Florida Electronic Health Records Exchange Act: Offshore Storage Restriction and Emergency Release
Florida EHR Data Localization Law
Health · Data security
Added by SB 264 (2023, ch. 2023-33), this subsection requires providers using certified EHR technology to keep all patient information stored offsite, including with cloud vendors, physically in the continental United States, its territories, or Canada. It adds to the HIPAA Security Rule.
- Where
- Florida
- Citation
- Fla. Stat. 408.051(3)-(4)
- Status
- In force
- In force since
- 2023-07-01
- Last amended
- 2025-07-01
- Enforced by
- Florida Agency for Health Care Administration
- People can sue
- No
- Penalties
- No specific penalty in the subsection; enforced through health care licensure.
- Applies to
- Health care providers that use certified electronic health record technology (408.051(3))
Security duties
- Ensure all patient information stored offsite, including through third-party, subcontracted, or cloud computing providers, is physically maintained in the continental United States or its territories or Canada, in addition to HIPAA security requirements.Fla. Stat. 408.051(3) · From 2023-07-01
Other duties
- A provider may release or access an identifiable health record without consent to treat an emergency medical condition when consent cannot be obtained.Fla. Stat. 408.051(4)
Sources
- Official text
- Fla. Stat. 408.051 (2026 Florida Statutes, Online Sunshine)
- Laws of Florida ch. 2023-33 (CS/CS/SB 264), effective July 1, 2023
- Laws of Florida ch. 2025-204 (SB 2514), adding nursing home data subsection, effective July 1, 2025
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: It was not confirmed that ch. 2023-33 is the act that added the storage rule, though ch. 2023-33 (SB 264, foreign-country interests) appears in the section's history and took effect July 1, 2023. | Ch. 2024-15 and ch. 2025-6 amendments were not reviewed.
Research reference, not legal advice.