Health record rights in Florida: what state law adds
In Florida, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a copy of your record faster than HIPAA requires, and free in some cases; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices must cover medical and health insurance information; and we found no law on AI in care. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
ch. 2023-201 took effect July 1, 2024. Consent for sensitive data, including health diagnosis, binds only controllers with over $1 billion revenue. Consent before sale of sensitive data binds smaller for-profit entities too.
Florida Digital Bill of Rights, privacy and data security: controller may not process sensitive data without consent. Fla. Stat. s. 501.71
In force · effective · read October 3, 2026 · source(leg.state.fl.us)
Process the sensitive data of a consumer without obtaining the consumer’s consent
Who it binds, in our words: Controllers as defined in s. 501.702, which include an entity that "Makes in excess of $1 billion in global gross annual revenues; and" meets further listed tests.
Florida Digital Bill of Rights, definitions (sensitive data, controller). Fla. Stat. s. 501.702
In force · effective · read October 3, 2026 · source(leg.state.fl.us)
Personal data revealing an individual’s racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status.
Who it binds, in our words: Makes in excess of $1 billion in global gross annual revenues; and
Requirements for sensitive data: consent before sale of sensitive data. Fla. Stat. s. 501.715(1)
In force · effective · read October 3, 2026 · source(leg.state.fl.us)
for the definition of a controller may not engage in the sale of personal data that is sensitive data without receiving prior consent from the consumer
Who it binds, in our words: A person who meets the requirements of s. 501.702(9)(a)1.-3. for the definition of a controller (no revenue threshold).
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
Yes, both. A deadline shorter than 30 days, and a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Beyond the federal floor: free hospital copy for continuing care, and 14 working days for current nursing home residents. Practitioners have only a timely standard. Per-page caps are recorded as facts only.
Deadline in the law: 14 days.
Free copy: Licensed facility (hospital): no charge when records are copied or searched for the purpose of continuing to receive medical care (s. 395.3025(1)).
Fee rule: Licensed facility: "may not exceed $1 per page"; nonpaper records up to $2; up to $1 per year of records requested (s. 395.3025(1)).
Fee rule: Practitioners: "no more than the actual cost of copying, including reasonable staff time, or the amount specified in administrative rule" (s. 456.057).
Fee rule: Physicians (Board of Medicine): $1.00 per page for the first 25 pages, 25 cents per page after (r. 64B8-10.003).
Fee rule: Nursing homes: "may not exceed $1 per page for the first 25 pages and 25 cents per page for each additional page" (s. 400.145).
Goes beyond the federal floor: yes.
Patient and personnel records; copies; examination (licensed facilities). Fla. Stat. s. 395.3025(1)
In force · effective · read October 3, 2026 · source(leg.state.fl.us)
However, a patient whose records are copied or searched for the purpose of continuing to receive medical care is not required to pay a charge for copying or for the search.
Who it binds, in our words: Any licensed facility (hospitals and other facilities licensed under ch. 395).
Nursing home resident records; deadline to furnish copies. Fla. Stat. s. 400.145(1)
In force · effective · read October 3, 2026 · source(leg.state.fl.us)
The facility shall provide the requested records within 14 working days after receipt of a request relating to a current resident or within 30 working days after receipt of a request relating to a former resident.
Who it binds, in our words: A nursing home facility, for a competent resident or the resident's authorized representative.
Ownership and control of patient records; copies to be furnished (practitioners). Fla. Stat. s. 456.057
In force · effective · read October 3, 2026 · source(leg.state.fl.us)
furnish, in a timely manner, without delays for legal review, copies of all reports and records relating to such examination or treatment, including X rays and insurance information.
Who it binds, in our words: Any health care practitioner licensed by the department or a board within the department.
Board of Medicine rule: Costs of Reproducing Medical Records. Fla. Admin. Code r. 64B8-10.003
(a) For the first 25 pages, the cost shall be $1.00 per page.
Who it binds, in our words: Any person licensed pursuant to chapter 458, F.S. (physicians).
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Statute sets no general HIE consent rule, so the value comes from the AHCA-linked Florida HIE policy. Its stricter rule for substance use records reflects federal 42 CFR Part 2, not state law.
Set by the published policy of the state-designated exchange; no state law sets the rule.
Designated exchange: Florida Health Information Exchange (AHCA program, operated by CRISP Shared Services).
Some sensitive records need your consent even where routine records do not.
Florida HIE, For Patients: right to opt out. Florida HIE patient opt-out policy (web page, modified 2026-08-13)
In force · effective · read October 3, 2026 · source(flhie.org, reached from ahca.myflorida.com)
Yes, patients can choose not to make their data available in the HIE. This action is called opting-out. If you opt-out of the HIE, none of your data will be shared via the HIE.
Who it binds, in our words: Clinical data shared through the Florida HIE; public health reporting and PDMP data continue after opt-out.
Florida Electronic Health Records Exchange Act. Fla. Stat. s. 408.051
In force · effective · read October 3, 2026 · source(leg.state.fl.us)
make available all admission, transfer, and discharge data to the agency’s Florida Health Information Exchange program for the purpose of supporting public health data registries and patient care coordination.
Who it binds, in our words: Hospitals and other listed entities that maintain certified electronic health record technology.
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No rule on confidentiality or disclosure of a person's reproductive health record found. s. 390.0112 makes monthly termination reports to the agency confidential and free of identifying information; these are agency reports, not the patient record.
