The Florida Senate
BILL ANALYSIS AND FISCAL IMPACT STATEMENT
(This document is based on the provisions contained in the legislation as of the latest date listed below.)
Prepared By: The Professional Staff of the Committee on Rules
BILL: CS/CS/SB 1606
INTRODUCER: Rules Committee; Health Policy Committee; Senators Grall and Bradley
SUBJECT: Patient Access to Records
DATE: April 23, 2025
ANALYST STAFF DIRECTOR REFERENCE ACTION
1. Smith Brown HP Fav/CS
2. Gerbrandt McKnight AHS Favorable
3. Smith Yeatman RC Fav/CS
Please see Section IX. for Additional Information:
COMMITTEE SUBSTITUTE - Substantial Changes
I. Summary:
CS/CS/SB 1606 standardizes timeframes and procedures for responding to health record requests
made by patients and their legal representatives. Current Florida law generally requires hospitals,
ambulatory surgical centers, and health care practitioners to provide requested health records in a
“timely” manner. In the absence of specific statutory deadlines, the federal Health Insurance
Portability and Accountability Act (HIPAA) imposes a 30-calendar-day standard. For electronic
health information, the federal Information Blocking Rule also applies, requiring access without
unreasonable delay.
The bill creates s. 408.833, F.S., within the Health Care Licensing Procedures Act, to establish
uniform standards for record access and delivery by health care providers (including facilities)
that are licensed, registered, or certified by the Agency for Health Care Administration (AHCA),
unless otherwise governed by specific statutes. It also amends s. 456.057, F.S., to apply these
standards to licensed health care practitioners regulated by the Department of Health (DOH).
Specifically:
• A health care practitioner or provider must furnish requested records within a patient’s
designated record set within 14 business days of receiving a written request from a patient or
his or her legal representative. The bill defines “designated record set,” consistent with
federal HIPAA, as a group of records used to make decisions about an individual’s health
care, coverage, or benefits.
REVISED: BILL: CS/CS/SB 1606 Page 2
• Additional records requested by the patient or his or her legal representative, including
medical records, care and treatment records, and interdisciplinary records, must be furnished
within 28 business days.
• The provider or practitioner may extend these timeframes by up to 14 additional business
days if the requester is notified in writing within the initial 14-day period and is provided
with a new delivery date.
• A health care practitioner or provider must allow the patient or his or her legal representative
access to inspect original records, or suitable reproductions such as microforms, within 10
business days of receiving a written request. Reasonable conditions may be imposed to
protect the integrity of the records.
• Requested records must be provided in the form and format specified by the requester if
readily producible. If not, the records must be furnished in another agreed-upon electronic
format or in a readable hard copy. Permissible forms of access include, but are not limited to,
secure web portals, email, physical media such as discs or USB drives, mail, or printed paper.
The bill also amends:
• s. 394.4615, F.S., to require mental health service providers to furnish clinical records within
the same standardized timeframes, when authorized by the patient or guardian, required by
legal representation, or ordered by a court.
• s. 397.501, F.S., to require substance abuse service providers to furnish individual records
within the same timeframes and to allow inspection access within 10 business days.
• s. 400.145, F.S., to align nursing home record access requirements with federal Medicare and
Medicaid Conditions of Participation. Under the bill, access to current resident records must
be provided within 24 hours (excluding weekends and holidays), and copies must be
furnished within two business days. The 30-business-day deadline for former resident records
remains unchanged.
The bill has no fiscal impact on state expenditures or revenues. See Section V., Fiscal Impact
Statement.
The bill provides an effective date of January 1, 2026.
II. Present Situation:
Federal Right of Access to Records Under HIPAA
The federal Health Insurance Portability and Accountability Act (HIPAA) establishes national
standards for the protection of individually identifiable health information. The HIPAA Privacy
Rule
1
, implements these protections and sets forth the individual right of access to medical
records.
2
The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) is
responsible for implementing and enforcing the HIPAA Privacy Rule.
