STORAGE NAME: h1083c.HHS
DATE: 4/1/2025
1
FLORIDA HOUSE OF REPRESENTATIVES
BILL ANALYSIS
This bill analysis was prepared by nonpartisan committee staff and does not constitute an official statement of legislative intent.
BILL #: CS/HB 1083
TITLE: Patient Access to Records
SPONSOR(S): Booth
COMPANION BILL: None
LINKED BILLS: None
RELATED BILLS: SB 1606 (Grall)
Committee References
Health Professions & Programs
17 Y, 0 N
Health & Human Services
19 Y, 7 N, As CS
SUMMARY
Effect of the Bill:
CS/HB 1083 standardizes access to health care records for patients, residents and legal representatives. The bill
requires all health care practitioners and facilities, excluding nursing homes, to provide records within 14 days of a
request and allow inspection of records within 10 days. Health care providers and facilities may produce the
requested records in paper or electronic format. However, health care providers and facilities must produce the
requested records in an electronic format, including access through a web-based patient portal or submission into a
patient’s electronic personal health record, if the health care provider or facility maintains an electronic health
recordkeeping system.
The bill requires nursing homes to provide residents with access to their records within 24 hours (excluding
holidays and weekends) and a copy of any requested records within two working days of request.
Fiscal or Economic Impact:
None
JUMP TO SUMMARY ANALYSIS RELEVANT INFORMATION BILL HISTORY
ANALYSIS
EFFECT OF THE BILL:
Patient Health Care Records Access
Current law governing access to health care records lacks standardization. The right to inspect records, whether
the records have to be produced in paper form or electronically, and the timeframe to produce copies are different
depending on which kind of health care facility or health care practitioner is involved.
The bill standardizes access to health care records for patients, and health care facility residents. The bill requires
all health care practitioners and facilities, excluding nursing homes, to provide records within 14 days of a request
and allow inspection of records within 10 days. Health care providers and facilities may produce the requested
records in paper or electronic format. However, health care providers and facilities must produce the requested
records in an electronic format, including access through a web-based patient portal or submission into a patient’s
electronic personal health record, if the health care provider or facility currently maintains a patient portal. This
licensure requirement is enforceable through the Department of Health, which regulates health care practitioners,
and by the Agency for Health Care Administration, which regulates health care facilities. (Section 1, 3, 5, 6)
Federal law currently requires nursing homes to provide residents with access to their records within 24 hours
(excluding holidays and weekends) and a copy of any requested records within two working days of request. The
bill incorporates these timelines into Florida law. This makes them enforceable as a licensure requirement by the
Agency for Health Care Administration, which regulates nursing homes. (Section 4, 5) JUMP TO SUMMARY ANALYSIS RELEVANT INFORMATION BILL HISTORY
2
These requirements also apply when a patient’s or resident’s legal representative makes the records request.
Under the bill, a patient’s or resident’s attorney designated to receive copies of the patient’s or resident’s medical,
care and treatment, or interdisciplinary records; any legally recognized guardian of the patient or resident; any
court appointed representative of the patient or resident; or any person designated by the patient or resident or by
a court of competent jurisdiction to receive copies of the patient’s or resident’s medical, care and treatment, or
interdisciplinary records. (Section 2, 3, 5, 6).
The bill provides an effective date of January 1, 2026. (Section 13).
RELEVANT INFORMATION
SUBJECT OVERVIEW:
Access to Health Care Records – Federal Law
Health Insurance Portability and Accountability Act
The federal Health Insurance Portability and Accountability Act (HIPAA), enacted in 1996, protects personal health
information (PHI).
1 In 2000, the U.S. Department of Health and Human Services promulgated privacy rules which
established national standards to protect medical records and other PHI.
2 These rules address, among other things,
the use and disclosure of an individual’s PHI. Only certain entities, known as “covered entities”, are subject to
HIPAA’s provisions and include:
Health plans,
Health care providers,
Health care clearinghouses; and
Business associates of any of the above
3
HIPAA requires the disclosure of an individual’s PHI to the individual who is the subject of the PHI information or
his or her personal representative,
4 upon his or her request.
5 A covered entity must produce the PHI in the
electronic form and format requested by the individual, if it is readily producible in such form and format.
6
In general, HIPAA privacy rules preempt any state law that is contrary to its provisions.
7 However, if the state law
is more stringent, the state law will apply.
