F.S.A. § 456.057

Ownership and control of patient records; report or copies of records to be furnished

 This section refers to “record owners” as any health care practitioner who creates a medical record after a patient encounter or any health care practitioner to whom patient records have been transferred, or any health care practitioner’s employer, including group practices or staff model HMOs, as long as the employer is designated as the record owner in the contract.  However, records owner or health care practitioner do not include the following:

• Certified nursing assistants;
• Pharmacists and pharmacies;
• Dental hygienists;
• Nursing home administrators;
• Respiratory therapists;
• Athletic trainers;
• Electrologists;
• Clinical laboratory personnel;
• Medical physicists;
• Opticians and optical establishments;
• Persons or entities providing medical examinations for insurance companies.

Under this section, health care practitioners who are record owners must maintain records consistent with the relevant confidentiality and disclosure provisions.  Health care practitioners must furnish copies of a patient’s medical record in a timely manner when requested.  However, providers of psychological or psychiatric services may provide a report in lieu of a copy of the record to a patient.  Copies of such records must be provided to a subsequent treating physician upon a patient’s written request.  The provision of record copies must not be based on the payment of fees for services rendered.  A health care practitioner may charge cost based fees for copying the medical record.

Except where otherwise allowed, records may not be provided to, or medical prognosis discussed with any other person other than the patient or patient’s representative or other health care providers involved in the patient’s treatment, unless the patient signs a written authorization for disclosure.  Employers of health care practitioners may release to the provider, medical records that the provider created, and are only notes, plan of care, and summaries, upon written request.  However, records may be provided without written authorization in the following situations:

• To a person or entity that has the patient’s consent;
• A required physician examination under the Rules of Evidence, the copies may be sent to the defendant and plaintiff;
• In a civil or criminal action, unless otherwise prohibited by law and upon the issuance of a subpoena;
• For statistical or scientific research provided that the information is abstracted and the patient is de-identified;
• To a regional poison control center for treatment or case management or data collection;

If a patient has not explicitly authorized the use of his or her medical information for marketing or solicitation purposes, it is prohibited. 

Information disclosed by a patient to a provider is confidential, and may only be disclosed to other treating providers, if permitted by a written authorization, or pursuant to a subpoena or court order.  The information may be used however, in a medical malpractice case where the provider is named as a defendant. 

The Department of Health may obtain patient records, billing records and insurance information pursuant to a subpoena without a patient’s written authorization if the Department reasonably believes there are fraudulent claims, excess payments, upcoding, or other instances of fraud and abuse.  If the Department is investigating professional liability claim, and the patient refuses to cooperate a written authorization is not feasible, and the patient records are necessary for the investigation, the Department may continue without the authorization with a valid subpoena.  All patient identifiable  records obtained by the Department are confidential.  All patient records billing records and other information obtained by the Department may only be used by the Department or the professional regulatory board for provider disciplinary actions.  The records may not be available for public inspection for public disciplinary hearings or sanctions.  However, this law does not limit the use of the psychotherapist-patient privilege, but allows a provider to release medical records even if he or she has treated the patient for mental disorders.  All records obtained by the Department relating to a current or former Medicaid recipient  must be turned over to the Medicaid Fraud Control Unit upon request. 

All record owners must maintain policies and procedures to ensure the confidentiality and security of patient medical records, and must train employees on these policies.  Record owners must maintain a record of disclosures of information contained in a medical record to a third party, which must be maintained in the record.  The third party is prohibited from further disclosing the information without the patient’s express informed consent. 

Record owners must place a notice in the newspaper when they retire, relocate, terminate their practice or are otherwise unavailable to patients, and give patients the ability to obtain a copy of the record.  Similarly, record owners must notify the appropriate licensing board when they retire, relocate, or terminate the practice, and must identify the new record owner and where the medical records will be located.  Once the record owner has turned over the records to a new record owner, the new owner is responsible for providing copies and access to patient medical records.  The Department of Health may appoint a record custodian temporarily in the event of the death of a practitioner, the mental or physical incapacitation of the practitioner, or abandonment of records by the practitioner.  The custodian is subject to the provision of this section, including medical record access provisions. 

Licensed providers who violate this section may be subject to disciplinary action by the appropriate licensing authority.  The Attorney General may enforce this section on record owners not otherwise licensed by the state through injunctive action and fines of $5,000 maximum per violation.