3
1
45 C.F.R. Part 160 and Subparts A and E of Part 164.
2
45 C.F.R. § 164.524.
3
U.S. Department of Health and Human Services, Office for Civil Rights, Summary of the HIPAA Privacy Rule, available at:
https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html (last visited Mar. 22, 2025). BILL: CS/CS/SB 1606 Page 3
Under the HIPPA Privacy Rule, individuals have the right to inspect or obtain a copy of their
protected health information (PHI) maintained by a covered entity. Covered entities include:
• Health care providers who transmit health information electronically in connection with
certain administrative transactions,
• Health plans such as insurers and health maintenance organizations (HMOs), and
• Health care clearinghouses.
4
Most licensed health care providers and health care practitioners in Florida qualify as covered
entities under these definitions. Business associates of covered entities, such as third-party billing
companies or cloud storage providers, must also comply with HIPAA’s access provisions when
they handle protected health information on behalf of the covered entity.
5
The HIPPA Privacy Rule requires covered entities to provide access to PHI contained in what is
known as a designated record set. A designated record set is defined
6
as a group of records
maintained by or for a covered entity that is used, in whole or in part, to make decisions about
individuals. These records include:
• Medical and billing records maintained by or for a health care provider,
• Enrollment, payment, claims adjudication, and case or medical management records
maintained by or for a health plan, and
• Any other records used to make decisions about the individual.
7
Records not used to make treatment or coverage decisions—such as peer review files or internal
administrative documents—are not considered to be included in the designated record set.
The Privacy Rule requires covered entities to respond to a request for access within 30 calendar
days.
8
One 30-day extension is permitted if the individual is notified in writing of the delay and
the expected response date.
9
If PHI is maintained electronically, and the individual requests an
electronic copy, the entity must provide it in the requested form and format if it is readily
producible.
10
Covered entities may charge only a reasonable, cost-based fee for access. This fee may include
the cost of labor for copying, supplies, and postage, if applicable, but may not include retrieval
fees or other administrative charges.
11
In guidance issued by the OCR, covered entities are
4
45 C.F.R. § 160.103.
5
45 C.F.R. §§ 160.103, 164.502(e).
6
45 C.F.R. § 164.501.
7
45 C.F.R. § 164.501.
8
The OCR has recently considered reducing this time frame to 15 days in a proposed rule modification, but the rule was not
finalized. U.S. Department of Health and Human Services, Modifications to the HIPAA Privacy Rule to Support, and Remove
Barriers to, Coordinated Care and Individual Engagement, 86 Fed. Reg. 6446 (Jan. 21, 2021), available at
https://www.govinfo.gov/content/pkg/FR-2021-01-21/pdf/2020-27157.pdf.
9
45 C.F.R. § 164.524(b)(2).
10
45 C.F.R. § 164.524(c)(2).
11
45 C.F.R. § 164.524(c)(4). BILL: CS/CS/SB 1606 Page 4
prohibited from imposing barriers to access, such as requiring patients to submit requests in
person or through proprietary forms when such requirements are not necessary.
12
Interaction of HIPAA with State Law
13
HIPAA establishes a national baseline for the privacy and security of health information but
permits states to enact laws that provide greater protections or access rights. A state law is only
preempted by HIPAA if it is contrary to HIPAA—that is, if it is impossible to comply with both
the state and federal requirements, or if the state law stands as an obstacle to the full purposes
and objectives of HIPAA.
However, if a state law is more protective of patient privacy or provides greater access to health
information than HIPAA, it is not preempted and remains enforceable. In practice, this means
states may adopt laws that expand individual rights of access, shorten response times, or add
safeguards, so long as they do not authorize disclosures or impose barriers that conflict with
HIPAA’s requirements.
Federal Information Blocking Prohibition
The 21st Century Cures Act
14
prohibits certain actors from engaging in “information blocking,”
which is broadly defined as any practice that is likely to interfere with access, exchange, or use
of electronic health information (EHI), unless the practice is required by law or covered by a
regulatory exception.
15
The Office of the National Coordinator for Health Information
Technology (ONC) is responsible for implementing the rule,
16
and the U.S. Department of
Health and Human Services Office of Inspector General (OIG) is charged with enforcement.
17
The federal Information Blocking Rule
18
, adopted by ONC in 2020, applies to three categories of
actors:
• Health care providers,
• Developers of certified health information technology (health information technology), and
• Health information networks or health information exchanges.
