Protecting Patient Privacy: Florida’s New Law Bans Offshore Storage of Health Records

On July 1, 2023, Florida SB 264 went into effect, marking a significant step in safeguarding the privacy and security of patient health records. Florida SB 264 amended the Florida Electronic Health Records Exchange Act, which prohibited the offshore storage of health records, addressed concerns about data breaches, and ensured that Florida patients’ sensitive information remains subject to greater protections. In this blog, we will delve into the details of this new law and its implications for health care providers, patients, and the broader health care industry.

Understanding the Need for Data Security

In an increasingly digital world, health care records have transitioned from paper files to electronic health records (EHRs). While this shift has improved the efficiency of health care delivery, it has also introduced new challenges related to data security and privacy. The potential risks associated with storing health records offshore, including data breaches and unauthorized access, have become a growing concern.

Florida’s Response: A Ban on Offshore Storage

Recognizing the urgency of addressing these concerns, Florida passed a groundbreaking law that bans offshore storage of health records. The primary objective of this law is to protect patient privacy and ensure that sensitive medical information remains safe.

The law mandates that health care providers that utilize certified electronic health record technology must ensure that all patient information stored in an offsite physical or virtual environment, including through a third party or subcontracted computing facility, or an entity providing cloud computing services, is physically maintained in the continental United States or its territories, or in Canada. This requirement ensures that patient data is subject to greater data protection laws.

Benefits of the Law

The Florida law banning offshore storage of health records offers several important benefits:

Enhanced Data Security: By keeping patient records within the United States, its territories, or Canada, health care providers can better control access and protect against data breaches.

Stronger Privacy Protections: Patients can have greater confidence that their health information is subject to Florida’s stringent data privacy regulations.

Legal Clarity: The law provides clear guidelines for health care providers and organizations, reducing ambiguity and ensuring compliance.

Patient Empowerment: Patients have the opportunity to make informed decisions about where their health records are stored, putting them in greater control of their personal information.

Implications for Healthcare Providers and Patients

Healthcare providers and organizations operating in Florida must now take proactive measures to ensure compliance with the new law. This may involve revising data storage and management practices, updating consent forms, and reviewing contracts with third-party service providers. Patients will also benefit from increased transparency regarding the storage of their health records.

Additionally, Florida licensees will be required to attest upon initial licensure and upon any renewals that they will comply with the new requirements. Licensees will also be required to ensure that no individual or entity with a controlling interest in the licensee has an interest in an entity that has a business relationship with certain foreign countries.

Among other impacted provider types, this new law applies to hospitals, clinics, ambulatory surgical centers, home health agencies, hospices, nursing homes, labs, pharmacies, and individual practitioners including physicians, physician assistants, advanced practice registered nurses, registered nurses, pharmacists, dentists, chiropractors, podiatrists, certain behavioral health providers, physical therapists, occupational therapists, speech-language pathologists, audiologists, and respiratory therapists.

Florida’s new law prohibiting offshore storage of health records represents a significant step in protecting patient privacy and data security. It ensures that sensitive medical information remains safe and enhances the trust and confidence of patients.