Florida Senate Bill 264 (SB 264) went into effect July 1, 2023. Generally, SB 264 amends the Florida Electronic Health Records Exchange Act under §408.051 and §408.810 adding additional restrictions and disclosures to offshore storage of health records that extend beyond HIPAA requirements and other generally applicable health privacy and security laws. While HIPAA does not prohibit the storage of health records outside the U.S., some state laws do, such as Florida’s SB 264. SB 264 has major implications for Covered Entities and Business Associates who receive Protected Health Information (PHI) and use offshore providers to manage and store their data. Covered Entities and Business Associates should also familiarize themselves with other state laws that have the same effect, and should review Business Associate Agreements and other contractual arrangements that may or may not address offshoring requirements of data.
Prohibited OffShore Electronic Data Storage
SB 264 amended §408.051, “In addition to the requirements under 45 C.F.R. part 160 and subparts A and C of part 164 (referring to HIPAA Information Security Rule), a health care provider that utilizes certified electronic health record technology must ensure that all patient information stored in an offsite physical or virtual environment, including through a third party, or subcontracted computing facility, or an entity providing cloud computing services, is physically maintained in the continental United States or its territories or Canada.”[1] This subsection applies to “all qualified electronic health records that are stored using any technology that can allow information to be electronically retrieved, accessed or transmitted.”[2] Thus, the amendment creates more stringent restrictions, preventing Florida healthcare providers from offshore storage of electronic healthcare data. It is unclear whether the requirements apply if a provider uses electronic health records but not “certified electronic health record technology” which is a specific protocol for the interoperability of electronic health records defined by CMS. For further reading, see: https://www.cms.gov/files/document/2022-cehrt-fact-sheet.pdf.
Practically, under this requirement, third-party vendors and contractors who store electronic healthcare records on Florida providers’ behalf cannot transfer or store health records outside the U.S. or Canada. Thus, healthcare providers and third-party vendors must be extra aware of where their data exists, which contractors possess their data that contains Florida health records, and whether those contractors and service providers have a mechanism to keep such data within the borders of the U.S. and Canada. With more and more Software as a Service (SaaS) vendors providing key IT operations for most businesses, data domesticity will become extremely challenging.
Required Licensee Compliance
Additionally, SB 264 amended §408.810 outlining minimum requirements of certain “licensees.” The requirements in this amendment outline the obligations of each applicant and licensee in compliance of this section to obtain and maintain a license. Under this section, any individual, facility, or party applying for, or holding a license under F.S. chapter 408 for the Florida Agency for Health Care Administration (the AHCA), as a “licensee,” must sign an affidavit, under the penalty of perjury, at time of initial license application or renewal that attests the licensee is in compliance with 408.051(3).[3] The license must remain in compliance with 408.051(3) and any failure to comply may subject the licensee to disciplinary action by the AHCA.
SB 264 requires applicable licensees ensure that no person or entity with controlling interest in the licensee has an interest in an entity that has a business relationship with certain foreign countries of concern: the People’s Republic of China, the Russian Federation, the Islamic Republic of Iran, the Democratic People’s Republic of Korea, the Republic of Cuba, the Venezuelan regime of Nicolás Maduro or the Syrian Arab Republic, including any agency of or any other entity of significant control of such foreign country of concern.[4]
In the practical application, applicable licensees applying for and or renewing their AHCA license must submit an affidavit of compliance and failure to maintain compliance requirements could result in disciplinary action. Furthermore, licensees must be aware that under Florida law a controlling interest is defined as “[a] person or entity that serves as an officer of, is on the board of directors of, or has a 5-percent or greater ownership interest in the applicant or licensee;” or “[a] person or entity that serves as an officer of, is on the board of directors of, or has a 5-percent or greater ownership interest in the management company or other entity, related or unrelated, with which the applicant or licensee contracts to manage the provider.”[5] Thus, under SB 264, licensees moving forward must be selective of third-party relationships ensuring interests do not violate relationships with foreign countries of concern.
By way of example, some business associates of Florida health providers may provide either IT or health services that have human resources in a different country. This may be commonplace among the general business paradigm of our times, but SB 264 places a fairly significant barrier to offshore expansion. Some business operations as simple as disaster recovery or off-site backups may have servers in Europe and Asia to provide diverse failover or backup-retrieval ability, but such a design may be contrary to SB 264. Business operations, IT systems and vendor due diligence should now consider Florida’s new law and its associated licensing requirements as well as other states who have some form of regulation that limits the geographic boundaries of health record storage.
If you have any questions about SB 264 and how it may affect you as an employer, please contact James K. Paulick at jpaulick@leechtishman.com or 424.738.4400. Paulick is Counsel in Leech Tishman’s Litigation and Corporate Practice Groups, and he regularly counsels small, medium, and large businesses in all matters involving Data Privacy & Cybersecurity.
[1] FLA. STAT. §408.051(3) (2023).
[2] Id.
[3] FLA. STAT. §408.810(14) (2023).
[4] FLA. STAT. §408.810(15) (2023); see FLA. STAT. §692.201(3) (2023); see also Stewart, Kate F. and Paolillo, Cassandra L., Effective July 1, Florida Will Prohibit Offshore Storage of Health Records and Require Additional Ownership Disclosures, Mintz, Effective July 1, Florida Will Prohibit Offshore Storage of Health Records and Require Additional Ownership Disclosures | Mintz
[5] FLA. STAT. §§408.803(7)(b), (7)(c) (2023).