19
12
U.S. Department of Health and Human Services, Office for Civil Rights, Individuals’ Right under HIPAA to Access their
Health Information 45 CFR § 164.524, available at: https://www.hhs.gov/hipaa/for-
professionals/privacy/guidance/access/index.html (last visited Mar. 22, 2025).
13
U.S. Department of Health and Human Services, Office of the National Coordinator for Health Information Technology,
When a state or federal law or regulation (such as the HIPAA Privacy Rule) requires that EHI be released, is it ever
information blocking not to release it?, available at: https://www.healthit.gov/faq/when-state-or-federal-law-or-regulation-
such-hipaa-privacy-rule-requires-ehi-be-released-no (last visited Mar. 22, 2025).
14
Pub. L. No. 114-255.
15
42 U.S.C. § 300jj-52.
16
U.S. Department of Health and Human Services, Office of the National Coordinator for Health Information Technology,
Information Blocking Overview, available at: https://www.healthit.gov/topic/information-blocking (last visited
Mar. 22, 2025).
17
U.S. Department of Health and Human Services, Office of Inspector General, Information Blocking Enforcement, available
at: https://oig.hhs.gov/reports/featured/information-blocking/ (last visited Mar. 22, 2025).
18
45 C.F.R. Part 171.
19
45 C.F.R. § 171.102. BILL: CS/CS/SB 1606 Page 5
Most licensed health care providers and health care practitioners in Florida fall within the rule’s
definition of a “health care provider.”
20
The rule prohibits these actors from engaging in practices that are “likely to interfere” with
access, exchange, or use of EHI, unless one of eight specified exceptions applies.
21
EHI is
defined to include all electronic protected health information (ePHI) that would be part of a
designated record set under HIPAA.
22
Examples of information blocking may include imposing
unnecessary delays, refusing to provide records in electronic format, charging unreasonable fees,
or using technology in a way that restricts access or interoperability.
Unlike HIPAA, which allows covered entities to respond to access requests within 30 calendar
days, the Information Blocking Rule requires that access to EHI be provided without
unreasonable delay, subject to specified exceptions where the EHI is protected.
23
These include
exceptions for preventing harm, protecting privacy, ensuring security, managing infeasible
requests, maintaining health information technology performance, complying with licensing
restrictions, and limiting the manner of access.
24
Enforcement of the Information Blocking Rule is governed by 42 U.S.C. § 300jj-52(b). The OIG
may impose civil monetary penalties of up to $1 million per violation on health IT developers
and health information networks or exchanges. While ONC and OIG have finalized enforcement
regulations for non-provider actors, enforcement policies for health care providers are still
forthcoming as of early 2025.
Interaction of the Information Blocking Rule with State Law
The federal law preempts state law only to the extent of a direct conflict.
“The information blocking provisions of the Cures Act establish a floor for permissible
practices and do not preempt State laws that are more stringent.”
— 85 Fed. Reg. 25810 (May 1, 2020).
The Information Blocking Rule does not prohibit state laws that impose stricter or faster access
obligations but does preempt state laws that would require or permit practices that interfere with
access to EHI in ways that federal law would otherwise prohibit.
The ONC has clarified that compliance with state law is not a defense to information blocking if
the delay or interference is not required by the state law. This is central to understanding how
federal and state requirements interact:
“The fact that an actor covered by the information blocking regulations meets its
obligations under another law applicable to them or its circumstances (such as the
20
“Health care provider” for purposes of the Information Blocking Rule has the same meaning as “health care provider” in
42 U.S.C. § 300jj.
21
45 C.F.R. § 171.103.
22
See 45 C.F.R. § 171.102, referencing 45 C.F.R. § 164.501.
23
45 C.F.R. §§ 171.200–171.303.
24
45 C.F.R. §§ 171.200–171.303. BILL: CS/CS/SB 1606 Page 6
maximum allowed time an actor has under that law to respond to a patient’s request) will
not automatically demonstrate that the actor’s practice does not implicate the
information blocking definition.”
— ONC Information Blocking FAQ.
25
This means that a state statute may impose a 14-day deadline, but if a provider routinely waits 14
days to respond when it could have provided access sooner, that practice may still constitute
information blocking.
Due to the many provider types affected by changes made by the bill, pertinent background
information regarding Florida law is provided within the Effect of Proposed Changes section of
this analysis for the reader’s convenience.
