Florida's breach law is stricter than HIPAA on timing. Practices must notify affected Floridians within 30 days, report larger breaches to the state, and keep patient records stored inside the United States, its territories or Canada.
AT A GLANCE
| Laws | Florida Information Protection Act, Fla. Stat. § 501.171; offshore storage ban for electronic health records, Fla. Stat. § 408.051 (as amended in 2023) |
|---|---|
| Data covered | Includes medical history, condition, treatment or diagnosis, and health insurance policy or subscriber numbers |
| Notice to individuals | As fast as practicable, and no later than 30 days after the breach is determined or reasonably believed to have occurred |
| Department of Legal Affairs | Required for breaches affecting 500 or more Floridians, within 30 days (up to 15 more days with good cause) |
| Vendors | Third-party agents must notify the practice within 10 days |
| HIPAA entities | Notice given under your federal regulator's rules counts as compliance, and sending the state a timely copy satisfies the state notice requirement |
| Penalties | $1,000 per day for the first 30 days, then $50,000 per 30-day period up to 180 days, with a $500,000 maximum per breach. No private right of action |
02
HOW WE HELP
HIPAA risk assessment
The documented risk analysis HIPAA requires, the foundation for every state law too.
Learn more →Incident response planning
Know who to notify, and by when, before a breach happens.
Learn more →HIPAA compliance program
Policies and procedures that cover both HIPAA and your state requirements.
Learn more →FAQ
No later than 30 days after determining a breach occurred, unless law enforcement requests a delay in writing.
If 500 or more Floridians are affected, notify the Department of Legal Affairs within 30 days.
Florida requires electronic patient records, including backups, to be stored in the continental US, US territories or Canada.
Sources: Fla. Stat. 501.171 · Polsinelli: Florida offshore storage ban · Constangy: Florida summary. This page is general information about the law as of November 2026, not legal advice. Statutes change, so confirm current requirements with your attorney.
Take the free HIPAA risk assessment, or talk to an analyst about Florida rules.
