FIPA Compliance for Florida Healthcare

Florida healthcare providers must follow two compliance frameworks. Federal HIPAA sets national standards, and the Florida Information Protection Act (FIPA) adds stricter breach notice rules. FIPA covers data about people in Florida, so it can reach organizations based outside Florida too.

Whether your practice operates in Miami, Tampa, Orlando, Jacksonville, or smaller communities across the state, both frameworks apply. This guide explains both layers, where they diverge, and what your practice must do to satisfy both.

Florida Quick Take

HIPAA is the base rule. Florida adds more steps.

• If a breach hits 500 or more Florida residents, tell the Florida Attorney General within 30 days.
• Tell patients as soon as you can (FIPA sets a 30-day outer limit).
• Keep records at least as long as your licensing board requires.
• Train staff.
• Sign BAAs.
• Use MFA.
• Keep proof.
• Review the plan each year.

These simple steps help your team stay ready.

Internal links: What Is HIPAA? · Complete HIPAA Compliance Guide 2026 · HIPAA Breach Notification Rule

Federal HIPAA in Florida: The Basics

HIPAA applies to covered entities (health plans, clearinghouses, and providers that bill electronically) and their business associates (vendors that handle patient data for them) across the country. This includes Florida healthcare providers that send health information electronically, such as insurance claims. The three core rules are Privacy, Security, and Breach Notification. They set the minimum compliance standards for all covered entities. Florida state law then adds additional duties that your practice must also satisfy.

Key federal rules every Florida provider must meet:

• Conduct, document, and keep current a security risk assessment under 45 CFR §164.308(a)(1)
• Implement admin, physical, and technical safeguards for all ePHI
• Execute signed Business Associate Agreements (BAAs) with all vendors that handle PHI (protected health information)
• Provide individual breach notices without unreasonable delay and within 60 days of discovery (45 CFR §164.404)
• Notify HHS within 60 days for breaches affecting 500 or more people

Florida State Privacy Laws Healthcare Providers Must Know

This guide covers four Florida laws that add to HIPAA rules. Each statute creates its own rules, even if you follow HIPAA.

Florida Information Protection Act (FIPA): §501.171

FIPA is Florida's main data breach law. It applies to any organization that collects, stores, or uses personal information from Florida residents. When linked to a person's name, that term includes medical history, health insurance numbers, and biometric data. Key FIPA duties for healthcare providers:

• 30-day breach notice to Florida AG: If a breach affects 500 or more Florida residents, the organization must notify the Florida Attorney General within 30 days. HIPAA gives up to 60 days, so the Florida deadline is stricter.
• Individual notice: Tell affected Florida residents as soon as possible. The outer limit is 30 days after you determine a breach happened. HIPAA covered entities have a shortcut: notify patients under HIPAA's rules and send the AG a copy. That counts as meeting this rule.
• AG notice content: Tell the AG what happened, how many people were affected, what help you offered, and who the AG can contact. Include a copy of the notice sent to patients.
• Credit bureaus: If more than 1,000 people are affected at one time, you must also notify the national credit reporting agencies.
• Vendors: A vendor that holds the data for you must tell you within 10 days after it determines a breach happened.
• Civil penalties: Late notice can cost $1,000 a day for the first 30 days. After that, it can cost $50,000 for each 30-day period, up to $500,000 per breach. The Florida AG enforces these.

Florida Patient Records Law (§456.057)

Florida's patient records law (§456.057) and the board rules under it set rules for record retention, patient access, and record release. Key points:

• Retention: Florida's rule for physicians (Rule 64B8-10.002) requires keeping records for at least 5 years from the last patient contact. Other license types follow their own board's rule. This is separate from HIPAA's 6-year rule for keeping HIPAA policies and paperwork.
• Written authorization required: In most cases, you need written patient approval to release records to others. You may share with other providers involved in the patient's care. The law also lists a few exceptions, such as a court subpoena with proper notice to the patient. These limits can be stricter than HIPAA, which allows sharing for treatment, payment, and operations.
• Copy fees regulated: Florida limits what providers may charge patients for copies. For physicians, Rule 64B8-10.003 caps the fee at $1.00 per page for the first 25 pages. After that, the cap is 25 cents per page. X-rays and other special records may be charged at actual cost.
• Patient access timeframe: Florida law says to provide copies in a timely manner. You cannot hold them up for legal review. HIPAA sets an outer limit of 30 days after the request, with one 30-day extension allowed.

HIV/AIDS Privacy Law: §381.004

Florida's HIV/AIDS privacy statute gives HIV test results extra protection. Key rules:

• In a health care setting, tell the patient (out loud or in writing) that an HIV test is planned. Also tell them they can say no. Outside a health care setting, get the person's informed consent first, meaning they agree after the test is explained.
• HIV test results may be shared only with the patient, treating providers who are directly tied in care, and certain parties listed in the law. In limited cases, this includes the Department of Health.
• Wrongful sharing of HIV test results is a first-degree misdemeanor under Florida law. Sharing someone's HIV status maliciously or for money is a third-degree felony.
• These protections apply in addition to HIPAA Privacy Rule rules. Standard HIPAA treatment, payment, and operations exceptions do not override them.

