Florida Statutes § 456.057 — Ownership and control of patient records; report or copies of records to be furnished; disclosure of information.

456.057 Ownership and control of patient records; report or copies of records to be furnished; disclosure of information.—(1) As used in this section, the term “records owner” means any health care practitioner who generates a medical record after making a physical or mental examination of, or administering treatment or dispensing legend drugs to, any person; any health care practitioner to whom records are transferred by a previous records owner; or any health care practitioner’s employer, including, but not limited to, group practices and staff-model health maintenance organizations, provided the employment contract or agreement between the employer and the health care practitioner designates the employer as the records owner. (2) As used in this section, the terms “records owner,” “health care practitioner,” and “health care practitioner’s employer” do not include any of the following persons or entities; furthermore, the following persons or entities are not authorized to acquire or own medical records, but are authorized under the confidentiality and disclosure requirements of this section to maintain those documents required by the part or chapter under which they are licensed or regulated:(a) Certified nursing assistants regulated under part II of chapter 464. (b) Pharmacists and pharmacies licensed under chapter 465. (c) Dental hygienists licensed under s. 466.023. (d) Nursing home administrators licensed under part II of chapter 468. (e) Respiratory therapists regulated under part V of chapter 468. (f) Athletic trainers licensed under part XIII of chapter 468. (g) Electrologists licensed under chapter 478. (h) Clinical laboratory personnel licensed under part I of chapter 483. (i) Medical physicists licensed under part II of chapter 483. (j) Opticians and optical establishments licensed or permitted under part I of chapter 484. (k) Persons or entities practicing under s. 627.736(7). (3) As used in this section, the term “records custodian” means any person or entity that:(a) Maintains documents that are authorized in subsection (2); or (b) Obtains medical records from a records owner. (4) Any health care practitioner’s employer who is a records owner and any records custodian shall maintain records or documents as provided under the confidentiality and disclosure requirements of this section. (5) This section does not apply to facilities licensed under chapter 395. (6) Any health care practitioner licensed by the department or a board within the department who makes a physical or mental examination of, or administers treatment or dispenses legend drugs to, any person shall, upon request of such person or the person’s legal representative, furnish, in a timely manner, without delays for legal review, copies of all reports and records relating to such examination or treatment, including X rays and insurance information. However, when a patient’s psychiatric, chapter 490 psychological, or chapter 491 psychotherapeutic records are requested by the patient or the patient’s legal representative, the health care practitioner may provide a report of examination and treatment in lieu of copies of records. Upon a patient’s written request, complete copies of the patient’s psychiatric records shall be provided directly to a subsequent treating psychiatrist. The furnishing of such report or copies shall not be conditioned upon payment of a fee for services rendered. (7)(a) Except as otherwise provided in this section and in s. 440.13(4)(c), such records may not be furnished to, and the medical condition of a patient may not be discussed with, any person other than the patient, the patient’s legal representative, or other health care practitioners and providers involved in the patient’s care or treatment, except upon written authorization from the patient. However, such records may be furnished without written authorization under the following circumstances:1. To any person, firm, or corporation that has procured or furnished such care or treatment with the patient’s consent. 2. When compulsory physical examination is made pursuant to Rule 1.360, Florida Rules of Civil Procedure, in which case copies of the medical records shall be furnished to both the defendant and the plaintiff. 3. In any civil or criminal action, unless otherwise prohibited by law, upon the issuance of a subpoena from a court of competent jurisdiction and proper notice to the patient or the patient’s legal representative by the party seeking such records. 4. For statistical and scientific research, provided the information is abstracted in such a way as to protect the identity of the patient or provided written permission is received from the patient or the patient’s legal representative. 5. To a regional poison control center for purposes of treating a poison episode under evaluation, case management of poison cases, or compliance with data collection and reporting requirements of s. 395.1027 and the professional organization that certifies poison control centers in accordance with federal law. 6. To the Department of Children and Families, its agent, or its contracted entity, for the purpose of investigations of or services for cases of abuse, neglect, or exploitation of children or vulnerable adults. (b) Absent a specific written release or authorization permitting utilization of patient information for solicitation or marketing the sale of goods or services, any use of that information for those purposes is prohibited. (c) Information disclosed to a health care practitioner by a patient in the course of the care and treatment of such patient is confidential and may be disclosed only to other health care practitioners and providers involved in the care or treatment of the patient, if allowed by written authorization from the patient, or if compelled by subpoena at a deposition, evidentiary hearing, or