The Florida Senate
BILL ANALYSIS AND FISCAL IMPACT STATEMENT
(This document is based on the provisions contained in the legislation as of the latest date listed below.)
Prepared By: The Professional Staff of the Committee on Health Policy
BILL: SB 1606
INTRODUCER: Senator Grall
SUBJECT: Patient Access to Records
DATE: March 24, 2025
ANALYST STAFF DIRECTOR REFERENCE ACTION
1. Smith Brown HP Pre-meeting
2. AHS
3. RC
I. Summary:
Under current Florida law, hospitals, ambulatory surgical centers, and health care practitioners
are required to provide requested patient health records to patients, residents, and their legal
representatives in a “timely” manner. In the absence of a specific statutory deadline, the federal
Health Insurance Portability and Accountability Act (HIPAA) standard of 30 calendar days
applies. For electronic health information, the federal Information Blocking Rule also generally
applies, requiring access without unreasonable delay.
SB 1606 standardizes the timeframe for responding to patient records requests for patients,
residents, and their legal representatives. The bill amends various sections of the Florida Statutes
to require health care providers and practitioners to furnish requested records within 14 working
days of a request. Providers and practitioners who maintain electronic health record systems
must deliver the records in the format chosen by the requester.
In addition, the bill requires providers and practitioners to allow access for the inspection of
original records, or suitable reproductions such as microforms, within 10 working days of
receiving a request. Providers may impose reasonable conditions to protect the integrity of the
records.
The bill creates s. 408.833, F.S., to establish uniform record access and delivery standards for
clients of health care providers (including facilities) that are licensed, registered, or certified by
the Agency for Health Care Administration (AHCA), that are not otherwise addressed in specific
statutory provisions. These standards are also applied to licensed health care practitioners
regulated by the Department of Health (DOH), as well as to mental health service providers and
substance abuse treatment providers.
Florida law currently requires nursing homes to provide requested records within 14 working
days. The bill revises this requirement to align with federal Medicare and Medicaid Conditions
REVISED: BILL: SB 1606 Page 2
of Participation, mandating that inspection be allowed within 24 hours (excluding weekends and
holidays) and copies be furnished within two working days of the request.
The bill provides an effective date of July 1, 2025.
II. Present Situation:
Federal Right of Access to Records Under HIPAA
The federal Health Insurance Portability and Accountability Act (HIPAA) establishes national
standards for the protection of individually identifiable health information. The HIPAA Privacy
Rule
1
, implements these protections and sets forth the individual right of access to medical
records.
2
The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) is
responsible for implementing and enforcing the HIPAA Privacy Rule.
3
Under the Privacy Rule, individuals have the right to inspect or obtain a copy of their protected
health information (PHI) maintained by a covered entity. Covered entities include:
• Health care providers who transmit health information electronically in connection with
certain administrative transactions,
• Health plans such as insurers and health maintenance organizations (HMOs), and
• Health care clearinghouses.
4
Most licensed health care providers and health care practitioners in Florida qualify as covered
entities under these definitions. Business associates of covered entities, such as third-party billing
companies or cloud storage providers, must also comply with HIPAA’s access provisions when
they handle protected health information on behalf of the covered entity.
5
The Privacy Rule requires covered entities to provide access to PHI contained in what is known
as a designated record set. A designated record set is defined
6
as a group of records maintained
by or for a covered entity that is used, in whole or in part, to make decisions about individuals.
These records include:
• Medical and billing records maintained by or for a health care provider,
• Enrollment, payment, claims adjudication, and case or medical management records
maintained by or for a health plan, and
• Any other records used to make decisions about the individual.
7
Records not used to make treatment or coverage decisions—such as peer review files or internal
administrative documents—are not considered to be included in the designated record set.
1
45 C.F.R. Part 160 and Subparts A and E of Part 164.
2
45 C.F.R. § 164.524.
3
U.S. Department of Health and Human Services, Office for Civil Rights, Summary of the HIPAA Privacy Rule, available at:
https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html (last visited Mar. 22, 2025).
