What Are Florida HIPAA Laws? Records, Minors, and Breaches

Florida’s HIPAA laws are really two frameworks working together: the federal Health Insurance Portability and Accountability Act sets a national floor for medical privacy, and a group of Florida statutes push past that floor in several important areas. When the two conflict, the one that gives you more privacy or more control wins. In practice, that means Florida patients often have broader access to their own records, stronger protections for mental health and substance abuse information, and specific rights for minors who consent to their own care.

How Federal and Florida Rules Fit Together

HIPAA’s Privacy Rule created the baseline for protecting individually identifiable health information held by health plans, providers, and their business associates.¹ As a rule, federal HIPAA preempts conflicting state laws. The important exception: if a state law “relates to the privacy of individually identifiable health information and is more stringent” than the corresponding HIPAA rule, the state law controls.²

A state law counts as more stringent when it gives you greater access to your records, further restricts disclosure, or creates a right HIPAA doesn’t. Florida uses that authority in several places. If a Florida statute ever tried to permit a disclosure HIPAA forbids, the federal rule would block it. Providers in Florida must satisfy whichever standard is more protective in the situation in front of them.

Getting Copies of Your Medical Records

Florida gives you a direct right to obtain copies of your records. Under Section 456.057, any licensed healthcare practitioner who has examined or treated you must furnish copies of all reports and records, including X-rays and insurance information, when you or your legal representative asks. The statute requires the provider to act “in a timely manner, without delays for legal review.”³ A provider cannot force you to pay an outstanding medical bill before releasing your records.

Hospitals and ambulatory surgical centers are governed by a separate statute. Section 395.3025 requires licensed facilities to furnish a true and correct copy of all patient records upon written request after discharge. Facilities may charge up to $1 per page, plus up to $1 per year of records searched, plus actual postage. If you need the copies to continue receiving medical care, though, the facility cannot charge you anything.⁴

For records held by an individual practitioner rather than a hospital, the Florida Board of Medicine caps copying costs at $1 per page for the first 25 pages and $0.25 per page after that.⁵

One category works differently. If you request psychiatric, psychological, or psychotherapeutic records, the practitioner can offer a summary report of your examination and treatment instead of the full chart. But if you want complete copies sent directly to another treating psychiatrist, the practitioner has to comply with that written request.³

Correcting Records and Seeing Who Received Them

Two federal rights are easy to overlook. If you spot an error in your file, you can ask the provider to amend it. The provider has 60 days to act, with one possible 30-day extension if they explain the delay in writing. A provider may deny the amendment if the record is accurate and complete, or if someone else created the information. If denied, you can file a written statement of disagreement that becomes part of the record.⁶

You can also request an accounting of disclosures covering the prior six years. The log lists times your provider shared your protected health information with third parties, though it excludes routine disclosures for treatment, payment, and healthcare operations, along with anything you specifically authorized.⁷ If you suspect improper sharing, this accounting is a useful first step before filing a formal complaint.

Mental Health Records

Florida treats mental health records with an extra layer of confidentiality beyond HIPAA. Under Section 394.4615, a clinical record kept for any patient receiving mental health services is confidential and exempt from Florida’s public records laws. That protection survives an unauthorized release: if someone leaks your mental health records without permission, the records do not lose their confidential status just because they got out.⁸

Release generally requires the express and informed consent of the patient, the patient’s guardian or guardian advocate, or, if the patient has died, the personal representative or next of kin. Without consent, release is limited to narrow situations: your own attorney needs the records for representation, a court orders disclosure after weighing the need against potential harm, or a provider determines the patient has communicated a specific threat of serious bodily harm to an identifiable person.⁸ Hospital records kept at facilities whose primary function is psychiatric care are carved out from the general hospital records statute and governed by these mental health confidentiality rules instead.⁴

Substance Abuse Records

Substance abuse treatment records carry the strongest confidentiality protections in healthcare because two frameworks apply at once. Florida Section 397.501 makes these records confidential and exempt from public records requirements. Disclosure without your written consent is limited to a short list: medical emergencies, provider staff who need the information to deliver care, government audits that don’t identify individual patients, and court orders where a judge finds the public interest outweighs the potential harm.⁹

Federal regulation 42 CFR Part 2 adds a parallel layer.¹⁰ Historically Part 2 required a separate, specific authorization before substance use disorder records could be shared, even if you had already signed a general medical records release. A final rule published in early 2024 brought Part 2 into closer alignment with HIPAA while preserving key extra protections: substance abuse records still cannot be used against you in civil, criminal, administrative, or legislative proceedings without your consent or a court order.

