In May 2023, Florida enacted a significant change to its health data laws. Senate Bill 264 amended the Florida Electronic Health Records Exchange Act restricting where certain patient data can be stored and accessed. Codified at Section 408.051(3) of the Florida Electronic Health Records Exchange Act, the change mandates that:
In addition to the requirements in 45 C.F.R. part 160 and subparts A and C of part 164, a health care provider that utilizes certified electronic health record technology must ensure that all patient information stored in an offsite physical or virtual environment, including through a third-party or subcontracted computing facility or an entity providing cloud computing services, is physically maintained in the continental United States or its territories or Canada. This subsection applies to all qualified electronic health records that are stored using any technology that can allow information to be electronically retrieved, accessed, or transmitted.
In other words, the law requires healthcare providers using certified electronic health record technology (CEHRT) to ensure that patient information stored outside their facilities—whether in a physical data center, virtual environment, or cloud service—is maintained only in the continental United States, its territories, or Canada.
Note this compliance requirement also comes with a statutory obligation (Section 408.810(14)) for any license under Chapter 408 of the Florida Public Health Law to sign an affidavit of compliance upon initial application and future renewals:
The licensee must sign an affidavit at the time of his or her initial application for a license and on any renewal applications thereafter that attests under penalty of perjury that he or she is in compliance with s. 408.051(3). The licensee must remain in compliance with s. 408.051(3) or the licensee shall be subject to disciplinary action by the agency.
Emphasis added.
This amendment makes clear its intent that the new rule go beyond the requirements in the well-known federal privacy and security regulations for healthcare providers, the Health Insurance Portability and Accountability Act (HIPAA). HIPAA generally does not impose geographic restrictions on where protected health information (PHI) may be processed or stored, so long as appropriate safeguards and agreements are in place. Likely considered a more stringent protection for PHI, the Florida amendment would appear to survive HIPAA preemption.
The law applies broadly across the healthcare sector, including hospitals, clinics, ambulatory surgical centers, home health agencies, hospices, nursing homes, labs, pharmacies, and many individual licensed practitioners—from physicians and nurses to therapists and pharmacists.
And, this restriction does not stop with covered providers. It extends to vendors and subcontractors that support healthcare operations. Managed service providers, IT vendors, scheduling support services, and other contractors that store or access patient information must also ensure that the data remains within the permitted geographic boundaries.
The requirements in the law also are not limited to certain types of patient information, such as diagnoses or mental health status. The rule extends to all patient information.
For many covered entities, the operational challenge is real. Disaster recovery environments, backup systems, and globally distributed cloud infrastructure often rely on servers outside the United States. Architectures designed for redundancy or resilience may now create compliance issues under Florida’s law.
Example: Healthcare providers often rely on vendors when handling investigations, such as for security incidents, and responding to data breaches. In some cases, providers may need to perform substantial data mining efforts to identify patients impacted by a breach. Third party data mining vendors often offer substantial discounts when that work is performed outside the U.S. Incident response plans of Florida covered providers should serve as a reminder of where patient information need to be stored.
Practically speaking, that means covered healthcare providers should be, at a minimum:
- auditing where patient data is actually stored
- reviewing vendor and subcontractor arrangements
- updating contracts, BAAs, and data processing agreements to reflect storage restrictions
- performing diligence on data location when onboarding new vendors
Florida’s move is also part of a larger trend. Regulators and policymakers are increasingly focused on data sovereignty and foreign access to sensitive health information. This amendment is an indicator of where state and federal regulation appears to be headed.