Florida Statute 381.004: HIV Testing Consent, Disclosure, and Reporting

Florida Statute 381.004 governs how HIV tests are ordered in Florida, who is allowed to see the results, and what happens when someone breaks the confidentiality rules. In healthcare facilities the law uses an opt-out approach: your provider must tell you a test is planned and that you can refuse. Outside healthcare settings, active informed consent is required. Results are confidential by statute, may only be shared with a specific list of people, and unauthorized disclosure is a crime.¹

Consent at a Hospital, Clinic, or Doctor’s Office

In a healthcare setting, the provider must inform you, verbally or in writing, that an HIV test is planned and that you have the right to decline. If you refuse, your refusal is noted in your medical record.¹

One point trips people up. If you already signed a general consent for medical care at the facility, you do not need to sign a separate HIV-specific consent. The general consent covers the test for as long as it remains in effect.¹

Before testing, the provider must also tell you two things: that a positive result will be reported to the county health department with information that identifies you, and that anonymous testing sites are available if you would rather your name not be attached.¹

Consent at Community and Outreach Testing Sites

Testing programs that are not part of a traditional medical facility follow a stricter rule. The provider must obtain your informed consent before ordering the test. The consent conversation has to explain your right to confidentiality under the statute, warn you that a positive result will be reported to the county health department, and tell you where anonymous testing is offered.¹

Your consent does not have to be in writing, but the provider must document in the record that the test was explained and that you consented. If you are under 18, not competent, or otherwise unable to make an informed decision, a legal guardian or authorized representative must consent for you.¹

When Your Consent Is Not Required

The statute lists specific situations where a test can proceed without going through the normal consent process. The list is narrower than most people assume.

A judge can order a test, but only after finding a compelling need that outweighs the privacy interest of the person being tested.²
A victim of any type of sexual battery may request that the defendant be tested. Results go only to the victim and the defendant.¹
People convicted of prostitution or procuring prostitution are subject to mandatory testing.
The Department of Corrections may test inmates before release through parole, gain time, or sentence expiration.¹
Licensed medical personnel can order a test without consent in a medical emergency when the result is needed for diagnosis or treatment and the patient cannot consent. The record must document why consent was not possible.¹
If a healthcare worker, paramedic, EMT, or medical student has a documented significant exposure to a patient’s blood or body fluids on the job, the patient can be tested. The exposed worker must also be tested or provide a recent negative result.²
Pregnant women are subject to mandatory HIV testing under Section 384.31, and may refuse in writing.
Testing may be performed as part of an autopsy or when processing donated human tissue, organs, or body parts.¹

An exception to consent is not an exception to confidentiality. Even when the test is ordered without your permission, the disclosure rules described below still apply to the result.

Who Is Allowed to See Your Results

Your identity as someone who has been tested for HIV, along with the result itself, is confidential and exempt from Florida public records law. Anyone who learns the result through the process in the statute is prohibited from sharing it, and cannot be forced to share it, except with people specifically named in the law.²

The authorized recipients are:

You or your legal representative.
Anyone you designate in writing. A general release of medical information is not enough on its own. You must have a prior written authorization specifically covering HIV results before a general release will include them.²
Staff at a health facility who participate in your care, handle your specimens, or have a documented need to know.
Providers consulting on your diagnosis or treatment, including licensed health professionals at state, county, or municipal detention facilities acting for those purposes.
The Department of Health, for disease reporting and infection control.
Organ and tissue procurement organizations when processing remains or donated tissue.
Facility review committees for program monitoring and evaluation.
Authorized epidemiological researchers, who may not further disclose identifying information.
A person granted access by court order, only after the court finds a compelling need that cannot be met any other way.²

Every lawful disclosure must be accompanied by a written notice that the information is confidential under state law and cannot be shared further without your specific written consent. A general authorization to release medical records is explicitly not sufficient to cover HIV results.² The written-notice requirement is easy for facilities to overlook. It is not optional.

Anonymous Testing Versus Confidential Testing

Confidentiality and anonymity are not the same thing. With confidential testing, your name is attached to your result and recorded in your medical file, and a positive result is reported to the county health department with information that identifies you. With anonymous testing, your name is never recorded at the test site, so the result cannot be tied back to you.

Every county health department in Florida must offer both anonymous and confidential HIV testing programs. Counseling at either type of site must include information about partner notification services and the confidentiality that comes with them.³ The Section 384.25 reporting requirement does not apply to anonymous testing programs.⁴

If keeping your name off the result entirely matters to you, anonymous testing through a county health department is the route. Providers must tell you this option exists before ordering a confidential test.

Penalties for Unauthorized Disclosure

The statute has real teeth. Florida law creates a tiered penalty structure for people who violate the confidentiality rules.

Any violation by a licensed provider or facility is grounds for disciplinary action under the applicable licensing chapter. Consequences depend on the licensing board and can include suspension or revocation.¹

Anyone who violates the confidentiality provisions commits a first-degree misdemeanor, which in Florida carries up to one year in jail and a fine of up to $1,000.¹

If someone who knew or should have known the nature of the information shares it maliciously or for monetary gain, the offense becomes a third-degree felony, punishable by up to five years in prison and a fine of up to $5,000.¹ The felony tier does not require intent to harm the person whose result was disclosed. “Maliciously” and “for monetary gain” are separate triggers. Selling someone’s HIV status to a tabloid or an employer would fall squarely into felony territory.

Mandatory Reporting by Labs and Providers

Separate from the confidentiality rules that protect you, Florida law requires laboratories, physicians, and anyone who diagnoses or treats a sexually transmissible disease to report positive HIV results to the Department of Health. The report must include enough information to identify you for epidemiological tracking. Reports are due within the timeframe set by department rule and no later than two weeks after a positive result.⁴

Providers who fail to report face fines of up to $500 per offense, and the Department of Health reports the violation to the provider’s licensing board.⁴ The reporting system must use a methodology developed by the CDC or an equivalent system to protect confidentiality. Anonymous testing programs are exempted from reporting.

How HIPAA Fits In

HIPAA sets a baseline for health information privacy nationwide, but when a state law is stricter, the state law controls. Florida’s HIV confidentiality rules are stricter than HIPAA in several ways: written confidentiality notice must accompany every disclosure, prior written authorization specifically covering HIV results is required before a general medical release can include them, and violations carry criminal penalties. Providers in Florida must follow the state standard, not just the federal one.

1
Online Sunshine. Florida Statutes 381.004 – HIV Testing
2
Florida Senate. Florida Statutes 381.004 – HIV Testing
3
Florida Senate. Florida Statutes 381.004 – HIV Testing
4
Florida Senate. Florida Statutes 384.25 – Reporting Required