On September 17, 2025, the Florida Agency for Health Care Administration (AHCA) will hold its first public meeting to discuss proposed rules designed to enhance transparency and preparedness around health care information system breaches. AHCA is Florida’s agency responsible for the state’s Medicaid program, the licensure of the state’s health care facilities, and the sharing of health care data through the Florida Center of Health Information and Policy Analysis.
The proposed rules would apply broadly to a wide range of licensed health care providers and facilities under AHCA’s regulatory authority. This includes, among others, hospitals, nursing homes, assisted living facilities, ambulatory surgical centers, hospice providers, home health agencies, intermediate care facilities for individuals with developmental disabilities, clinical laboratories, rehabilitation centers, and health care clinics. In practice, nearly every licensed entity that delivers health care services in Florida or participates in Medicaid could be subject to the new obligations if approved.
Key Provisions
Mandatory Breach Reporting. Providers would be required to report “information technology incidents” to AHCA within 24 hours of having a reasonable belief that an incident may have occurred. For this purpose, an information technology incident means:
an observable occurrence or data disruption or loss in an information technology system or network that permits or is caused by unauthorized access of data in electronic form. Good faith access by an authorized employee does not constitute an information technology incident, provided that the data is not used in an unauthorized manner or for an unauthorized purpose.
Notably the reporting obligation is not limited to an unauthorized access or acquisition of protected health information. Also, reports would need to be submitted through the Agency’s adverse incident reporting system using a standardized form. This short timeframe signals the Agency’s intent to receive timely information about potential breaches that could affect patient care or compromise sensitive health information.
Written Continuity Plans. Providers covered by the rule would need to maintain a written “continuity plan.” This plan is defined as a detailed policy that sets out procedures to maintain critical operations and essential patient care services during any disruption of normal operations.
Importantly, according to the proposed rules, continuity plans must not only have a process for performing redundant on-site and off-site data backups, but one that verifies the restorability of back-ups. When facing a ransomware attack, for example, it is little help to have backed-up files, if the organization cannot restore them.
Additionally, the continuity plan must include procedures for restoring critical systems and patient services, and securely restoring backed-up data.
Post-Incident Documentation. Upon AHCA’s request, providers would be obligated to furnish documentation relating to an information technology incident. This could include police or forensic investigation reports, internal policies, details of the information disclosed, remedial measures taken, and the provider’s continuity plan. The rule is intended to ensure that providers not only respond to incidents but also demonstrate how they investigated, contained, and addressed them.
However, in many cases, some of these materials are prepared at the direction of counsel in anticipation of litigation and subject to the attorney client privilege. Providers concerned about the disclosure of such materials, which could include confidential business and proprietary information, as well as sensitive information about the organization’s IT infrastructure, should consult with counsel.
Next Steps
If adopted, the proposed rule would impose significant operational and compliance requirements on Florida’s licensed health care providers. Facilities and organizations subject to AHCA licensure should review their current cybersecurity incident response procedures, reporting mechanisms, and continuity planning to ensure they align with the proposed requirements, if adopted.