Individual notice deadline
As expeditiously as practicable, and without unreasonable delay, but no later than 30 days after determining the breach, subject to the statutory law-enforcement delay and a permitted 15-day extension for good cause.
The outer bound of 30 days is materially shorter than HIPAA's 60-day individual-notice window. Federal and state duties apply independently.
Source: Fla. Stat. § 501.171(4)(a)
Statewide rules that also reach telehealth practices
Minor may consent
The disability of nonage of a minor who is married, has been married, subsequently becomes married, or whose marriage is dissolved, or who is widowed or widowered, is removed. The minor may assume the management of their estate, contract and be contracted with, sue and be sued, and perform all acts that they could do if not a minor.
What this means operationally
Florida removes the disability outright rather than granting a health-care-specific capacity, so a married or formerly married minor consents as an adult would across every service line, dentistry and optometry included. The status persists after the marriage ends, which means the question at intake is whether the minor has ever been married, not whether they are married now.
Applies when
- The minor is or has been married
Minor may consent
Where, after a reasonable attempt, a person with the power to consent as otherwise provided by law cannot be contacted by the treatment provider and has given no actual notice to the contrary, the following may consent to the medical care or treatment of a minor, IN THE ORDER OF PRIORITY LISTED: a health care surrogate designated under § 765.2035 after 30 September 2015 or a person holding a power of attorney to give medical consent for the minor; the stepparent; the grandparent; an adult brother or sister; an adult aunt or uncle. Medical care and treatment for this purpose means ordinary and necessary medical and dental examination and treatment, including blood testing, ordinary immunizations, tuberculin testing and well-child care, but excludes surgery, general anesthesia, provision of psychotropic medications and other extraordinary procedures. Blood testing excludes HIV testing and controlled substance testing. Documentation that a reasonable attempt was made to contact the person with the power to consent shall be maintained in the provider's records of the minor.
What this means operationally
Unlike the Texas and Maryland equivalents, Florida's list is ORDERED — a grandparent does not have equal standing with a stepparent, and a practice that takes consent from whoever is in the room has not followed the section. Three further constraints do real work: the scope is defined as ordinary and necessary care and expressly excludes surgery, general anesthesia and psychotropic medications; a surrogate or power of attorney CAN reach surgery and anesthesia where the grandparent route cannot; and the reasonable attempt to reach the parent must be documented in the minor's record, not merely made.
Applies when
- A reasonable attempt to contact the person with power to consent has failed
- That person has given no actual notice to the contrary
- The minor is not committed to or in the custody of the Department of Children and Families or the Department of Juvenile Justice
Exceptions
- Excludes surgery, general anesthesia, psychotropic medications and other extraordinary procedures, except that a qualifying health care surrogate or power of attorney may reach medically necessary surgical and general anesthesia services unless excluded in the instrument
- Blood testing under the section excludes HIV testing and controlled substance testing
- Does not apply to minors in the custody of the Department of Children and Families or the Department of Juvenile Justice
Left to professional judgment
A health care provider may accept the completed certification form, or the card issued under § 1001.42, as proof of a minor's status as a certified unaccompanied homeless youth, and may keep a copy of the form or card in the youth's medical file. An unaccompanied homeless youth is an individual 16 or older who is not in the physical custody of a parent or guardian, including one who has run away from home, been forced to leave, or been left behind. Certification is made by a school district's liaison for homeless children and youths, or by the director of a qualifying federally funded shelter, runaway or transitional living program, or a continuum of care lead agency.
What this means operationally
Florida gives a practice something most states do not: a standardized document it may rely on, and express permission to retain a copy. What the section does NOT do is confer consent capacity — the youth reaches that by petitioning the circuit court under § 743.015. So the form answers who the patient is, not who may consent, and treating it as consent authority would be a misreading with real consequences.
Applies when
- A minor presents a completed certification form or § 1001.42 card
Exceptions
- The form is proof of status only; consent capacity requires removal of the disabilities of nonage under § 743.015
Duty to keep an accurate record
RECORDS OWNERS ARE RESPONSIBLE FOR MAINTAINING A RECORD OF ALL DISCLOSURES of information contained in the medical record TO A THIRD PARTY, INCLUDING THE PURPOSE OF THE DISCLOSURE REQUEST. The record of disclosure MAY BE MAINTAINED IN THE MEDICAL RECORD. The THIRD PARTY to whom information is disclosed IS PROHIBITED FROM FURTHER DISCLOSING any information in the medical record WITHOUT THE EXPRESSED WRITTEN CONSENT of the patient or the patient's legal representative.