III. Effect of Proposed Changes:
Section 1 amends s. 394.4615, F.S., to require a mental health service provider
26
to furnish
copies of clinical records
27
within 14 business days of receiving a request, if:
• The patient or the patient’s guardian
28
or legal custodian authorizes the release;
• The patient is represented by counsel and the records are needed by the patient’s counsel for
adequate representation; or
• The court orders the release.
A service provider may extend the timeframe for furnishing requested clinical records by up to
14 additional business days if the provider notifies the requester of the delay in writing within the
first 14 business days after receiving the request and provides the expected date when the records
will be made available, which must be no later than 14 business days after the original deadline
for providing the records.
Records must be provided in the form and format requested by the requester if the records are
readily producible in that form and format. If not readily producible, the service provider must
furnish the records in another electronic format agreed upon by the requester and provider, or in
a readable hard copy format. Permissible forms of access include, but are not limited to, a web-
based application or patient portal, secure download, electronic copy by email, physical media
such as a disc or USB drive, United States mail, or printed paper records.
25
U.S. Department of Health and Human Services, Office of the National Coordinator for Health Information Technology,
When a state or federal law or regulation (such as the HIPAA Privacy Rule) requires that EHI be released, is it ever
information blocking not to release it?, available at: https://www.healthit.gov/faq/when-state-or-federal-law-or-regulation-
such-hipaa-privacy-rule-requires-ehi-be-released-no (last visited Mar. 22, 2025).
26
“Service provider” means a receiving facility, a facility licensed under ch. 397, F.S., a treatment facility, an entity under
contract with the Department of Children and Families to provide mental health or substance abuse services, a community
mental health center or clinic, a psychologist, a clinical social worker, a marriage and family therapist, a mental health
counselor, a physician, a psychiatrist, an advanced practice registered nurse, a psychiatric nurse, or a qualified professional as
defined in s. 39.01, F.S. Section 394.455(45), F.S.
27
“Clinical record” means all parts of the record required to be maintained and includes all medical records, progress notes,
charts, and admission and discharge data, and all other information recorded by facility staff which pertains to the patient’s
hospitalization or treatment. Section 394.455(6), F.S.
28
“Guardian” means the natural guardian of a minor, or a person appointed by a court to act on behalf of a ward’s person if
the ward is a minor or has been adjudicated incapacitated. Section 394.455(18), F.S. BILL: CS/CS/SB 1606 Page 7
Section 2 amends s. 395.3025, F.S., to remove the requirement that licensed hospitals and
ambulatory surgical centers timely provide patient records only after a patient’s discharge,
thereby aligning state law with federal access rights under HIPAA.
The bill changes the term “agency” (as in the Agency for Health Care Administration) to
“Department of Health” (DOH) and “department” to clarify
29
and correct
30
that the DOH has the
authority to issue subpoenas for patient records from entities regulated under ch. 395, F.S., for
the purposes of investigating a health care practitioner.
To conform to changes made by the bill, this section also deletes language requiring a licensed
hospital or ambulatory surgical center to allow a person to examine original records in its
possession, or microforms or other suitable reproductions of the records. The requirements in the
deleted text would instead be applied to licensed hospitals and ambulatory surgical centers in
s. 408.833, F.S., as created in section 6 of the bill.
As a federal condition of a hospital’s participation in Medicare or Medicaid, a hospital must
provide access to requested patient records “within a reasonable time frame” and to “seek to
fulfill requests as quickly as their recordkeeping system permits.”
31
This requirement exists in
conjunction with Florida law and would continue to apply under the bill.
Section 3 amends s. 397.501, F.S., to require substance abuse service providers to furnish
copies of individual records within 14 business days after receiving a written request from an
individual or the individual’s legal representative, as that term is defined in
s. 456.057(6)(a), F.S., as amended in section 7 of the bill.
32
A service provider may extend the
timeframe for furnishing records by up to 14 additional business days if the requester is notified
in writing within the initial 14 business days and is provided with an expected date of
availability. The records must be made available no later than 14 business days after the original
deadline.
Records must be provided in the form and format requested by the individual or legal
representative if the records are readily producible in that form and format. If not readily
producible, the provider must furnish the records in another electronic format agreed upon by the
requester and provider, or in a readable hard copy format. Permissible forms of access include,
but are not limited to, a web-based application or patient portal, secure download, electronic
copy by email, physical media such as a disc or USB drive, United States mail, or printed paper
records.