4
45 C.F.R. § 160.103.
5
45 C.F.R. §§ 160.103, 164.502(e).
6
45 C.F.R. § 164.501.
7
Id. BILL: SB 1606 Page 3
The Privacy Rule requires covered entities to respond to a request for access within 30 calendar
days. One 30-day extension is permitted if the individual is notified in writing of the delay and
the expected response date.
8
If PHI is maintained electronically, and the individual requests an
electronic copy, the entity must provide it in the requested form and format if it is readily
producible.
9
Covered entities may charge only a reasonable, cost-based fee for access. This fee may include
the cost of labor for copying, supplies, and postage, if applicable, but may not include retrieval
fees or other administrative charges.
10
In guidance issued by the OCR, covered entities are
prohibited from imposing barriers to access, such as requiring patients to submit requests in
person or through proprietary forms when such requirements are not necessary.
11
Interaction of HIPAA with State Law
12
HIPAA establishes a national baseline for the privacy and security of health information but
permits states to enact laws that provide greater protections or access rights. A state law is only
preempted by HIPAA if it is contrary to HIPAA—that is, if it is impossible to comply with both
the state and federal requirements, or if the state law stands as an obstacle to the full purposes
and objectives of HIPAA.
However, if a state law is more protective of patient privacy or provides greater access to health
information than HIPAA, it is not preempted and remains enforceable. In practice, this means
states may adopt laws that expand individual rights of access, shorten response times, or add
safeguards, so long as they do not authorize disclosures or impose barriers that conflict with
HIPAA’s requirements.
Federal Information Blocking Prohibition
The 21st Century Cures Act
13
prohibits certain actors from engaging in “information blocking,”
which is broadly defined as any practice that is likely to interfere with access, exchange, or use
of electronic health information (EHI), unless the practice is required by law or covered by a
regulatory exception.
14
The Office of the National Coordinator for Health Information
8
45 C.F.R. § 164.524(b)(2).
9
45 C.F.R. § 164.524(c)(2).
10
45 C.F.R. § 164.524(c)(4).
11
U.S. Department of Health and Human Services, Office for Civil Rights, Individuals’ Right under HIPAA to Access their
Health Information 45 CFR § 164.524, available at: https://www.hhs.gov/hipaa/for-
professionals/privacy/guidance/access/index.html (last visited Mar. 22, 2025).
12
U.S. Department of Health and Human Services, Office of the National Coordinator for Health Information Technology,
When a state or federal law or regulation (such as the HIPAA Privacy Rule) requires that EHI be released, is it ever
information blocking not to release it?, available at: https://www.healthit.gov/faq/when-state-or-federal-law-or-regulation-
such-hipaa-privacy-rule-requires-ehi-be-released-no (last visited Mar. 22, 2025).
13
Pub. L. No. 114-255.
14
42 U.S.C. § 300jj-52. BILL: SB 1606 Page 4
Technology (ONC) is responsible for implementing the rule,
15
and the U.S. Department of
Health and Human Services Office of Inspector General (OIG) is charged with enforcement.
16
The federal Information Blocking Rule
17
, adopted by ONC in 2020, applies to three categories of
actors:
• Health care providers,
• Developers of certified health information technology (health IT), and
• Health information networks or health information exchanges.
18
Most licensed health care providers and health care practitioners in Florida fall within the rule’s
definition of a “health care provider.”
19
The rule prohibits these actors from engaging in practices that are “likely to interfere” with
access, exchange, or use of EHI, unless one of eight specified exceptions applies.
20
EHI is
defined to include all electronic protected health information (ePHI) that would be part of a
designated record set under HIPAA.
21
Examples of information blocking may include imposing
unnecessary delays, refusing to provide records in electronic format, charging unreasonable fees,
or using technology in a way that restricts access or interoperability.
Unlike HIPAA, which allows covered entities to respond to access requests within 30 calendar
days, the Information Blocking Rule requires that access to EHI be provided without
unreasonable delay, subject to specified exceptions where the EHI is protected.
22
These include
exceptions for preventing harm, protecting privacy, ensuring security, managing infeasible
requests, maintaining health IT performance, complying with licensing restrictions, and limiting
the manner of access.
23
Enforcement of the Information Blocking Rule is governed by 42 U.S.C. § 300jj-52(b). OIG may
impose civil monetary penalties of up to $1 million per violation on health IT developers and
health information networks or exchanges. While ONC and OIG have finalized enforcement
regulations for non-provider actors, enforcement policies for health care providers are still
forthcoming as of early 2025.
