I’ve always understood that as a fitness business, client records need to be kept onsite in a secure area with only access by the trainer/service provider. I have some sub contractors who do specialized services, like accupunture and MAT, do they need to keep the records here in the same manner? What is the liability there and what does the law require?