Fla. Stat. 390.0112(3)
In force · effective · read October 3, 2026 · source(leg.state.fl.us)
Reports submitted pursuant to this section shall be confidential and exempt from the provisions of s. 119.07 (1) and shall not be revealed except upon the order of a court of competent jurisdiction in a civil or criminal proceeding.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
s. 394.4615 makes the clinical record confidential. Confidential status is kept unless waived by express and informed consent of the patient or a listed representative.
Clinical records; confidentiality (Baker Act). Fla. Stat. s. 394.4615
In force · effective · read October 3, 2026 · source(leg.state.fl.us)
A clinical record is confidential and exempt from the provisions of s. 119.07
Who it binds, in our words: Clinical records of patients under part I of chapter 394 (Florida Mental Health Act).
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
s. 381.004 limits disclosure of HIV test results and the identity of the person tested to listed exceptions. Malicious disclosure of HIV status is a third degree felony.
HIV testing; confidentiality of test results. Fla. Stat. s. 381.004(2)(e)
In force · effective · read October 3, 2026 · source(leg.state.fl.us)
No person who has obtained or has knowledge of a test result pursuant to this section may disclose or be compelled to disclose the identity of any person upon whom a test is performed, or the results of such a test in a manner which permits identification
Who it binds, in our words: Any person who has obtained or has knowledge of an HIV test result under s. 381.004.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
s. 760.40 requires express consent to perform DNA analysis and to disclose its results. Exceptions are in s. 817.5655.
Genetic testing; express consent required; confidentiality. Fla. Stat. s. 760.40(2)
In force · effective · read October 3, 2026 · source(leg.state.fl.us)
The results of such DNA analysis, whether held by a public or private entity, are the exclusive property of the person tested, are confidential, and may not be disclosed without express consent.
Who it binds, in our words: Any person or entity that performs DNA analysis or holds its results, public or private.
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Suits are limited to narrow cases: false-pretense or forged record authorizations (s. 408.051) and mental health patient rights (s. 394.459). The breach law and Digital Bill of Rights bar private suits. s. 456.057 and s. 760.40 state no private remedy.
Damages a court may award: None fixed. s. 408.051: compensatory damages plus reasonable attorney's fees and costs. s. 394.459: damages as determined by law.
Florida Electronic Health Records Exchange Act: liability for forged or false-pretense authorization. Fla. Stat. s. 408.051
In force · effective · read October 3, 2026 · source(leg.state.fl.us)
may be liable to the patient or a health care provider that has released an identifiable health record in reliance on an authorization form presented to the health care provider by the person for compensatory damages caused by an unauthorized release, plus reasonable attorney’s fees and costs
Who it binds, in our words: A person who forges or alters an authorization form, or obtains a form or health record under false pretenses.
Rights of patients (mental health): liability for violations. Fla. Stat. s. 394.459
In force · effective · read October 3, 2026 · source(leg.state.fl.us)
Any person who violates or abuses any rights or privileges of patients provided by this part is liable for damages as determined by law.
Who it binds, in our words: Rights of patients under part I of chapter 394, which includes clinical record confidentiality in s. 394.4615.
Security of confidential personal information: no private cause of action. Fla. Stat. s. 501.171(10)
In force · effective · read October 3, 2026 · source(leg.state.fl.us)
This section does not establish a private cause of action.
Who it binds, in our words: Breach notification law.
Florida Digital Bill of Rights: enforcement, no private cause of action. Fla. Stat. s. 501.72
In force · effective · read October 3, 2026 · source(leg.state.fl.us)
This part does not establish a private cause of action.
Who it binds, in our words: Florida Digital Bill of Rights, part V of chapter 501.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Both medical and health insurance information are in the definition. Section last amended by ch. 2026-52, effective on approval April 23, 2026. Individual notice is due within 30 days.
Deadline to tell people: No later than 30 days after determination of the breach; 15 more days for good cause given in writing..
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Security of confidential personal information: medical information in definition. Fla. Stat. s. 501.171(1)(g)
In force · effective · read October 3, 2026 · source(leg.state.fl.us)
Any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional;
Who it binds, in our words: Covered entities that acquire, maintain, store or use personal information.
Security of confidential personal information: health insurance information in definition. Fla. Stat. s. 501.171(1)(g)
In force · effective · read October 3, 2026 · source(leg.state.fl.us)
An individual’s health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual;
Who it binds, in our words: Covered entities that acquire, maintain, store or use personal information.
Notice to Department of Legal Affairs. Fla. Stat. s. 501.171(3)
In force · effective · read October 3, 2026 · source(leg.state.fl.us)
A covered entity shall provide notice to the department of any breach of security affecting 500 or more individuals in this state.
Who it binds, in our words: Breaches affecting 500 or more individuals in Florida.
Federal regulator notice deemed compliant. Fla. Stat. s. 501.171(4)
In force · effective · read October 3, 2026 · source(leg.state.fl.us)
Notice provided pursuant to rules, regulations, procedures, or guidelines established by the covered entity’s primary or functional federal regulator is deemed to be in compliance with the notice requirement in this subsection
Who it binds, in our words: Covered entities with a primary or functional federal regulator.
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No in-force law found. HB 527 (2026), on human review of AI claim denials, died in Rules. SB 482 (2026), the AI Bill of Rights, died in Messages on March 13, 2026.
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
13.7%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
95.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
88.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
8.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$67,917 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
4.3%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
6.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
29.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
13.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
