Every cardiology practice knows HIPAA’s breach notification rule. Fewer have built their incident response plan around the Florida Information Protection Act (FIPA), Fla. Stat. § 501.171, which adds a state layer that applies even to HIPAA-covered practices.
What FIPA requires
- Individual notice: affected Florida residents must be notified no later than 30 days after the breach is determined or there is reason to believe one occurred.
- Attorney General notice: if 500 or more Floridians are affected, the Florida Department of Legal Affairs must be notified within 30 days.
- Credit reporting agencies: if more than 1,000 individuals are notified at once, the nationwide consumer reporting agencies must be notified as well.
Where HIPAA and FIPA meet
FIPA recognizes federal rules. Under § 501.171(4)(g), notice given under the rules of an entity’s primary federal regulator counts as compliance with FIPA’s individual notice requirement, as long as a timely copy of that notice goes to the Department of Legal Affairs. For a HIPAA-covered practice, patient notice that follows HIPAA’s rules generally satisfies Florida’s individual-notice requirement.
But two Florida pieces still apply:
- The copy to the state. If 500 or more Floridians are affected, the Attorney General’s office must be notified within 30 days of determining the breach. A timely copy of your HIPAA notice can satisfy this, but someone has to send it, and it is the step most often missed.
- Data HIPAA doesn’t cover. FIPA protects personal information that is not PHI, such as employee Social Security numbers, payroll records, and driver’s license numbers. A breach of that data falls outside HIPAA, so Florida’s 30-day notice clock applies on its own.
What to check in your plan
- Does your incident response plan reference FIPA, or only HIPAA?
- Does it name who sends the copy of the notice to the Department of Legal Affairs, and by when?
- Does it cover a breach of employee or HR data, not just patient records?
- Do your vendor contracts require your vendors to tell you about a breach quickly enough for you to meet both deadlines?
How CardioWatch helps
FIPA is one of the state-layer frameworks national compliance vendors tend to miss, and it is built into every CardioWatch program. We write your incident response plan to both the HIPAA and Florida requirements and coordinate the response with your attorney if a breach happens. Start with a Compliance Gap Assessment.
This article is general information about compliance program management, not legal advice. Talk to your attorney about how these rules apply to your practice.