Effective July 1, Florida Law Changes Set Limits on Storage of Patient Information and Maintaining Relationships with Foreign Countries of Concern

Effective July 1, most health care providers utilizing certified electronic health record technology (“EHRs”) in Florida will need to ensure that “all patient information” is physically maintained in the continental U.S., its territories, or Canada.  Other changes require certain licensees to ensure that no individual holding a controlling interest in the provider has a “business relationship” with a foreign country of concern.

New Data Storage Limits for Providers

Florida Senate Bill 264 (2023) amends the Florida Electronic Health Records Exchange Act (codified at Fla. Stat. § 408.051) to add a new requirement for providers who use a certified Electronic Health Record (“EHR”) to ensure all patient information, whether stored in an offsite physical location or virtually in the cloud, remains in the U.S., its territories, or Canada. See Fla. Stat.  § 408.051(3).  The term “provider” is defined broadly under the new statutory language to include individual practitioners as well as licensed facilities. While the new data storage requirements apply to those providers using certified EHRs, since most providers are using certified EHRs at this point and the requirements apply to “all patient information,” the limitations appear to expand beyond patient information maintained in EHR.  As a result, providers in Florida should take steps to ensure all patient information is maintained in the U.S. or Canada, including patient information that is accessed or maintained by health IT vendors (whether by cloud or otherwise).   

Florida Statutes § 408.810 is also amended to include new minimum licensure requirements for providers licensed through the Florida Agency for Health Care Administration (“AHCA”), including a requirement that licensees attest under penalty of perjury that they are in compliance with these new data storage requirements.  Based on the language of the statute, this attestation will be a new requirement at the time of initial application for a license and thereafter upon renewal. See Fla. Stat. § 408.810(14).  Failure to remain in compliance can result in disciplinary action.   

Since these new data storage requirements under Florida law are more restrictive than, and in addition to, the requirements that apply under the Health Insurance and Portability Act of 1996 (“HIPAA”), providers should be reviewing their current practices and vendor relationships to ensure compliance.

Other Changes Impacting Health Care Providers in Florida

Florida Senate Bill 264 also impacts entities licensed through AHCA in other ways.  Certain AHCA licensees are now required to ensure that a person or entity who possesses a controlling interest “does not hold, either directly or indirectly, regardless of ownership structure, an interest in an entity that has a business relationship with a foreign country of concern or that is subject to s. 287.135.” Fla. Stat. § 408.810(15)(a). “Business relationship” is defined broadly to mean “engaging in commerce in any form, including, but not limited to, acquiring, developing, maintaining, owning, selling, possessing, leasing, or operating equipment, facilities, personnel, products, services, personal property, real property, military equipment, or any other apparatus of business or commerce.” Fla. Stat. § 408.810(15)(b)(1).  Of note, unlike the data storage provisions of Florida Senate Bill 264, this requirement only applies to “foreign countries of concern” which include: the People’s Republic of China, the Russian Federation, the Islamic Republic of Iran, the Democratic People’s Republic of Korea, the Republic of Cuba, the Venezuelan regime of Nicolás Maduro, or the Syrian Arab Republic, including any agency of or any other entity of significant control of such foreign country of concern. See Fla. Stat. § 408.810(15)(b)(2).

Other Impacts of Florida Senate Bill 264 (2023)

Not limited to the health care field, Florida Senate Bill 264 also introduces restrictions and prohibitions with newly created Sections 287. 138, 692.203, and 693.204, whereby the government will limit contracting and ownership of property by entities who are controlled by governments and principals in countries of concern, such as:

• Florida Statutes Section 287.138 prohibits Florida government entities from contracting with entities’ whose controlling interests are owned by a government in a country of concern as well as entities who are “organized under the laws of or [who have their] principal place of business in a foreign country of concern” if such a contract would provide personal information to the entity. “Controlling interest” includes the power to direct or cause direction of management or policies of the company, whether through ownership or securities, by contract, or otherwise. “Controlling interest” also includes a person or entity that directly or indirectly has the right to vote 25% or more of the voting interests of the company or is entitled to 25% or more of its profits. Entities offering bids or proposals for government contracts will be required to sign attestations, and violations of the law can result in civil actions, severe penalties (up to twice the contract price),and being banned from contracting with the government or being placed on banned vendor lists.
• Florida Statutes Section 692.203 prohibits a foreign principal from ownership, acquisition, or transfer of any real property within 20 miles of a military installation, chemical manufacturing facility, refinery, electrical power plant, water intake facility or structure, wastewater treatment plant, pump station, natural gas transmission compressor station, liquid natural gas terminal or storage facility, telecommunications central switching office, inland port, gas processing plant, seaport, or spaceport. Because of the wide variety of critical infrastructures, it is likely to affect most property within Florida.
• Additional restrictions will be placed on those connected to the People’s Republic of China or the Chinese Communist Party as well as those domiciled in the People’s Republic of China and who are not citizens of the U.S. Florida Statutes Section 692.204 will prohibit acquisition of real property in Florida by entities organized in China and individuals domiciled in China who are not U.S. citizens. This statute is not limited to real property near military installations or critical infrastructures but instead applies to any real property in Florida.

The law changes under Florida Senate Bill 264 are too extensive to fully address in this article.  The health care team at Johnson Pope is actively working to help providers prepare for this new law and ensure compliance. Please reach out if you need information or direct guidance on these law changes. 

THIS ARTICLE IS PROVIDED FOR GENERAL INFORMATIONAL PURPOSES ONLY AND IS NOT BEING PROVIDED OR OFFERED AS LEGAL ADVICE. YOU SHOULD NOT CONSIDER OR RELY ON THIS ARTICLE AS LEGAL ADVICE. NOTHING CONTAINED IN THIS ARTICLE SHALL BE CONSTRUED TO CREATE AN ATTORNEY-CLIENT RELATIONSHIP. LEGAL ADVICE CANNOT BE GIVEN WITHOUT INFORMATION ABOUT YOUR SPECIFIC SITUATION.  YOU SHOULD ALSO NOTE THAT LAWS ARE MODIFIED AND UPDATED WITH THE PASSAGE OF TIME.  IF YOU NEED MORE INFORMATION ABOUT HOW THE LAWS REFERENCED IN THIS ARTICLE MAY IMPACT YOU OR YOUR BUSINESS, YOU SHOULD CONSULT THE ATTORNEYS AT JOHNSON POPE BOKOR RUPPEL & BURNS LLP OR OTHER LEGAL COUNSEL.