What this means operationally
A standing accounting-of-disclosures duty in state law, and it is broader than the federal one because it carries no exclusion for treatment, payment or operations disclosures — every third-party disclosure is logged, and the PURPOSE must be captured, not just the recipient and date. Practices that rely on their EHR's HIPAA disclosure log will usually find it under-scoped for this. The downstream limb is the one worth telling requesters about: a third party who receives records may not pass them on without the patient's express written consent, which binds insurers, attorneys and referral recipients directly.
Applies when
- Information in a medical record is disclosed to a third party
Duty to keep an accurate record
ALL RECORDS OWNERS SHALL DEVELOP AND IMPLEMENT POLICIES, STANDARDS AND PROCEDURES TO PROTECT THE CONFIDENTIALITY AND SECURITY OF THE MEDICAL RECORD. EMPLOYEES OF RECORDS OWNERS SHALL BE TRAINED IN THESE POLICIES, STANDARDS AND PROCEDURES.
What this means operationally
A state-law written-policy and workforce-training mandate that sits alongside the federal one and is stated in two sentences with no size threshold, no risk-analysis qualifier and no exemption for small practices. It names SECURITY as well as confidentiality, so it is not satisfied by a privacy notice alone. Because enforcement runs through the practitioner's own licensing board under § 456.057(15) rather than through a federal regulator, a documentation gap here is a license-discipline exposure for the individual practitioner, which is a different risk profile from a civil monetary penalty against an entity.
Applies when
- A practitioner or practice is a records owner under § 456.057(1)
Parental right of access
Any health care practitioner licensed by the department or a board who makes a physical or mental examination of, administers treatment to, or dispenses legend drugs to any person shall, upon request of that person or their legal representative, FURNISH, IN A TIMELY MANNER, WITHOUT DELAYS FOR LEGAL REVIEW, copies of ALL REPORTS AND RECORDS relating to such examination or treatment, INCLUDING X RAYS AND INSURANCE INFORMATION. However, where a patient's PSYCHIATRIC, chapter 490 PSYCHOLOGICAL, or chapter 491 PSYCHOTHERAPEUTIC records are requested by the patient or their legal representative, the practitioner MAY PROVIDE A REPORT OF EXAMINATION AND TREATMENT IN LIEU OF COPIES of records. Upon a patient's WRITTEN REQUEST, COMPLETE COPIES of the patient's psychiatric records SHALL BE PROVIDED DIRECTLY TO A SUBSEQUENT TREATING PSYCHIATRIST. THE FURNISHING OF SUCH REPORT OR COPIES SHALL NOT BE CONDITIONED UPON PAYMENT OF A FEE FOR SERVICES RENDERED.
What this means operationally
Three phrases carry the weight. WITHOUT DELAYS FOR LEGAL REVIEW forecloses the common practice of routing a patient's own request through counsel before release. The duty expressly reaches X RAYS AND INSURANCE INFORMATION, so a practice that treats billing and imaging as outside the record is under-producing. And release may not be conditioned on payment for the CARE — distinct from the copying charge, which the fee provision separately permits. The mental-health carve-out is a real option but narrow: a report may substitute for the record when the patient asks, yet a written request routes the COMPLETE psychiatric record directly to a subsequent treating psychiatrist with no substitution available.
Applies when
- A patient or legal representative requests reports or records of examination or treatment
Exceptions
- Does not apply to facilities licensed under chapter 395
- For psychiatric, chapter 490 psychological or chapter 491 psychotherapeutic records, a report of examination and treatment may be provided in lieu of copies
Limit on copy fees, format or delivery
A health care practitioner or records owner furnishing copies of reports or records, OR MAKING THE REPORTS OR RECORDS AVAILABLE FOR DIGITAL SCANNING, shall charge NO MORE THAN THE ACTUAL COST OF COPYING, INCLUDING REASONABLE STAFF TIME, or the amount specified in ADMINISTRATIVE RULE BY THE APPROPRIATE BOARD, or the department where there is no board.
