Florida has a new law as of July 1, 2023 relating to the storage of certain health records. The newly enacted Florida Statutes section 408.051 creates the “Florida Electronic Health Records Exchange Act.” The Act states in part that in addition to the Health Insurance Portability and Accountability Act (HIPAA) requirements that may apply to a health care practitioner/entity, if a covered health care provider utilizes a “certified electronic health record technology,” the health care provider must ensure that all applicable patient information stored in an offsite physical or virtual environment (including through third parties) is physically maintained in the continental U.S. or its territories or Canada.

Additionally, the Act defines “certified electronic health record technology” to mean a qualified electronic health record that is certified pursuant to s. 3001(c)(5) of the Public Health Service Act as meeting standards adopted under s. 3004 of such act which are applicable to the type of record involved, such as an ambulatory electronic health record for office-based physicians or an inpatient hospital electronic health record for hospitals. This generally refers to systems that qualified for Meaningful Use dollars and the systems that followed that build.

Furthermore, the Act explains that a “Health Care Provider” means any entity/person regulated by the Florida Agency for Health Care Administration (AHCA). This includes:

1. Laboratories authorized to perform testing under the Drug-Free Workplace Act, as provided under ss. 112.0455 and 440.102.
2. Birth centers, as provided under Chapter 383.
3. Abortion clinics, as provided under Chapter 390.
4. Crisis stabilization units, as provided under parts I and IV of Chapter 394.
5. Short-term residential treatment facilities, as provided under parts I and IV of Chapter 394.
6. Residential treatment facilities, as provided under part IV of Chapter 394.
7. Residential treatment centers for children and adolescents, as provided under part IV of Chapter 394.
8. Hospitals, as provided under part I of Chapter 395.
9. Ambulatory surgical centers, as provided under part I of Chapter 395.
10. Nursing homes, as provided under part II of Chapter 400.
11. Assisted living facilities, as provided under part I of Chapter 429.
12. Home health agencies, as provided under part III of Chapter 400.
13. Nurse registries, as provided under part III of Chapter 400.
14. Companion services or homemaker services providers, as provided under part III of Chapter 400.
15. Adult day care centers, as provided under part III of Chapter 429.
16. Hospices, as provided under part IV of Chapter 400.
17. Adult family-care homes, as provided under part II of Chapter 429.
18. Homes for special services, as provided under part V of Chapter 400.
19. Transitional living facilities, as provided under part XI of Chapter 400.
20. Prescribed pediatric extended care centers, as provided under part VI of Chapter 400.
21. Home medical equipment providers, as provided under part VII of Chapter 400.
22. Intermediate care facilities for persons with developmental disabilities, as provided under part VIII of Chapter 400.
23. Health care services pools, as provided under part IX of Chapter 400.
24. Health care clinics, as provided under part X of Chapter 400, and
25. Organ, tissue, and eye procurement organizations, as provided under part V of Chapter 765.

The definition also includes: any person licensed under Chapter 457; Chapter 458; Chapter 459; Chapter 460; Chapter 461; Chapter 462; Chapter 463; Chapter 464; Chapter 465; Chapter 466; Chapter 467; part I, part II, part III, part V, part X, part XIII, or part XIV of Chapter 468; Chapter 478; Chapter 480; part I, part II, or part III of Chapter 483; Chapter 484; Chapter 486; Chapter 490; Chapter 491; radiology personnel certified under Chapter 468 part IV; a home health aide; a mental health service provider as defined in 394.455 and associated staff; a continuing care facility under 651; and a pharmacy.

Finally, for licensees of AHCA, there are new licensure requirements obligating an applicant to provide an affidavit that the licensee is in compliance with the above requirement.

Health care providers need to discuss the new law with IT professionals and experienced health care counsel. If the law is applicable, it is advisable that a health care provider obtain a written compliance certification from its IT vendors who store medical and patient information.