(a) All information collected for the prescription monitoring program database and any records maintained by the board, or by any entity contracting with the board, submitted to, maintained or stored as a part of the database, shall be retained for five years.
(b) Program data shall not be stored outside of the program database, with the following exceptions:
(1) Temporary storage necessary to deliver program data to electronic health records or pharmacy management systems approved by the board;
(2) retention of specific information or records related to an investigation or proceeding under administrative or criminal law;
(3) program data provided under K.S.A. 65-1685 (e), and amendments thereto; or
(4) board retention of information for purposes of operation of the program and administration and enforcement of this act or the uniform controlled substances act, K.S.A. 65-4101 et seq., and amendments thereto.