The 21
st Century Cures Act
The 21
st Century Cures (Act), was enacted to, among other things, improve patient access to health care records.
Whereas HIPAA protects patient privacy, the Act increases patient’s access to health care records by prohibiting
“actors” from interfering with the access, exchange or use of electronic health information. The Act prohibits three
categories of actors from information blocking:
Health Care Providers;
1 Pub. L. No. 104-191 (1996). Protected health information includes all individually identifiable health information held or transmitted by a
covered entity or its business associate.
2 U.S. Department of Health and Human Services, Health Information Privacy, available at https://www.hhs.gov/hipaa/for-
professionals/privacy/index.html (last visited February 17, 2025). The rules were modified in 2002.
3 U.S. Department of Health and Human Services, Office for Civil Rights, Summary of the HIPAA Privacy Rule, (last rev. May 2003), available at
https://www.hhs.gov/sites/default/files/privacysummary.pdf. (last visited February 17, 2025).
4 Supra, FN 2. A personal representative is generally a person with authority under state law to make health care decisions on behalf of an
individual.
5 Supra, FN 3. HIPAA limits the access to psychotherapy notes, certain lab results, and information compiled for legal proceedings. A covered
entity may also deny access to personal health information in certain situations, such as when a health care practitioner believes access
could cause harm to the individual or others.
6 45 CFR § 164.524(c)(2)(i).
7 45 C.F.R. s. 160.203. JUMP TO SUMMARY ANALYSIS RELEVANT INFORMATION BILL HISTORY
3
Health Information Network or Health Information Exchange
Health IT Developer of Certified Health IT
Upon request, actors must make access to certain types of clinical notes that have been created in an electronic
health record (EHR) immediately available:
8
Consultation notes;
Discharge summary notes;
Procedure notes;
Progress notes;
Imaging narratives;
Lab report narratives;
Pathology report narratives; and
History and physicals.
Notes compiled in reasonable anticipation of, or use in a civil, criminal or administrative action or proceeding and
psychotherapy session notes are exempt from being produced under the Act.
9
The Act provides several exceptions to providing a patient with immediate access to their EHR. Specifically, it will
not be considered information blocking under the Act if access is denied or limited for any of the following
reasons:
10
Preventing Harm;
Privacy;
Security;
Infeasibility;
11 and
Health IT Performance and Maintenance.
12
It will also not be considered to be information blocking under certain circumstances if an actor provides the EHI
in a different manner than it was requested, charges a fee, requires a licensing agreement or limits access to only
through TEFCA
13 (Trusted Exchange Framework and Common Agreement).
Medicare Requirements for Long-Term Care Facilities
Access to medical and clinical records by residents of a nursing home receiving federal Medicare funding to care
for Medicare patients is controlled by federal medical records exception rules not HIPAA. Such nursing homes are
required to provide residents with access to their records within 24 hours (excluding holidays and weekends) and
a copy of any requested records within two working days of request.
14
8 Cures Act Overview. The Risk Management Foundation of the Harvard Medical Institutions, Inc., at Cures Act Overview. (Last visited March
3, 2025).
9 Id.
10 Information Blocking. Office of the National Coordinator for Health IT., at Information Blocking | HealthIT.gov. (Last visited on March 3,
2025).
11 It is not information blocking if it is not feasible for the actor to provide access to the EHI in the manner requested by the patient.
12 Health IT systems can be temporarily shut down for maintenance or to degrade the health IT's performance for the benefit of the overall
performance of the health IT.
13 TEFCA was created by the U.S. Department of Health & Human Services Assistant Secretary for Technology Policy to remove barriers for
sharing health records electronically among healthcare providers, patients, public health agencies, and payers. The TEFCA framework
directly supports nationwide health data sharing by connecting health information networks (HINs) across the country. Each of these
existing networks supports health information sharing for specific states, regions and localities, or among customers using the same
electronic health record (EHR) vendor.
14 42 CFR s. 483.10(2)(g). JUMP TO SUMMARY ANALYSIS RELEVANT INFORMATION BILL HISTORY
4
Currently, all but two of the licensed nursing homes in this state are medical records exception-certified and would
be subject to these federal requirements.
15 The Agency for Health Care Administration cited 11 nursing homes for
failing to meet these requirements from 2023 to January 2025.
16
Access to Health Care Records – Florida Law
Practitioners
Chapter 456, F.S., is the licensure act for all health care practitioners. Any requirement within this chapter applies
to all health care practitioners.
