) Shredding;

(b) Deleting, erasing, or reformatting electronic media; and

(c) Other readable forms of media that are defaced or rendered unusable or unreadable.