Interaction of the Information Blocking Rule with State Law
The federal law preempts state law only to the extent of a direct conflict.
15
U.S. Department of Health and Human Services, Office of the National Coordinator for Health Information Technology,
Information Blocking Overview, available at: https://www.healthit.gov/topic/information-blocking (last visited Mar. 22,
2025).
16
U.S. Department of Health and Human Services, Office of Inspector General, Information Blocking Enforcement, available
at: https://oig.hhs.gov/reports/featured/information-blocking/ (last visited Mar. 22, 2025).
17
45 C.F.R. Part 171.
18
45 C.F.R. § 171.102.
19
“Health care provider” for purposes of the Information Blocking Rule has the same meaning as “health care provider” in
42 U.S.C. § 300jj.
20
45 C.F.R. § 171.103.
21
See 45 C.F.R. § 171.102, referencing 45 C.F.R. § 164.501.
22
45 C.F.R. §§ 171.200–171.303.
23
Id. BILL: SB 1606 Page 5
“The information blocking provisions of the Cures Act establish a floor for permissible
practices and do not preempt State laws that are more stringent.”
— 85 Fed. Reg. 25810 (May 1, 2020).
The Information Blocking Rule does not prohibit state laws that impose stricter or faster access
obligations but does preempt state laws that would require or permit practices that interfere with
access to EHI in ways that federal law would otherwise prohibit.
The ONC has clarified that compliance with state law is not a defense to information blocking if
the delay or interference is not required by the state law. This is central to understanding how
federal and state requirements interact:
“The fact that an actor covered by the information blocking regulations meets its
obligations under another law applicable to them or its circumstances (such as the
maximum allowed time an actor has under that law to respond to a patient’s request) will
not automatically demonstrate that the actor’s practice does not implicate the
information blocking definition.”
— ONC Information Blocking FAQ.
24
This means that a state statute may impose a 14-day deadline, but if a provider routinely waits 14
days to respond when it could have provided access sooner, that practice may still constitute
information blocking.
Due to the many provider types affected by changes made by the bill, pertinent background
information regarding Florida law is provided within the Effect of Proposed Changes section of
this analysis for the reader’s convenience.
III. Effect of Proposed Changes:
Section 1 of the bill amends s. 394.4615, F.S., to require a mental health service provider
25
to
furnish copies of clinical records
26
within 14 working days of receiving a request, if:
• The patient or the patient’s guardian
27
or legal custodian authorizes the release;
24
U.S. Department of Health and Human Services, Office of the National Coordinator for Health Information Technology,
When a state or federal law or regulation (such as the HIPAA Privacy Rule) requires that EHI be released, is it ever
information blocking not to release it?, available at: https://www.healthit.gov/faq/when-state-or-federal-law-or-regulation-
such-hipaa-privacy-rule-requires-ehi-be-released-no (last visited Mar. 22, 2025).
25
“Service provider” means a receiving facility, a facility licensed under ch. 397, F.S., a treatment facility, an entity under
contract with the Department of Children and Families to provide mental health or substance abuse services, a community
mental health center or clinic, a psychologist, a clinical social worker, a marriage and family therapist, a mental health
counselor, a physician, a psychiatrist, an advanced practice registered nurse, a psychiatric nurse, or a qualified professional as
defined in s. 39.01, F.S. Section 394.455(45), F.S.
26
“Clinical record” means all parts of the record required to be maintained and includes all medical records, progress notes,
charts, and admission and discharge data, and all other information recorded by facility staff which pertains to the patient’s
hospitalization or treatment. Section 394.455(6), F.S.
27
“Guardian” means the natural guardian of a minor, or a person appointed by a court to act on behalf of a ward’s person if
the ward is a minor or has been adjudicated incapacitated. Section 394.455(18), F.S. BILL: SB 1606 Page 6
• The patient is represented by counsel and the records are needed by the patient’s counsel for
adequate representation; or
• The court orders the release.