When Minors Control Their Own Records

Florida generally requires parental consent for a minor’s medical treatment. Several exceptions let a minor consent independently, and when a minor can legally consent to treatment, the minor controls the disclosure of those records.

Sexually Transmitted Disease Treatment

Any minor, regardless of age, can consent to examination and treatment for a sexually transmissible disease without parental involvement. The consultation, examination, and treatment are confidential, and the provider cannot reveal them even indirectly, for example by sending a bill to a parent.¹¹

Outpatient Mental Health Crisis Services

A minor 13 or older experiencing an emotional crisis can request and consent to outpatient mental health services from a licensed mental health professional, including diagnostic evaluation, individual psychotherapy, group therapy, and counseling. These services do not cover medication or other somatic treatments, and they are limited to two visits per week before parental consent is needed for further care.¹² Parents are not financially responsible for these sessions unless they participate in them.

Substance Abuse Treatment

Because a minor has the legal capacity to voluntarily seek substance abuse treatment, only the minor can give written consent to disclose those records. This applies even to sharing identifying information with a parent for insurance reimbursement.⁹ When parental consent is required for the minor to enter treatment in the first place, both the minor and the parent must agree to any records disclosure.

Pregnancy, Marriage, and Emancipation

An unwed pregnant minor can consent to medical and surgical care related to her pregnancy, and an unwed minor mother can consent to medical care for her child, with the same legal effect as if she were an adult.¹³ Married and legally emancipated minors also have full capacity to consent to their own medical treatment.

Breach Notification Deadlines

The Florida Information Protection Act (FIPA) sets a tighter breach notification timeline than federal HIPAA. Under FIPA, an entity that experiences a security breach involving personal information—including medical history, diagnoses, or health insurance data—must notify affected individuals within 30 days of discovering the breach, with a possible 15-day extension for good cause shown in writing.¹⁴ The federal HIPAA breach notification rule gives covered entities up to 60 calendar days.¹⁵

FIPA targets late notification with escalating civil penalties: $1,000 per day for the first 30 days, then $50,000 for each subsequent 30-day period, capped at $500,000 per breach. Violations are also treated as unfair or deceptive trade practices, which gives the Attorney General additional enforcement tools.¹⁴

How to File a Complaint

You have both federal and state options, and they cover different situations.

For a HIPAA violation, file with the U.S. Department of Health and Human Services Office for Civil Rights (OCR), which investigates covered entities and their business associates. Complaints can be filed electronically through the OCR Complaint Portal.¹⁶

For a Florida-licensed practitioner’s handling of your records, the state route is more direct. The Florida Department of Health can bring disciplinary action against any practitioner who violates patient record requirements. Penalties include license suspension or permanent revocation, restriction of practice, a reprimand, probation, and administrative fines of up to $10,000 per offense.¹⁷ For data breaches involving personal health information, the Attorney General enforces FIPA’s notification requirements. If the same incident implicates both state and federal rules, you can pursue both channels at the same time.

1
U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule
2
eCFR. 45 CFR 160.203 – General Rule and Exceptions
3
Justia Law. Florida Code 456.057 – Ownership and Control of Patient Records; Report or Copies of Records to Be Furnished; Disclosure of Information
4
FindLaw. Florida Code 395.3025 – Patient and Personnel Records
5
Legal Information Institute. Florida Administrative Code R. 64B8-10.003 – Costs of Reproducing Medical Records
6
eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
7
eCFR. 45 CFR 164.528 – Accounting of Disclosures of Protected Health Information
8
Florida Senate. Florida Code 394.4615 – Clinical Records; Confidentiality
9
FindLaw. Florida Code 397.501 – Rights of Individuals
10
eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
11
The Florida Legislature. Florida Code 384.30 – Minors Consent to Treatment
12
Florida Senate. Florida Code 394.4784 – Minors; Access to Outpatient Crisis Intervention Services and Treatment
13
Florida Senate. Florida Code 743.065 – Unwed Pregnant Minor or Minor Mother; Consent to Medical Services for Minor or Minors Child Valid
14
Florida Senate. Florida Code 501.171 – Security of Confidential Personal Information
15
eCFR. 45 CFR 164.404 – Notification to Individuals
16
U.S. Department of Health and Human Services. Filing a Health Information Privacy Complaint
17
The Florida Legislature. Florida Code 456.072 – Grounds for Discipline; Penalties; Enforcement