trial for which proper notice has been given. (d) Notwithstanding paragraphs (a)-(c), information disclosed by a patient to a health care practitioner or provider or records created by the practitioner or provider during the course of care or treatment of the patient may be disclosed:1. In a medical negligence action or administrative proceeding if the health care practitioner or provider is or reasonably expects to be named as a defendant; 2. Pursuant to s. 766.106(6)(b)5.; 3. As provided for in the authorization for release of protected health information filed by the patient pursuant to s. 766.1065; or 4. To the health care practitioner’s or provider’s attorney during a consultation if the health care practitioner or provider reasonably expects to be deposed, to be called as a witness, or to receive formal or informal discovery requests in a medical negligence action, presuit investigation of medical negligence, or administrative proceeding.a. If the medical liability insurer of a health care practitioner or provider described in this subparagraph represents a defendant or prospective defendant in a medical negligence action:(I) The insurer for the health care practitioner or provider may not contact the health care practitioner or provider to recommend that the health care practitioner or provider seek legal counsel relating to a particular matter. (II) The insurer may not select an attorney for the practitioner or the provider. However, the insurer may recommend attorneys who do not represent a defendant or prospective defendant in the matter if the practitioner or provider contacts an insurer relating to the practitioner’s or provider’s potential involvement in the matter. (III) The attorney selected by the practitioner or the provider may not, directly or indirectly, disclose to the insurer any information relating to the representation of the practitioner or the provider other than the categories of work performed or the amount of time applicable to each category for billing or reimbursement purposes. The attorney selected by the practitioner or the provider may represent the insurer or other insureds of the insurer in an unrelated matter. b. The limitations in this subparagraph do not apply if the attorney reasonably expects the practitioner or provider to be named as a defendant and the practitioner or provider agrees with the attorney’s assessment, if the practitioner or provider receives a presuit notice pursuant to chapter 766, or if the practitioner or provider is named as a defendant. (8)(a)1. The department may obtain patient records pursuant to a subpoena without written authorization from the patient if the department and the probable cause panel of the appropriate board, if any, find reasonable cause to believe that a health care practitioner has excessively or inappropriately prescribed any controlled substance specified in chapter 893 in violation of this chapter or any professional practice act or that a health care practitioner has practiced his or her profession below that level of care, skill, and treatment required as defined by this chapter or any professional practice act and also find that appropriate, reasonable attempts were made to obtain a patient release. Notwithstanding the foregoing, the department need not attempt to obtain a patient release when investigating an offense involving the inappropriate prescribing, overprescribing, or diversion of controlled substances and the offense involves a pain-management clinic. The department may obtain patient records without patient authorization or subpoena from any pain-management clinic required to be licensed if the department has probable cause to believe that a violation of any provision of s. 458.3265 or s. 459.0137 is occurring or has occurred and reasonably believes that obtaining such authorization is not feasible due to the volume of the dispensing and prescribing activity involving controlled substances and that obtaining patient authorization or the issuance of a subpoena would jeopardize the investigation. 2. The department may obtain patient records and insurance information pursuant to a subpoena without written authorization from the patient if the department and the probable cause panel of the appropriate board, if any, find reasonable cause to believe that a health care practitioner has provided inadequate medical care based on termination of insurance and also find that appropriate, reasonable attempts were made to obtain a patient release. 3. The department may obtain patient records, billing records, insurance information, provider contracts, and all attachments thereto pursuant to a subpoena without written authorization from the patient if the department and probable cause panel of the appropriate board, if any, find reasonable cause to believe that a health care practitioner has submitted a claim, statement, or bill using a billing code that would result in payment greater in amount than would be paid using a billing code that accurately describes the services performed, requested payment for services that were not performed by that health care practitioner, used information derived from a written report of an automobile accident generated pursuant to chapter 316 to solicit or obtain patients personally or through an agent regardless of whether the information is derived directly from the report or a summary of that report or from another person, solicited patients fraudulently, received a kickback as defined in s. 456.054, violated the patient brokering provisions of s. 817.505, or presented or caused to be presented a false or fraudulent insurance claim within the meaning of s. 817.234(1)(a), and also find that, within the meaning of s. 817.234(1)(a), patient authorization cannot be obtained because the patient cannot be located or is deceased, incapacitated, or suspected of being a participant in the fraud or scheme, and if the subpoena is issued for specific and relevant records. 4. Notwithstanding subparagraphs 1.