Law / United States / 
Florida
Patient and personnel records: confidentiality of a licensed facility's patient records
In force.
A sensitive categories rule binding public and private bodies.
- Enforcement body
- Agency for Health Care Administration
- Obligation class
- Consent, Data subject rights, Prohibition
- Audit expectation
- none
As of .
What it requires
- If you are a facility licensed under chapter 395, do not disclose patient records without the consent of the patient or the patient's legal representative, except to the persons and for the purposes the section lists.
- Do not use patient information for solicitation or for marketing the sale of goods or services without a specific written release or authorization.
- When you provide the content of a patient treatment record under the section, make clear that the recipient, if other than the patient or the patient's representative, may use it only for the purpose provided and may not further disclose it without the patient's express written consent.
- After discharge, on written request, furnish a true and correct copy of the patient's records, including X rays and insurance information, to the patient or the patient's representative, and let them examine the original records on reasonable terms.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 395.1065(2)(a) lets the agency impose an administrative fine of up to $1,000 per violation, per day, for the violation of any provision of part I of chapter 395 (sections 395.001 through 395.3042), part II of chapter 408 or applicable rules, and each day of violation is a separate violation.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Day
- Per violation amount
- 1,000
Over one month of continuous breach, USD 30,440.
What this law does
Patient records of a licensed facility are confidential and must not be disclosed without the consent of the patient or the patient's legal representative, except to the persons and for the purposes the subsection lists.
Under section 395.3025, a recipient of the content of a patient treatment record other than the patient or the patient's representative may use it only for the purpose provided and may not further disclose it unless the patient expressly consents in writing, and a general authorization for the release of medical information is not sufficient.
Under section 395.3025, absent a specific written release or authorization, any use of patient information for solicitation or marketing the sale of goods or services is prohibited.
A licensed facility must, on written request and after discharge of the patient, furnish a true and correct copy of all patient records, including X rays and insurance information, to the patient or the patient's guardian, representative, next of kin or a person the patient designates in writing, on payment of the charge the section sets.
Section 395.3025 does not apply to records of a facility whose primary function is psychiatric care, to records of treatment for a mental or emotional condition governed by section 394.4615, or to records of substance abuse impaired persons governed by section 397.501. Section 395.3025 is in part I of chapter 395, which runs from section 395.001 through section 395.3042.
Under section 395.1065, the agency may impose an administrative fine, not to exceed $1,000 per violation, per day, for the violation of any provision of this part, part II of chapter 408, or applicable rules.
When LexLint raises it
When your app profile says your app handles health records.