(a) Upon request by a service recipient sixteen (16) years of age or older, a service provider shall disclose to the service recipient what records the provider maintains on the service recipient and how the service recipient can obtain access to them. Upon written request by a service recipient, a service provider shall permit the service recipient, within a reasonable time, to review the service recipient's record itself or the part of it that the service recipient requests or a copy of the record or the part except to the extent that:
(1) Service recipient access to the record is expressly restricted or prohibited by another statute; or
(2) The provider is authorized to deny access under subsection (b).
(b) If a person's qualified mental health professional determines that giving the service recipient, or a person acting for the service recipient, access to part of the service recipient's record poses a substantial risk of serious harm to the health or safety of the service recipient or another person, then the qualified mental health professional may refuse access to that part of the record.