-3., when the department investigates a professional liability claim or undertakes action pursuant to s. 456.049 or s. 627.912, the department may obtain patient records pursuant to a subpoena without written authorization from the patient if the patient refuses to cooperate or if the department attempts to obtain a patient release and the failure to obtain the patient records would be detrimental to the investigation. (b) Patient records, billing records, insurance information, provider contracts, and all attachments thereto obtained by the department pursuant to this subsection shall be used solely for the purpose of the department and the appropriate regulatory board in disciplinary proceedings. This section does not limit the assertion of the psychotherapist-patient privilege under s. 90.503 in regard to records of treatment for mental or nervous disorders by a medical practitioner licensed pursuant to chapter 458 or chapter 459 who has primarily diagnosed and treated mental and nervous disorders for a period of not less than 3 years, inclusive of psychiatric residency. However, the health care practitioner shall release records of treatment for medical conditions even if the health care practitioner has also treated the patient for mental or nervous disorders. If the department has found reasonable cause under this section and the psychotherapist-patient privilege is asserted, the department may petition the circuit court for an in camera review of the records by expert medical practitioners appointed by the court to determine if the records or any part thereof are protected under the psychotherapist-patient privilege. (9)(a) All patient records obtained by the department and any other documents maintained by the department which identify the patient by name are confidential and exempt from s. 119.07(1) and shall be used solely for the purpose of the department and the appropriate regulatory board in its investigation, prosecution, and appeal of disciplinary proceedings. The records shall not be available to the public as part of the record of investigation for and prosecution in disciplinary proceedings made available to the public by the department or the appropriate board. (b) Notwithstanding paragraph (a), all patient records obtained by the department and any other documents maintained by the department which relate to a current or former Medicaid recipient shall be provided to the Medicaid Fraud Control Unit in the Department of Legal Affairs, upon request. (10) All records owners shall develop and implement policies, standards, and procedures to protect the confidentiality and security of the medical record. Employees of records owners shall be trained in these policies, standards, and procedures. (11) Records owners are responsible for maintaining a record of all disclosures of information contained in the medical record to a third party, including the purpose of the disclosure request. The record of disclosure may be maintained in the medical record. The third party to whom information is disclosed is prohibited from further disclosing any information in the medical record without the expressed written consent of the patient or the patient’s legal representative. (12) Notwithstanding the provisions of s. 456.058, records owners shall place an advertisement in the local newspaper or notify patients, in writing, when they are terminating practice, retiring, or relocating, and no longer available to patients, and offer patients the opportunity to obtain a copy of their medical record. (13) Notwithstanding the provisions of s. 456.058, records owners shall notify the appropriate board office when they are terminating practice, retiring, or relocating, and no longer available to patients, specifying who the new records owner is and where medical records can be found. (14) Whenever a records owner has turned records over to a new records owner, the new records owner shall be responsible for providing a copy of the complete medical record, upon written request, of the patient or the patient’s legal representative. (15) Licensees in violation of the provisions of this section shall be disciplined by the appropriate licensing authority. (16) The Attorney General is authorized to enforce the provisions of this section for records owners not otherwise licensed by the state, through injunctive relief and fines not to exceed $5,000 per violation. (17) A health care practitioner or records owner furnishing copies of reports or records or making the reports or records available for digital scanning pursuant to this section shall charge no more than the actual cost of copying, including reasonable staff time, or the amount specified in administrative rule by the appropriate board, or the department when there is no board. (18) Nothing in this section shall be construed to limit health care practitioner consultations, as necessary. (19) A records owner shall release to a health care practitioner who, as an employee of the records owner, previously provided treatment to a patient, those records that the health care practitioner actually created or generated when the health care practitioner treated the patient. Records released pursuant to this subsection shall be released only upon written request of the health care practitioner and shall be limited to the notes, plans of care, and orders and summaries that were actually generated by the health care practitioner requesting the record. (20) The board with department approval, or the department when there is no board, may temporarily or permanently appoint a person or entity as a custodian of medical records in the event of the death of a practitioner, the mental or physical incapacitation of a practitioner, or the abandonment of medical records by a practitioner. Such custodian shall comply with this section. The department may contract with a third party to provide these services under the confidentiality and disclosure requirements of this section.