The service provider must, within 10 business days after receiving such a written request from an
individual or his or her legal representative, provide access to examine the original records in the
29
Department of Health, Senate Bill 1606 Legislative Analysis (Mar. 20, 2025) (on file with the Senate Committee on Health
Policy).
30
Agency for Health Care Administration, Senate Bill 1606 Legislative Analysis (Mar. 19, 2025) (on file with the Senate
Committee on Health Policy).
31
See 42 CFR § 482.24(b)(3) and 42 C.F.R. § 482.13(d)(2).
32
For purposes of this section, the term “legal representative” has the same meaning as in s. 456.057(6)(a), F.S., as defined in
section 6 of the bill. BILL: CS/CS/SB 1606 Page 8
service provider’s possession, or microforms, or other suitable reproductions of the records. The
provider may impose reasonable conditions to ensure that the records are not damaged,
destroyed, or altered.
Section 4 amends s. 400.145, F.S., to revise the timeframe within which nursing home facilities
must provide access to and copies of resident records upon written request.
33
Current law
requires a nursing home facility to provide the requested records within 14 working days after
receiving a written request relating to a current resident. Under the bill, for current residents,
access must be provided within 24 hours (excluding weekends and holidays), and copies must be
provided within two business days, of receipt of the written request. This change would align
Florida law with federal law for nursing home facilities that receive Medicare or Medicaid
funding.
34
For former residents, copies must be provided within 30 business days. The bill does not make
changes to the timeline for requests from former residents.
Section 5 republishes s. 408.803(6), F.S., the existing definition of the term “client” for purposes
of the Health Care Licensing Procedures Act, which includes s. 408.833, F.S., as created in
section 6 of the bill. The term “client” means any person receiving services from a provider
listed in s. 408.802, F.S.
35
Section 6 creates s. 408.833, F.S., within the Health Care Licensing Procedures Act,
36
to
establish uniform standards for record access by clients of health care providers,
37
including
facilities, that are licensed, registered, or certified by the Agency for Healthcare Administration
(AHCA) and not otherwise addressed in statute. Records maintained by psychiatric hospitals,
substance abuse treatment providers, or nursing homes are exempt from this section under the
bill.
The bill defines the term “designated record set” consistent with the term’s usage under federal
HIPAA regulations. The term refers to a group of records maintained by or for a provider that
includes medical and billing records about a client and other records used, in whole or in part, to
make decisions about the client’s care, coverage, or benefits.
33
Note that access to assisted living facility resident records is also governed by this section in current law. See changes
made to s. 429.294, F.S., in section 11 of the bill.
34
42 C.F.R. § 483.10(g)(2)(ii) requires Medicare- or Medicaid-certified long-term care facilities to provide residents or their
legal representatives the opportunity to inspect all records, including clinical records, within 24 hours (excluding weekends
and holidays) of an oral or written request.
35
See note 37.
36
Chapter 408, Part II, F.S. See also s. 408.801(1), F.S.
37
The Act applies to all of the following facilities: Laboratories authorized to perform testing under the Drug-Free
Workplace Act; birth centers; abortion clinics; crisis stabilization units; short-term residential treatment facilities; residential
treatment facilities; residential treatment centers for children and adolescents; hospitals; ambulatory surgical centers; nursing
homes; assisted living facilities; home health agencies; nurse registries; companion services or homemaker services
providers; adult day care centers; hospices; adult family-care homes; homes for special services; transitional living facilities;
prescribed pediatric extended care centers; home medical equipment providers; intermediate care facilities for persons with
developmental disabilities; health care services pools; health care clinics; and organ, tissue, and eye procurement
organizations. Section 408.802, F.S. See also s. 408.803(12), F.S. BILL: CS/CS/SB 1606 Page 9
The bill defines the term “legal representative” to mean:
• A legally recognized guardian of the client;
• A court-appointed representative of the client;
• A person designated by the client or by a court of competent jurisdiction to receive copies of
the client’s medical records, care and treatment records, or interdisciplinary records; or
• An attorney who has been designated by a client to receive copies of the client’s medical
records, care and treatment records, or interdisciplinary records.
