(1) Every managed care organization shall establish and at all times maintain adequate records of its financial and business transactions.
(2) The managed care organization shall retain its general records with respect to a particular transaction for a period of not less than seven (7) years after termination of the transaction, and health records shall be retained for a period of seven (7) years after the termination of the member’s contract.
(3) The managed care organization shall make all records available to the director or his designee for review at all reasonable times upon the director’s request; provided, however, that the availability of health records shall be subject to any Idaho law limiting or defining such availability.