The Florida Legislature recently amended the Florida Electronic Medical Records Exchange Act (the “Act”) to prohibit certain health care providers from using certified electronic medical record technologies to store qualified electronic medical records.[1] outside the United States, its territories, or Canada.[2] Significantly, the ban also extends to qualifying electronic health records that are stored through a third-party or outsourced computing facility or cloud service provider.[3]
In effect, qualified health care providers may not store qualified electronic medical records abroad, nor may they rely on third-party providers operating abroad. It is also important to emphasize that the concept of storage extends to a party’s ability to retrieve, access, or even transmit qualified electronic health records.[4] This concept becomes a concern when a third-party contractor outside of the United States, its territories, or Canada, such as an IT support provider, electronic medical record platform, or data entry subcontractor, may access electronic medical records. qualified that would otherwise be stored on servers within the United States.
For the purposes of this foreign prohibition, a “health care provider” includes certain qualifications:
- Health professionals licensed or licensed by Florida law, such as physicians, physician assistants, acupuncturists, chiropractors, podiatrists, naturopathic physicians, optometrists, nurse practitioners, pharmacists, dentists, speech therapists, occupational therapists, nursing home administrators, dietitians, trainers sports, massage therapists, among others.
- Health care facilities and related service providers, such as hospitals, ambulatory surgical centers, nursing homes, assisted living facilities, pharmacies, home health care agencies, nursing registries, homemaker or escort service providers, medical adult day care facilities, hospices, drug-free workplace law testing laboratories, birthing centers, abortion clinics, crisis stabilization units, short-term residential treatment centers, residential treatment centers for children and adolescents, adult family care homes, transitional living centers, pediatric long-term care prescription facilities, home health equipment providers, intermediate care facilities for people with developmental disabilities, health care service groups, clinics health care organizations, organ, tissue and eye procurement organizations, continuing care centers, among others.
- Licensed facilities and providers that provide mental health or substance abuse services, along with their respective clinical and non-clinical staff that support inpatient and outpatient services.[5]
The Act is scheduled to take effect on July 1, 2023. Eligible health care providers must assess where electronic patient information is stored, including whether third-party providers (such as IT support, programming, etc.) outside of the United States or Canada has access to patient information. When there is a conflict, eligible healthcare providers may need to begin transferring patient information to new storage locations or take steps to ensure that access to patient information is appropriately limited prior to the effective date of the Law.
FOOTNOTES
[1] State of Florida §408.051(3). For purposes of the Act, a “qualified electronic health record” includes “an electronic record of information relating to the health of an individual that includes patient demographic and clinical information, such as medical history and problem lists, and that has the capability to provide clinical decision support, to support the entry of physician orders, to capture and query information relevant to the quality of medical care, and to exchange electronic health information and integrate such information from other sources”. State of Florida §408.051(2).
[2] State of Florida §408.051(3).
[3] State of Florida §408.051(3).
[4] State of Florida §408.051(3).
[5] State of Florida §408.051(2).