Under the bill, a provider must furnish records from the designated record set within 14 business
days after receiving a written request from the client or the client’s legal representative. If
additional records, including medical records, care and treatment records, and interdisciplinary
records, are requested, the provider must provide them within 28 business days. The provider
may extend the timeframe for furnishing records by up to 14 additional business days if the
provider notifies the client or legal representative in writing within the initial 14 business days
and provides the expected date of availability. The records must be made available no later than
14 business days after the original deadline.
A provider must allow access for the inspection of original records, or suitable reproductions
such as microforms, within 10 business days of receiving a request. Providers may impose
reasonable conditions to protect the integrity of the records.
Requested records must be furnished in the form and format specified by the client or legal
representative if the records are readily producible in that form and format. If not, the provider
must furnish the records in another electronic format agreed upon by the requester and provider,
or in a readable hard copy format. Permissible forms of access include, but are not limited to, a
web-based application or patient portal, secure download, electronic copy by email, physical
media such as a disc or USB drive, United States mail, or printed paper records.
A hospice would be required to follow this section of law. However, pursuant to
s. 400.611(4), F.S., a hospice may not release a patient’s interdisciplinary record or any portion
of it, unless the person requesting the information provides a patient authorization or other
satisfactory documentation in compliance with that section.
Section 7 amends s. 456.057, F.S., to require a health care practitioner
38
licensed by the DOH
who is not exempt
39
to furnish copies of requested records within specific timeframes after
38
Acupuncturists; allopathic physicians, physician assistants, anesthesiologist assistants, and medical assistants; osteopathic
physicians, physician assistants, and anesthesiologist assistants; chiropractic physicians and physician assistants; podiatric
physicians; naturopathic physicians; optometrists; autonomous advanced practice registered nurses, advanced practice
registered nurses, registered nurses, licensed practical nurses, and certified nursing assistants; pharmacists, pharmacy interns,
and pharmacy technicians; dentists, dental hygienists, and dental laboratories; midwives; speech and language pathologists;
audiologists; occupational therapists and occupational therapy assistants; respiratory therapists; dieticians and nutritionists;
athletic trainers; orthotists, prosthetists, and pedorthists; electrologists; massage therapists; clinical laboratory personnel;
medical physicists; genetic counselors; opticians; hearing aid specialists; physical therapists; psychologists and school
psychologists; and clinical social workers, mental health counselors, and marriage and family therapists.
39
Section 456.057(2), F.S., exempts the following persons: certified nursing assistants, pharmacists and pharmacies, dental
hygienists, nursing home administrators, respiratory therapists, athletic trainers, electrologists, clinical laboratory personnel,
medical physicists, opticians and optical establishments, and persons or entities practicing under s. 627.736(7), F.S. BILL: CS/CS/SB 1606 Page 10
receiving a written request from a patient or his or her legal representative. This replaces the
current requirement to provide records “in a timely manner, without delays for legal review.”
The bill defines the term “designated record set” consistent with its usage in federal HIPAA
regulations. The term refers to a group of records maintained by or for the health care
practitioner that includes medical and billing records about a patient and other records used, in
whole or in part, to make decisions about the patient’s care, coverage, or benefits.
The bill also defines the term “legal representative” to mean:
• A legally recognized guardian of the patient;
• A court-appointed representative of the patient;
• A person designated by the patient or by a court of competent jurisdiction to receive copies
of the patient’s medical records, care and treatment records, or interdisciplinary records; or
• An attorney who has been designated by a patient to receive copies of the patient’s medical
records, care and treatment records, or interdisciplinary records.
Under the bill, a health care practitioner must furnish requested records from the designated
record set within 14 business days after receiving a written request. If additional records,
including medical records, care and treatment records, and interdisciplinary records, are
requested, the practitioner must provide them within 28 business days. The practitioner may
extend the timeframe for furnishing records up to 14 additional business days if the requester is
notified in writing within the initial 14 business days and is provided with a new deadline, which
must be no later than 14 business days after the original due date.
The bill also requires health care practitioners to allow inspection of original records, or suitable
reproductions such as microforms, within 10 business days of receiving a request. Practitioners
may impose reasonable conditions to safeguard the integrity of the records.