17 Health care practitioners law has standardized records access requirements that
apply to all practitioners. A practitioner must provide a copy of patient medical records to the patient if requested
by the patient or his or her legal representative.
18 The patient’s medical records must be released without delay for
legal review.
Substance abuse service providers are subject to different requirements. A substance abuse service provider may
only release records with the written consent of the individual whom they pertain.
19 However, under limited
circumstances, such as a medical emergency, the service provider may release records without the consent of the
individual whom they pertain.
20 There is no statutorily established timeframe for a substance abuse service
provider to release requested records.
Facilities
Chapter 408, F.S., is the core licensure act for health care facilities. Any requirement contained within this chapter
applies to all health care facilities, which includes:
21
Laboratories authorized to perform testing under the Drug-Free Workplace Act;
Birth centers;
Abortion clinics;
Crisis stabilization units;
Short-term residential treatment facilities;
Residential treatment facilities;
Residential treatment centers for children and adolescents;
Hospitals;
Ambulatory surgical centers;
Nursing homes;
Assisted living facilities;
Home health agencies;
Nurse registries;
Companion services or homemaker services providers;
15 Correspondence from the Agency for Health Care Administration to committee staff dated February 27, 2025, on file with the Health
Professions and Programs Subcommittee.
16 Correspondence from the Agency for Health Care Administration to committee staff dated February 27, 2025, on file with the Health
Professions and Programs Subcommittee.
17A health care practitioner is any person licensed under ch. 457, F.S., (acupuncture); ch. 458, F.S., (medical practice); ch. 459, F.S.,
(osteopathic medicine); ch. 460, F.S., (chiropractic medicine); ch. 461, F.S., (podiatric medicine); ch. 462, F.S., (naturopathy); ch. 463, F.S.,
(optometry); ch. 464, F.S., (nursing); ch. 465, F.S., (pharmacy); ch. 466, F.S., (dentistry, dental hygiene, and dental laboratories); ch. 467, F.S.,
(midwifery); part I, part II, part III, part V, part X, part XIII, or part XIV of ch. 468, F.S., (speech language pathology and audiology, nursing
home administration, occupational therapy, respiratory therapy, dietetics and nutrition practice, athletic trainers, or orthotics, prosthetics,
and pedorthics); ch. 478, F.S., (electrolysis); ch. 480, F.S., (massage practice); part III or part IV of ch. 483, F.S., (clinical laboratory personnel
or medical physicists); ch. 484, F.S., (dispensers of optical devices and hearing aids); ch. 486, F.S., (physical therapy practice); ch. 490, F.S.,
(psychological services); or ch. 491, F.S., (clinical, counseling, and psychotherapy services).
18 S. 456.057, F.S. In lieu of copies of certain medical records related to psychiatric or psychological treatment, a practitioner may release a
report of examination and treatment.
19 S. 397.501(7)(a), F.S.
20 Id.
21 Ss. 408.803(11) F.S., and 408.802, F.S. JUMP TO SUMMARY ANALYSIS RELEVANT INFORMATION BILL HISTORY
5
Adult day care centers;
Hospices;
Adult family-care homes;
Homes for special services;
Transitional living facilities;
Prescribed pediatric extended care centers;
Home medical equipment providers;
Intermediate care facilities for persons with developmental disabilities;
Health care services pools;
Health care clinics; and,
Multiphasic health testing centers.
Currently, Chapter 408 does not establish standard requirements for health care facilities to produce, or allow
inspection of, a patient’s or resident’s medical, clinical and interdisciplinary records. Rather, the requirements are
in each facility licensure act and vary, sometimes greatly. Some health care facilities do not have statutory
requirements related to a patient’s access to records.
Hospitals, Ambulatory Surgical Centers, and Mobile Surgical Centers
After a patient has been discharged, a licensed hospital, ambulatory surgical center, and mobile surgical center
(licensed facility) must, upon written request, timely provide patient records in its possession to the patient.
22 The
records may also be released to the patient’s guardian, curator, or personal representative, or in the absence of one
of those persons, to the next of kin of a decedent or the parent of the minor, or to any other person designated in
writing by such patient.
A licensed facility must also allow a patient or their representative access to examine the records in its possession,
but may establish reasonable terms to assure that the records will not be damaged, destroyed, or altered.
23 There
is no statutorily established timeframe for when a licensed facility must provide this access.