What this means operationally
Florida's ceiling is actual cost, and unusually it names REASONABLE STAFF TIME as a recoverable component, which most cost-based regimes exclude. The provision also anticipates the requester bringing their own scanner: making records available for digital scanning is priced on the same basis, so a practice cannot levy a higher charge for supervising an on-site scan than for copying. Note the alternative limb — a board may set a figure by rule, and where it has, that figure governs rather than the actual-cost calculation.
Applies when
- A practitioner or records owner furnishes copies or makes records available for digital scanning
Custody on closure or transfer
Notwithstanding § 456.058, RECORDS OWNERS SHALL PLACE AN ADVERTISEMENT IN THE LOCAL NEWSPAPER OR NOTIFY PATIENTS, IN WRITING, when they are TERMINATING PRACTICE, RETIRING, OR RELOCATING, and no longer available to patients, AND OFFER PATIENTS THE OPPORTUNITY TO OBTAIN A COPY OF THEIR MEDICAL RECORD. Records owners SHALL ALSO NOTIFY THE APPROPRIATE BOARD OFFICE when they are terminating practice, retiring or relocating, SPECIFYING WHO THE NEW RECORDS OWNER IS AND WHERE MEDICAL RECORDS CAN BE FOUND.
What this means operationally
Two notices, to two different audiences, and both are mandatory. The patient notice may be given either by newspaper advertisement or in writing — the choice is the practice's, which makes the newspaper route available where contact details are stale. The board notice has no alternative form and must name the NEW RECORDS OWNER and the LOCATION of the records, so the custody question has to be settled before the notice can be filed. RELOCATING triggers both duties, which surprises practices that assume only closure counts; a move that leaves patients unable to reach the practitioner is treated the same as retirement.
Applies when
- A records owner terminates practice, retires, or relocates and is no longer available to patients
Custody on closure or transfer
WHENEVER A RECORDS OWNER HAS TURNED RECORDS OVER TO A NEW RECORDS OWNER, THE NEW RECORDS OWNER SHALL BE RESPONSIBLE FOR PROVIDING A COPY OF THE COMPLETE MEDICAL RECORD, UPON WRITTEN REQUEST, of the patient or the patient's legal representative.
What this means operationally
The access duty follows the records rather than staying with the practitioner who created them, and it attaches to the COMPLETE record. For a practice acquiring another, this is an inherited obligation that arrives with the files and is not negotiable in the purchase agreement — the buyer answers patient requests for care it never delivered. The practical consequence is diligence: an acquirer should confirm the transferred set is complete and usable before closing, because an incomplete transfer becomes the acquirer's compliance problem on the first request.
Applies when
- Records have been turned over to a new records owner and a patient or legal representative makes a written request
How long the record must be kept
Each board created under chapters 457, 458, 459, 460, 461, 463, part I of 464, 465, 466, part I of 484, 486, 490 or 491, and the department under chapter 462, SHALL PROVIDE BY RULE for the DISPOSITION of the medical records or records of a psychological nature of practitioners which are IN EXISTENCE AT THE TIME THE PRACTITIONER DIES, TERMINATES PRACTICE, OR RELOCATES and is no longer available to patients. THE RULES SHALL PROVIDE THAT THE RECORDS BE RETAINED FOR AT LEAST 2 YEARS AFTER the practitioner's DEATH, TERMINATION OF PRACTICE, OR RELOCATION. In the case of the death of the practitioner, the rules shall provide for the DISPOSITION OF SUCH RECORDS BY THE ESTATE of the practitioner.
What this means operationally
This is the architecture that explains why Florida's retention periods differ by profession: the legislature set a two-year FLOOR and delegated the actual periods to each board, naming chiropractic at chapter 460, optometry at 463, dentistry at 466 and physical therapy at 486. Two consequences follow. The two years is a minimum that every board rule must clear, so a board period shorter than two years would be invalid rather than governing. And the clock here runs from the CLOSURE EVENT, not from last patient contact, which is a different trigger from the active-practice periods the boards set — a practice winding down is measuring from a different date than it was the week before.
Applies when
- A practitioner regulated under one of the named chapters dies, terminates practice, or relocates and is no longer available to patients