Requested records must be furnished in the form and format requested by the patient or legal
representative if they are readily producible in that format. If not, the practitioner must provide
the records in another electronic format agreed upon by the requester and the practitioner, or in a
readable hard copy format. Permissible forms of access include, but are not limited to, web-
based applications or patient portals, secure downloads, electronic copies via email, physical
media such as discs or USB drives, U.S. mail, or printed paper records.
Sections 8, 9, 10, 13, and 14 of amend ss. 316.1932, 316.1933, 395.4025, 440.185, and
456.47, F.S., respectively, to revise cross-references to conform to the renumbering of
subsections within s. 395.3025, F.S., in section 2 of the bill.
Section 11 amends s. 397.702, F.S., to revise a cross-reference to conform to the renumbering of
subsections within s. 397.501, F.S., in section 3 of the bill.
Section 12 amends s. 429.294, F.S., to conform a cross-reference to changes made in the bill so
that access to assisted living facility resident records is governed by s. 408.833, F.S., as created
in section 6 of the bill, rather than s. 400.145, F.S.
Section 15 provides an effective date of January 1, 2026. BILL: CS/CS/SB 1606 Page 11
IV. Constitutional Issues:
A. Municipality/County Mandates Restrictions:
None.
B. Public Records/Open Meetings Issues:
None.
C. Trust Funds Restrictions:
None.
D. State Tax or Fee Increases:
None.
E. Other Constitutional Issues:
While a 14-day deadline for responding to records requests is not in conflict with the
federal Information Blocking Rule, compliance with that statutory deadline alone may
not be enough to shield a provider from liability under federal law if a delay is otherwise
unreasonable.
V. Fiscal Impact Statement:
A. Tax/Fee Issues:
None.
B. Private Sector Impact:
None.
C. Government Sector Impact:
The bill has no impact on state expenditures or revenues.
VI. Technical Deficiencies:
None.
VII. Related Issues:
None. BILL: CS/CS/SB 1606 Page 12
VIII. Statutes Affected:
This bill substantially amends the following sections of the Florida Statutes: 316.1932, 316.1933,
394.4615, 395.3025, 395.4025, 397.501, 397.702, 400.145, 429.294, 440.185, 456.047, and
456.057.
This bill creates section 408.833 of the Florida Statutes.
IX. Additional Information:
A. Committee Substitute – Statement of Substantial Changes:
(Summarizing differences between the Committee Substitute and the prior version of the bill.)
CS/CS by Rules on April 21, 2025:
The committee substitute defines the term “designated record set,” consistent with federal
HIPAA, to mean a group of records used to make decisions regarding a patient’s health
care, coverage, or benefits. Under the amendment, specified health care practitioners and
providers must furnish records requested by a patient or his or her legal representative
within the designated record set within 14 business days of a request. A health care
practitioner or provider must furnish additional requested records, including medical
records, care and treatment records, and interdisciplinary records, requested by a patient
or his or her legal representative within 28 business days of a request. A health care
practitioner or provider may extend the time for furnishing requested records by up to 14
additional business days. The amendment requires records to be provided in the form and
format requested by the patient or legal representative if the requested records are readily
producible in that form and format. If not readily producible, the health care practitioner
or provider must produce the records in another electronic form and format agreed to by
the requester and the practitioner or in a readable hard copy format. Forms of access to
records may include, but are not limited to: patient portals, secure downloads, emails, on
CDs, or USBs, US mail, or printed paper records.
CS by Health Policy on March 25, 2025:
The CS revises the requirement for health care providers and practitioners furnishing
records pursuant to a request in the manner chosen by the requester. Under the CS, this
includes, but is not limited to, an electronic format, submission through a patient's
electronic personal health record, or access through a web-based patient portal if the
provider maintains a patient portal. This clarifies that providers and practitioners that do
not maintain a patient portal are not required to implement a patient portal to comply with
the requirements of the bill.
The CS deletes a cross-reference within s. 400.0234, F.S., which was mistakenly included
in the underlying bill. The CS also changes the effective date of the bill from
July 1, 2025, to January 1, 2026. BILL: CS/CS/SB 1606 Page 13
B. Amendments:
None.
This Senate Bill Analysis does not reflect the intent or official position of the bill’s introducer or the Florida Senate.