Florida HIPAA Statutes

Right to Privacy of Medical Records

Patient medical records maintained by a physician are generally confidential and may not be furnished to a third party without patient authorization. Records requested must be furnished upon request in a timely fashion without delays for legal review. The release of the records cannot be conditioned upon payment of a fee for services rendered. The physician can require as a condition of releasing records the payment of reasonable costs of reproducing the records.



Keep records of all disclosures of information including the purpose of the disclosure request. Third parties cannot disclose records to anyone unless they have written consent.

Records must be maintained for 5 years. Since the statute of limitations for malpractice is 7 years, it is recommended records are kept for seven years.

Healthcare providers are the owners of the records and must protect the confidentiality and security of the records and train employees in these policies.

Fines for violating this statute are up to $5,000 per violation and disciplinary actions. Parents are considered the legal representative of the minor child and can authorize release of records to a third party except:

In case of divorce, only the parent having “parental responsibility” for the minor is entitled to medical records. If custody is shared, both parents can have access to the child’s records.

Charges for Providing Medical Records

When furnishing copies of a medical record, the physician can charge no more than $1.00 per page for the first 25 pages of written material, .25 cents for each additional page and the actual cost of reproducing non written records, e.g.: X-rays. (Worker’s Compensation is .50 cents per page)

Release of Records to a third party

A general consent form is sufficient for most records. Records of HIV, substance abuse, or psychiatric care have a special consent form. Always document the purpose of the disclosure. Subpoenas do not authorize the release of HIV, alcohol, substance abuse, or psychiatric records. In these cases, a court order is required to release records. The patient must also agree to release these records. Generally records must be provided to governmental officials with a search warrant. Records regarding potential child abuse, abuse of a vulnerable adult, the diagnosis of or suspect of a disease of a “public health significance” and sexually transmitted diseases must be reported to Florida’s Department of Health