Nursing Homes
Upon request, a nursing home must provide a competent resident with a copy of any paper and electronic records
of the resident which it has in its possession.
24 Such records must include any medical records and records
concerning the care and treatment of the resident performed by the nursing home, except for notes and report
sections of a psychiatric nature.
25 A nursing home must provide these records within 14 days for a current resident
and 30 days for a former resident.
26 A nursing home may refuse to furnish these records directly to a resident if it
determines that disclosure would be detrimental to the resident’s physical or mental health.
27 However, upon such
a refusal, a resident may have his or her records furnished to a medical provider designated by the resident.
28
A nursing home must also allow a resident’s representative access to examine the records in its possession, but
may establish reasonable terms to assure that the records will not be damaged, destroyed, or altered.
29 There is no
statutorily established timeframe for when a nursing home must provide this access.
Mental Health Facilities
22 S. 395.3025, F.S. This does not apply to facilities that primarily provide psychiatric care or certain clinical records created at any licensed
facility concerning certain mental health or substance abuse services.
23 S. 395.3025(1), F.S.
24 S. 400.145(1), F.S.
25 Id.
26 Id.
27 S. 400.145(5), F.S.
28 Id.
29 Id. JUMP TO SUMMARY ANALYSIS RELEVANT INFORMATION BILL HISTORY
6
A clinical record is required for each patient receiving treatment for mental illness at a receiving facility
30 or
treatment facility.
31 The treatment or receiving facility must release a patient’s clinical records if requested by the
patient, the patient’s guardian or counsel or the Department of Corrections.
32 There is no statutorily timeframe for
when a receiving or treatment facility must provide the requested clinical records.
Hospices
A hospice is required to release a patient’s interdisciplinary record if requested by an individual authorized by the
patient or by the court.
33 There is no statutorily established timeframe for when a hospice must release a patient’s
interdisciplinary record.
Electronic Medical Records Patient Portals
Patient portals are health care provider-owned and -operated electronic applications which give patients secure
access to protected health information and allow secure methods for communicating and sharing information with
health care providers.
34 These portals are typically connected to the electronic health records of a particular health
care provider, practice group or institution.
35
Portals vary in sophistication ranging from those which only allow patients to view medical records to those which
allow patients to access specific-patient educational materials, schedule appointments and request prescription
refills.
36 Improved access to records and health care providers can promote better informed health care decision-
making and patient engagement.
37
One of the drawbacks to patient portals is the inability of patients to have a centralized repository of their health
care records. Patient portals are owned by health care providers, rather than by patients, and may not be
interoperable with the electronic health records of another provider. A patient who receives treatment or services
from multiple health care providers or facilities could feasibly have his or her records dispersed between multiple
patient portals.
Electronic Personal Health Record
An electronic personal health record (PHR) is a patient owned electronic application through which individuals can
access, manage and share health information in a private, secure and confidential environment.
38 PHRs that are
offered by health plans or health care providers are subject to the HIPAA privacy rule.
39 PHRs that are offered by
vendors, employers and other non-covered entities are not subject to the HIPAA privacy rule. These entities have
30 A “receiving facility” is a public or private facility or hospital designated by the Department of Children and Families to receive and hold or
refer, as appropriate, involuntary patients under emergency conditions for mental health or substance abuse evaluation and to provide
treatment or transportation to the appropriate service provider. S. 394.455(39), F.S.
31 S. 394.4615(1), F.S.; A “treatment facility” is a state-owned, state-operated, or state-supported hospital, center, or clinic designated by the
Department of Children and Families for extended treatment and hospitalization, beyond that provided for by a receiving facility, of persons
who have a mental illness, including facilities of the United States Government, and any private facility designated by the Department of
Children and Families when rendering such services. S. 394.455(47), F.S.
32 S. 394.4615(2), F.S.
33 S. 400.611(3), F.S.
34 Kooij, Groen, van Harten, Barriers and Facilitators Affecting Patient Portal Implementation from an Organizational Perspective: Qualitative
Study, J Med Internet Res. 2018 May; 20(5): e183, https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5970285/ (last viewed on February 18,
2025).
35 Id.
36 Griffin, Skinner, Thornhill, Weinberger, Patient Portals: Who uses them? What features do they use? And do they reduce hospital
readmissions?, Appl Clin Inform. 2016; 7(2): 489–501, https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4941855/ (last visited on February
18, 2025).
