(a) All information collected for the prescription monitoring program database and any records maintained by the board, or by any entity contracting with the board, submitted to, maintained or stored as a part of the database, shall be retained for five years.

(b) Program data shall not be stored outside of the program database, with the following exceptions:

(1) Temporary storage necessary to deliver program data to electronic health records or pharmacy management systems approved by the board;

(2) retention of specific information or records related to an investigation or proceeding under administrative or criminal law;

(3) program data provided under Kan. Stat. Ann. § 65-1685(e), and amendments thereto; or

(4) board retention of information for purposes of operation of the program and administration and enforcement of this act or the uniform controlled substances act, Kan. Stat. Ann. § 65-4101 et seq., and amendments thereto.