Under the bill, a service provider may furnish the requested clinical records in paper form or,
upon request, in an electronic format. If the service provider maintains an electronic health
record system, the service provider must furnish the clinical records in the format chosen by the
requester, which must include electronic format, access through a web-based patient portal, or
submission through a patient’s electronic personal health record.
Section 2 of the bill amends s. 395.3025, F.S., to remove the requirement that licensed hospitals
and ambulatory surgical centers timely provide patient records only after a patient’s discharge,
thereby aligning state law with federal access rights under HIPAA.
Section 2 also changes the term “agency” (as in the Agency for Health Care Administration) to
“Department of Health” and “department” to clarify
28
and correct
29
that the DOH has the
authority to issue subpoenas for patient records from entities regulated under ch. 395, F.S., for
the purposes of investigating a health care practitioner.
To conform to changes made by the bill this section also deletes language requiring a licensed
hospital or ambulatory surgical center to allow a person to examine original records in its
possession, or microforms or other suitable reproductions of the records. The requirements in the
deleted text would instead be applied to licensed hospitals and ambulatory surgical centers in
s. 408.833, F.S., as created in section 5 of the bill, on lines 215-221.
As a federal condition of a hospital’s participation in Medicare or Medicaid, a hospital must
provide access to requested patient records “within a reasonable time frame” and to “seek to
fulfill requests as quickly as their recordkeeping system permits.”
30
This requirement exists in
conjunction with Florida law and would continue to apply under the bill.
Section 3 of the bill amends s. 397.501, F.S., to require substance abuse service providers to
furnish copies of records within 14 working days after receiving a written request from an
individual or the individual’s legal representative.
31
If the service provider maintains an electronic health record system, the service provider must
furnish the requested records in the format chosen by the requester, which must include
electronic format, access through a web-based patient portal, or submission through a patient’s
electronic personal health record.
28
Department of Health, Senate Bill 1606 Legislative Analysis (Mar. 20, 2025) (on file with the Senate Committee on Health
Policy).
29
Agency for Health Care Administration, Senate Bill 1606 Legislative Analysis (Mar. 19, 2025) (on file with the Senate
Committee on Health Policy).
30
See 42 CFR § 482.24(b)(3) and 42 C.F.R. § 482.13(d)(2).
31
For purposes of this section, the term “legal representative” has the same meaning as in s. 408.833(1), F.S., as created in
section 5 of the bill. BILL: SB 1606 Page 7
The service provider must, within 10 working days after receiving such a written request from an
individual or his or her legal representative, provide access to examine the original records in the
service provider’s possession, or microforms, or other suitable reproductions of the records. The
service provider may impose any reasonable terms necessary to ensure that the records will not
be damaged, destroyed, or altered.
Section 4 of the bill amends s. 400.145, F.S., to revise the timeframe within which nursing
home facilities must provide access to and copies of resident records upon written request.
32
Current law requires a nursing home facility to provide the requested records within 14 working
days after receiving a written request relating to current resident. Under the bill, for current
residents, access must be provided within 24 hours (excluding weekends and holidays), and
copies must be provided within two working days, of receipt of the written request. This change
would align Florida law with federal law for nursing home facilities that receive Medicare or
Medicaid funding.
33
For former residents, copies must be provided within 30 working days. The bill does not make
changes to the timeline for requests from former residents.
Section 5 of the bill creates s. 408.833, F.S., within the Health Care Licensing Procedures Act
34
to establish uniform standards for record access by clients
35
of health care providers,
36
including facilities, that are licensed, registered, or certified by the AHCA and not otherwise
addressed in statute. Records maintained by psychiatric hospitals, substance abuse treatment
providers, or nursing homes are exempt from this section pursuant to subsection (4).
The section defines the term “legal representative” as an attorney who has been designated by a
client to receive copies of the client’s medical, care and treatment, or interdisciplinary records; a
legally recognized guardian of the client; a court-appointed representative of the client; or a
person designated by the client or by a court of competent jurisdiction to receive copies of the
client’s medical, care and treatment, or interdisciplinary records.
The bill requires providers to furnish records within 14 working days after receiving a written
request from a client or his or her legal representative. A provider must furnish all records in the
32
Note that access to assisted living facility resident records is also governed by this section in current law. See changes
made to s. 429.294, F.S., in section 11 of the bill.