Mental Health Records: Florida Baker Act Provisions

The Florida Mental Health Act (commonly called the Baker Act, §394.451 et seq.) gives extra privacy protection to people who receive mental health evaluation or treatment. Baker Act records:

• May be shared only with patient consent or under a specific legal exception, such as a court order or emergency.
• Follow Florida's stricter sharing rules, not only HIPAA's usual treatment and operations permissions.
• Providers should train staff on the difference between Baker Act privacy rules and standard HIPAA permissions.

Florida Breach Notice Rules

Florida providers that face a data breach must manage two notice tracks. Each one has a different deadline. If you miss the shorter FIPA deadline, you can still violate Florida law even if you meet HIPAA's timeline.

FIPA: 30-Day AG Notice for Large Breaches

If a breach affects 500 or more Florida residents, FIPA requires the following actions:

1. Day 0: Breach discovered
2. As soon as possible: Begin forensic investigation and risk assessment
3. Within 30 days of determining the breach: Send written notice to the Florida Attorney General's office. Florida law allows 15 more days if you give the AG a written reason (good cause) for the delay within those 30 days.
4. Within the same 30 days: Notify all affected Florida residents (or follow HIPAA's patient notice rules and send the AG a copy)

For breaches affecting fewer than 500 Florida residents, AG notice is not required. But you must still notify individuals no later than 30 days after you determine a breach happened.

Florida AG Notice Rules

The rules for the written AG notice are in Fla. Stat. §501.171. It must include:

• A short summary of what happened
• The number of Florida residents affected
• Any free services offered to affected individuals (such as credit monitoring)
• A copy of the notice sent to individuals, or an explanation of the other steps you took to notify them
• The name and contact details of a person at your organization who can answer questions

The AG may also ask for more, such as a police report, your policies, or forensic reports.

HHS Notice Under HIPAA: Aligning the Timelines

For a breach that affects 500 or more Florida residents, providers must manage several deadlines at once:

• FIPA AG notice: 30 days from breach determination. This is the strict deadline.
• HIPAA notice to people: 60 days from discovery.
• HIPAA notice to HHS: 60 days from discovery when 500 or more people are affected.
• HIPAA media notice: 60 days from discovery when more than 500 people in the state are affected.

Practical guidance: Start the HIPAA four-factor breach risk assessment as soon as you find a breach. Start FIPA notice work at the same time. Do not wait for the HIPAA assessment to finish, because the FIPA clock may already be running.

HIPAA Compliance for Florida Telehealth Providers

Florida's telehealth law (§456.47, passed in 2019) sets the rules for care given by telehealth. It includes registration for out-of-state providers. Telehealth programs must meet these compliance rules:

• Platform security: Any telehealth platform that sends or receives ePHI for Florida patients must meet HIPAA technical safeguard rules. Encryption in transit (while data moves) and at rest (while data is stored) is "addressable" under current HIPAA rules. That means you must use it unless you write down why it is not reasonable for your practice. In that case, use an equal safeguard instead when that is reasonable
• BAAs with telehealth vendors: A telehealth platform that handles patient data for you is a business associate. A signed BAA should be in place before patient sessions begin
• FIPA applicability: Telehealth records can include health information that FIPA protects when linked to a patient's name. A cyber incident involving session data may be reportable under HIPAA and FIPA
• Out-of-state providers: Out-of-state providers may fall under FIPA when they treat Florida residents by telehealth

HIPAA Penalties in Florida (Current Rates)

Florida healthcare providers face penalties from two enforcement bodies:

Federal OCR Enforcement

HHS Office for Civil Rights enforces HIPAA with four penalty tiers. The amounts in force in 2026 were last adjusted for inflation in 2025. Penalties for the same kind of violation are also capped at $2,190,294 per calendar year:

• Tier 1 (Lack of awareness): $145 to $73,011 per violation
• Tier 2 (Reasonable cause): $1,461 to $73,011 per violation
• Tier 3 (Willful neglect, corrected): $14,602 to $73,011 per violation
• Tier 4 (Willful neglect, not corrected): $73,011 to $2,190,294 per violation

Florida AG Enforcement (FIPA)

• Florida law treats a FIPA violation as an unfair or deceptive trade practice
• Late notice: $1,000 a day for the first 30 days, then $50,000 for each 30-day period after that, up to 180 days
• If notice is more than 180 days late, penalties of up to $500,000 per breach
• Patients cannot sue you directly under FIPA

Florida HIPAA Compliance Checklist

Use this checklist to verify your organization meets both federal HIPAA and Florida state rules:

• HIPAA security risk assessment completed, kept current, and results documented
• Signed BAAs in place with vendors that handle PHI, including telehealth, EHR, and cloud vendors
• Breach response plan updated for FIPA's 30-day patient and AG notice deadlines
• Medical records retention schedule meets your Florida board's rule (5 years from last contact for physicians)
• Staff trained on HIV/AIDS privacy (§381.004) and Baker Act record restrictions
• Telehealth platforms verified for HIPAA compliance, with signed BAAs
• FIPA notice-to-AG procedure documented. A named person owns it
• MFA and encryption active for all systems that contain ePHI
• Staff training completed and documented, with refreshers when rules or systems change
• Notice of Privacy Practices current and given to all new patients

Frequently Asked Questions

What is FIPA compliance?

