Florida Bans Offshoring of Certain Patient Information

The Florida Legislature recently amended the Florida Electronic Health Records Exchange Act (the “Act”) to prohibit certain health care providers utilizing certified electronic health record technologies from storing qualified electronic health records[1] outside of the United States, its territories, or Canada.[2] Significantly, the prohibition also extends to qualified electronic health records that are stored through a third-party or subcontracted computing facility or cloud service provider.[3]

In effect, qualifying health care providers may not themselves store qualified electronic health records offshore, nor can they rely on third-party vendors who operate offshore. It is also important to emphasize that the concept of storage extends to a party’s ability to retrieve, access, or even transmit qualified electronic health records.[4] This concept becomes a concern where a third party contractor outside of the United States, its territories, or Canada, such as an IT support vendor, electronic health records platform, or data entry subcontractor, is able to access qualified electronic health records that are otherwise stored on servers within the United States.

For purposes of this offshore prohibition, a “health care provider” includes certain qualifying:

• Health care practitioners licensed or permitted under Florida law, such as physicians, physician assistants, acupuncturists, chiropractors, podiatrists, naturopathic physicians, optometrists, nurses, pharmacists, dentists, speech pathologists, occupational therapists, nursing home administrators, dieticians, athletic trainers, massage therapists, among others.
• Health care facilities and related service providers, such as hospitals, ambulatory surgical centers, nursing homes, assisted living facilities, pharmacies, home health agencies, nurse registries, companion services or homemaker services providers, adult day care centers, hospices, laboratories authorized to perform testing under the Drug-Free Workplace Act, birth centers, abortion clinics, crisis stabilization units, short-term residential treatment facilities, residential treatment centers for children and adolescents, adult family-care homes, transitional living facilities, prescribed pediatric extended care centers, home medical equipment providers, intermediate care facilities for persons with development disabilities, health care services pools, health care clinics, organ, tissues, and eye procurement organizations, continuing care facilities, among others.
• Licensed facilities and providers furnishing mental health or substance abuse services, along with their respective clinical and non-clinical staff who support inpatient and outpatient services.[5]

The Act is slated to take effect on July 1, 2023. Qualifying health care providers should assess where electronic patient information is stored, including whether third-party vendors (such as IT support, scheduling support, etc.) outside of the United States or Canada have access to the patient information. Where there is a conflict, qualifying health care providers may need to begin transitioning patient information to new storage locations or take steps to ensure that access to patient information is appropriately limited prior to the Act’s effective date.

FOOTNOTES

[1] Fla. Stat. § 408.051(3). For purposes of the Act, a “qualified electronic health record” includes “an electronic record of health-related information concerning an individual which includes patient demographic and clinical health information, such as medical history and problem lists, and which has the capacity to provide clinical decision support, to support physician order entry, to capture and query information relevant to health care quality, and to exchange electronic health information with, and integrate such information from, other sources.” Fla. Stat. § 408.051(2).

[2] Fla. Stat. § 408.051(3).

[3] Fla. Stat. § 408.051(3).

[4] Fla. Stat. § 408.051(3).

[5] Fla. Stat. § 408.051(2).