33
42 C.F.R. § 483.10(g)(2)(ii) requires Medicare- or Medicaid-certified long-term care facilities to provide residents or their
legal representatives the opportunity to inspect all records, including clinical records, within 24 hours (excluding weekends
and holidays) of an oral or written request.
34
Chapter 408, Part II, F.S. See also s. 408.801(1), F.S.
35
“Client” means any person receiving services from a provider listed in s. 408.802. Section 408.803(6), F.S.
36
The Act applies to all of the following facilities: Laboratories authorized to perform testing under the Drug-Free
Workplace Act; birth centers; abortion clinics; crisis stabilization units; short-term residential treatment facilities; residential
treatment facilities; residential treatment centers for children and adolescents; hospitals; ambulatory surgical centers; nursing
homes; assisted living facilities; home health agencies; nurse registries; companion services or homemaker services
providers; adult day care centers; hospices; adult family-care homes; homes for special services; transitional living facilities;
prescribed pediatric extended care centers; home medical equipment providers; intermediate care facilities for persons with
developmental disabilities; health care services pools; health care clinics; and organ, tissue, and eye procurement
organizations. Section 408.802, F.S. See also s. 408.803(12), F.S. BILL: SB 1606 Page 8
provider’s possession, including, but not limited to: medical, care and treatment, and
interdisciplinary records.
A provider may furnish the requested records in paper form or, upon request, in an electronic
format. If the health care practitioner maintains an electronic health record system, the service
provider must furnish the requested records in the format chosen by the requester, which must
include electronic format, access through a web-based patient portal, or submission through a
patient’s electronic personal health record.
The health care provider must, within 10 working days after receiving a request from an
individual or his or her legal representative, provide access to examine the original records in the
service provider’s possession, or microforms, or other suitable reproductions of the records. The
health care provider may impose any reasonable terms necessary to ensure that the records will
not be damaged, destroyed, or altered.
A hospice would be required to follow this section of law. However, pursuant to
s. 400.611(4), F.S., a hospice may not release a patient’s interdisciplinary record or any portion
of it, unless the person requesting the information provides a patient authorization or other
satisfactory documentation in compliance with that section.
Section 6 of the bill amends s. 456.057, F.S., to require any health care practitioner
37
licensed
by the DOH who is not exempt under subsection (2)
38
to furnish copies of requested records
within 14 working days after the request is received, rather than “in a timely manner, without
delays for legal review” as written in current law. This creates a specific timeframe in which
health care practitioners must remit the requested records to the patient or his or her legal
representative.
For health care practitioners, records include any report or record relating to examination or
treatment of the patient.
If the health care practitioner maintains an electronic health record system, the service provider
must furnish the requested records in the format chosen by the requester, which must include
electronic format, access through a web-based patient portal, or submission through a patient’s
electronic personal health record.
37
Acupuncturists; allopathic physicians, physician assistants, anesthesiologist assistants, and medical assistants; osteopathic
physicians, physician assistants, and anesthesiologist assistants; chiropractic physicians and physician assistants; podiatric
physicians; naturopathic physicians; optometrists; autonomous advanced practice registered nurses, advanced practice
registered nurses, registered nurses, licensed practical nurses, and certified nursing assistants; pharmacists, pharmacy interns,
and pharmacy technicians; dentists, dental hygienists, and dental laboratories; midwives; speech and language pathologists;
audiologists; occupational therapists and occupational therapy assistants; respiratory therapists; dieticians and nutritionists;
athletic trainers; orthotists, prosthetists, and pedorthists; electrologists; massage therapists; clinical laboratory personnel;
medical physicists; genetic counselors; opticians; hearing aid specialists; physical therapists; psychologists and school
psychologists; and clinical social workers, mental health counselors, and marriage and family therapists.
38
The following persons are not included for purposes of that section: certified nursing assistants, pharmacists and
pharmacies, dental hygienists, nursing home administrators, respiratory therapists, athletic trainers, electrologists, clinical
laboratory personnel, medical physicists, opticians and optical establishments, and persons or entities practicing under
s. 627.736(7), F.S. BILL: SB 1606 Page 9
The bill creates a definition for the term “legal representative” that is similar to the definition
created for health care providers earlier in the bill. Under the bill and for this section, “legal
representative” means a patient’s attorney who has been designated by the patient to receive
copies of the patient’s medical records, a legally recognized guardian of the patient, a court-
appointed representative of the patient, or any other person designated by the patient or by a
court of competent jurisdiction to receive copies of the patient’s medical records.