37 Id.
38 Tang, Ash, Bates, Overhage, and Sands, Personal Health Records: Definitions, Benefits, and Strategies for Overcoming Barriers to Adoption, J
Am Med Inform Assoc., 2006 Mar-Apr; 13(2): 121-126, https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1447551/pdf/121.pdf (last visited
February 19, 2025).
39 Personal Health Records and the HIPAA Privacy Rule, U.S. Department of Health and Human Services, Office for Civil Rights, available at
https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/understanding/special/healthit/phrs.pdf (last visited on February 19, 2025). JUMP TO SUMMARY ANALYSIS RELEVANT INFORMATION BILL HISTORY
7
contractual privacy policies, which may vary, but are required under federal law to notify customers in the event of
a security breach.
40
A PHR can be stand-alone or integrated. In a stand-alone PHR, the individual enters all information into the
record.
41 This can be done manually by entering the medical data or by uploading medical records into the PHR. In
an integrated PHR, information is submitted directly through electronic health care devices and through health
care provider’s electronic health records system.
42
Integrated Personal Health Record
43
Potential benefits of the use of a PHR, for patients, health care providers, and health care systems include:
44
Empowerment of patients. PHRs let patients verify the information in their medical record and
monitor health data about themselves (very useful in chronic disease management). PHRs also provide
scheduling reminders for health maintenance services.
Improved patient-provider relationships. PHRs improve communication between patients and
clinicians, allow documentation of interactions with patients and convey timely explanations of test
results.
Increased patient safety. PHRs provide drug alerts, help identify missed procedures and services, and
get important test results to patients rapidly. PHRs also give patients timely access to updated care
plans.
Improved quality of care. PHRs enable continuous, comprehensive care with better coordination
between patients, physicians and other providers.
More efficient delivery of care. PHRs help avoid duplicative testing and unnecessary services. They
provide more efficient communication between patients and physicians (e.g., avoiding congested office
phones).
40 16 CFR § 318.3.
41 Id.
42 Id.
43 Roehrs A, da Costa CA, da Rosa Righi R, de Oliveira KSF, Personal Health Records: A Systematic Literature Review, J Med Internet Res
2017;19(1):e13, https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5251169/ (last visited on February 18, 2025)
44 Endsley, Kibbe, Linares, MD, Colorafi, An Introduction to Personal Health Records, Fam Pract Manag. 2006 May;13(5):57-62,
https://www.aafp.org/fpm/2006/0500/p57.html (last visited on February 18, 2025). JUMP TO SUMMARY ANALYSIS RELEVANT INFORMATION BILL HISTORY
8
Better safeguards on health information privacy. By giving patients control of access to their
records, PHRs offer more selectivity in sharing of personal health information.
Bigger cost savings. Improved documentation brought about by PHRs can decrease malpractice costs.
PHRs' ability to reduce duplicative tests and services is a factor here, too.
PHRs can also potentially be beneficial in ensuring continuity of care in mass evacuations situations, such as
hurricanes and brushfires.
45
There are numerous potential barriers to the adoption and use of PHRs. These include privacy and security
concerns, costs, integrity, accountability, health literacy and legal and liability risk.
46
BILL HISTORY
COMMITTEE REFERENCE ACTION DATE
STAFF
DIRECTOR/
POLICY CHIEF
ANALYSIS
PREPARED BY
Health Professions & Programs
Subcommittee
17 Y, 0 N 3/20/2025 McElroy Aderibigbe
Health & Human Services
Committee
19 Y, 7 N, As CS 3/31/2025 Calamas Aderibigbe
THE CHANGES ADOPTED BY THE
COMMITTEE:
Health care practitioners are required to provide a patient with records
through a patient portal only if the practitioner currently maintains a
patient portal.
Corrected an erroneous cross-reference by removing the section.
Changed the effective date to January 1, 2026.
-------------------------------------------------------------------------------------------------------------------------------------
THIS BILL ANALYSIS HAS BEEN UPDATED TO INCORPORATE ALL OF THE CHANGES DESCRIBED ABOVE.
-------------------------------------------------------------------------------------------------------------------------------------
45 Supra FN 38.
46 Vance, Tomblin, Studney, Coustasse, Benefits and Barriers for Adoption of Personal Health Records, 2015,
https://mds.marshall.edu/cgi/viewcontent.cgi?referer=https://www.google.com/&httpsredir=1&article=1135&context=mgmt_faculty (last
visited on February 18, 2025).