FIPA compliance means meeting the requirements of Florida's Information Protection Act, Section 501.171 of the Florida Statutes. FIPA requires businesses that handle personal information of Florida residents to implement reasonable security measures, notify affected individuals no later than 30 days after determining a breach happened. Breaches affecting 500 or more Florida residents must also be reported to the Florida Attorney General within the same 30 days. Healthcare organizations in Florida must comply with both FIPA and HIPAA. A HIPAA covered entity can notify patients under HIPAA's rules and send the AG a copy. Florida treats that as meeting FIPA's patient notice rule.

Does Florida have its own health privacy law beyond HIPAA?

Yes. Florida's Information Protection Act (FIPA, §501.171) adds breach notice rules. Its breach notices have a 30-day deadline, which is stricter than HIPAA's 60-day rule. Florida also has a patient records law (§456.057) covering records access, sharing, and copy fees, and separate privacy laws for HIV/AIDS testing results (§381.004) and mental health records under the Baker Act (§394.451).

How quickly must Florida healthcare providers notify patients of a breach?

HIPAA requires individual notice within 60 calendar days of breach discovery. Under Florida's FIPA, you must tell affected people no later than 30 days after you determine a breach happened. If 500 or more Florida residents are affected, you must also tell the Florida Attorney General within those same 30 days. A HIPAA covered entity (a provider or health plan that HIPAA covers) has a shortcut: it can notify patients under HIPAA's rules and send the Attorney General a copy. Florida treats that as meeting FIPA's patient notice rule. So for the AG notice, you cannot wait the full 60 days that HIPAA allows.

What are Florida's medical records retention rules?

Florida's rule for physicians (Rule 64B8-10.002) requires keeping medical records for at least 5 years after the last patient contact. Other license types follow their own board's rule, so check yours. This applies to both paper and electronic records. HIPAA separately requires keeping HIPAA-related policies and documentation for 6 years from creation or the date last in effect, whichever is later.

Are Florida telehealth providers subject to both HIPAA and FIPA?

Yes. Florida-licensed providers who offer telehealth to Florida residents must follow HIPAA for ePHI (electronic protected health information). They must also follow FIPA for breach notices. Florida's telehealth law (§456.47, passed in 2019) does not create HIPAA exemptions: all standard HIPAA safeguards apply. Out-of-state providers treating Florida residents by telehealth may also fall under FIPA's breach notice rules.

Who enforces healthcare privacy in Florida?

HHS Office for Civil Rights (OCR) enforces federal HIPAA. The Florida Attorney General's office enforces FIPA. Florida's licensing boards and the Department of Health mainly enforce the patient records law (§456.057). They discipline practitioners, including for record-keeping duties under board rules. Federal and state enforcers can act separately. Settling with OCR does not by itself end a Florida FIPA case.

Florida healthcare providers face a dual compliance burden: federal HIPAA sets the floor, and Florida state law (particularly FIPA's 30-day breach notice timeline) raises the bar in key areas. The most common failure point is not HIPAA itself, but the FIPA obligation that runs on a shorter clock. Build your breach response plan around the 30-day FIPA deadline, and you will also be inside HIPAA's 60-day limit. One Guy Consulting helps Florida healthcare organizations implement both layers correctly. Book a consultation today.

Sources

• HHS.gov: HIPAA for Professionals
• Florida Statutes §501.171: Security of Confidential Personal Information (FIPA)
• Florida Statutes §456.057: Medical Records
• Florida Statutes §381.004: HIV/AIDS Privacy
• Florida Senate: Fla. Stat. §501.171 (FIPA text)
• HHS: HIPAA Breach Notification Rule

---

Related Reading: State Privacy Laws vs. Federal HIPAA Rules · Illinois HIPAA Compliance Rules · Texas HIPAA Compliance Rules · California HIPAA Compliance Rules · New York HIPAA Compliance Rules

Need help building a Florida-compliant HIPAA program? One Guy Consulting provides practical HIPAA guidance for covered entities and business associates across Florida. Book a consultation · HIPAA consulting services

HIPAA compliance in other states

State law stacks on top of HIPAA differently in every state. These guides cover the statutes that move the baseline where you operate.

• HIPAA Compliance in Arizona
• HIPAA Compliance in Pennsylvania
• HIPAA Compliance in Tennessee
• HIPAA Compliance in Virginia
• HIPAA Compliance in Washington
• HIPAA Compliance in Colorado