The health care practitioner provider must, within 10 working days after receiving a written
request from an individual or his or her legal representative, provide access to examine the
original records in the service provider’s possession, or microforms, or other suitable
reproductions of the records. The health care practitioner may impose any reasonable terms
necessary to ensure that the records will not be damaged, destroyed, or altered.
Section 10 of the bill amends s. 400.0234, F.S., to revise a cross-reference so that requests for
nursing home resident records are now governed by s. 408.833, F.S., as created in section 5 of
the bill, rather than s. 400.145, F.S., for certain purposes. See “Technical Deficiencies” section of
this analysis.
Section 11 of the bill amends s. 429.294, F.S., to conform a cross-reference to changes made in
the bill so that access to assisted living facility resident records is governed by s. 408.833, F.S.,
as created in section 5 of the bill, rather than s. 400.145, F.S.
Sections 7, 8, 9, 12, and 13 of the bill amend ss. 316.1932, 316.1933, 395.4025, 440.185, and
456.47, F.S., respectively to revise cross-references to conform to the renumbering of
subsections within s. 395.3025, F.S., in section 2 of the bill.
Section 14 of the bill provides an effective date of July 1, 2025.
IV. Constitutional Issues:
A. Municipality/County Mandates Restrictions:
None.
B. Public Records/Open Meetings Issues:
None.
C. Trust Funds Restrictions:
None.
D. State Tax or Fee Increases:
None. BILL: SB 1606 Page 10
E. Other Constitutional Issues:
While a 10- or 14-day deadline for responding to records requests is not necessarily in
conflict with the federal Information Blocking Rule, compliance with that statutory
deadline alone may not be enough to shield a provider from liability under federal law if
the delay is otherwise unreasonable.
V. Fiscal Impact Statement:
A. Tax/Fee Issues:
None.
B. Private Sector Impact:
None.
C. Government Sector Impact:
None.
VI. Technical Deficiencies:
On line 230 of the bill, records of a resident of a nursing home facility are expressly exempt from
the requirements governing client access to medical records that apply to other health care
providers. However, section 10 of the bill erroneously conforms a cross-reference to reflect
changes elsewhere in the bill, with the unintended effect of subjecting access to nursing home
facility records to the provisions of newly created section 408.833, F.S.—the very section from
which they are explicitly exempted. Because this section was mistakenly included, staff
recommends that an amendment be considered to delete section 10 of the bill.
VII. Related Issues:
Lines 154 and 205 respectively require that substance abuse service providers and health care
providers furnish a true and correct copy of all records in the possession of the provider rather
than a true and correct copy of all requested records in the possession of the provider. If this is
unintended, an amendment should be considered to add the word “requested” before “records.”
The bill also requires health care providers, health care practitioners, mental health service
providers, and substance abuse service providers that maintain an electronic health record system
to furnish clinical records in a format chosen by the requester. Formatting options must include
“electronic format, access through a web-based patient portal, or submission through a patient’s
electronic personal health record.” If a requester chooses an electronic file format that is contrary
to the manner in which the provider maintains the files, this formatting requirement may be
unnecessarily burdensome on the provider or practitioner. It is unclear if the bill as written
intends to limit the formatting options to these three options. BILL: SB 1606 Page 11
VIII. Statutes Affected:
This bill substantially amends the following sections of the Florida Statutes: 394.4615,
395.3025, 397.501, 400.145, 456.057, 316.1932, 316.1933, 395.4025, 400.0234, 429.294,
440.185, and 456.47.
This bill creates section 408.833 of the Florida Statutes.
IX. Additional Information:
A. Committee Substitute – Statement of Changes:
(Summarizing differences between the Committee Substitute and the prior version of the bill.)
None.
B. Amendments:
None.
This Senate Bill Analysis does not reflect the intent or official position of the bill’s introducer or the Florida Senate.