Florida’s FIPA gives organisations half the time HIPAA does to notify breach victims — 30 days, not 60 — and backs the deadline with per-day penalties that escalate to $500,000 per breach, so a HIPAA-only incident response plan is a plan to be late in Florida.
What FIPA is
The Florida Information Protection Act of 2014, codified at Florida Statutes section 501.171, replaced the state’s older breach law with a broader and stricter regime. It applies to any commercial entity that acquires, maintains, stores, or uses personal information of Florida residents — the statute calls these covered entities, in a usage wider than HIPAA’s — and to governmental entities. Location does not matter: an out-of-state telehealth platform with Florida patients is in scope.
Personal information under FIPA includes the familiar identifiers — Social Security number, driver licence number, financial account numbers with access credentials — and, importantly for healthcare, expressly includes an individual’s name in combination with information regarding their medical history, mental or physical condition, or medical treatment or diagnosis, as well as health insurance policy numbers and subscriber IDs. Online account credentials (email address plus password or security answers) are covered too. In other words, essentially any health-data breach involving Florida residents lands inside FIPA as well as HIPAA.
The 30-day notification clock
FIPA requires notice to affected individuals as expeditiously as practicable and in any event within 30 days after determination of the breach or reason to believe one occurred. Two features of that sentence deserve attention.
First, 30 days is half of HIPAA’s 60-day individual notification window. When an incident touches both regimes, the shorter clock governs your operational plan — you cannot run the investigation to the federal timeline and then discover the state deadline passed two weeks ago.
Second, the extension is narrow. The statute allows up to 15 additional days only for good cause, provided in writing to the Department of Legal Affairs within the original 30 days. There is also the standard law-enforcement delay provision where notification would interfere with an investigation. Neither is something to rely on in planning.
FIPA also has a risk-of-harm provision: notice to individuals is not required if, after an appropriate investigation and consultation with relevant law enforcement, the entity reasonably determines the breach has not and will not likely result in identity theft or other financial harm — but that determination must be documented in writing, kept for five years, and provided to the Department of Legal Affairs within 30 days. Even the exemption has a filing deadline.
Who gets notified, and when
The notification map for a Florida-touching health-data breach looks like this:
- Affected Florida residents: within 30 days of determination, with statutorily specified content — date or date range of the breach, description of the information involved, and contact information for the entity.
- Florida Department of Legal Affairs (the Attorney General’s office): within 30 days if the breach affects 500 or more Florida residents, with a written notice covering a synopsis of the incident, the number of Floridians affected, services offered to them, and a copy of the individual notice. The Department can also request supporting materials such as incident reports and policies.
- Consumer reporting agencies: without unreasonable delay if more than 1,000 Floridians are affected.
- Data owners, where you are the vendor: a third-party agent that maintains data on behalf of a covered business must notify that business within 10 days of discovering a breach. If you are a business associate holding Florida residents’ data, this 10-day statutory duty sits alongside whatever your business associate agreement says — and it is usually tighter.
For entities regulated federally, FIPA deems individual notice compliant if provided in accordance with the federal regulator’s rules — so a properly executed HIPAA notification satisfies the individual-notice piece — but the notice to the Florida Attorney General is still required on the state’s own timeline. That state filing is the step HIPAA-centric incident plans most often lack.
Per-record exposure and penalties
FIPA violations are treated as unfair or deceptive trade practices, enforced by the Attorney General. For failure to notify on time, civil penalties run up to $1,000 per day for the first 30 days of violation, then up to $50,000 for each subsequent 30-day period or fraction of one, capped at $500,000 per breach. The penalties apply per breach, not per individual — but a breach affecting thousands of Floridians with a months-late notification builds toward the cap quickly, and the penalty sits on top of any federal exposure from OCR and on top of the litigation that publicised breaches attract. FIPA itself creates no private right of action, but Florida plaintiffs’ firms are active, and common-law negligence claims routinely follow large health-data breaches.
FIPA is not only a breach statute. It also requires covered entities and their third-party agents to take reasonable measures to protect and secure data in electronic form containing personal information, and to take reasonable measures to dispose of customer records — shredding, erasing, or otherwise rendering them unreadable. For a HIPAA-regulated organisation, a genuinely implemented Security Rule programme covers this ground; the point is that the state has its own hook if the programme is hollow.
Building the Florida lane into your incident plan
Concretely, a HIPAA incident response plan adapted for Florida needs:
- A 30-day master clock for any incident involving Florida residents, with the internal investigation milestones back-planned from it — not from HIPAA’s 60 days.
- The Department of Legal Affairs notification package as a prepared template: synopsis, counts, services offered, copy of individual notice.
- The 500-resident and 1,000-resident thresholds flagged in your breach assessment procedure, alongside HIPAA’s own 500-person thresholds.
- The 10-day upstream notification duty in your vendor management terms if you hold data for others, and in your expectations of vendors who hold data for you.
- A written risk-of-harm determination template, with the five-year retention and 30-day state filing requirements attached, for incidents where you conclude notice is not required.
- Counsel identified in advance — the good-cause extension and law-enforcement delay provisions are decisions to make with a lawyer, quickly, not research projects mid-incident.
Run a tabletop against the 30-day clock once and the gaps show themselves: breaches are rarely fully scoped in the first week, which leaves little slack for drafting notices from scratch.
Where SuperHIPAA fits
The platform keeps your incident response procedures, breach assessment records, and notification templates in one place, with the state-specific deadlines beside the federal ones — so during a live incident your team executes a plan instead of reconstructing one. Our incident response assistance service exists for the weeks when the clock is actually running.
Start where you are
Take the free readiness assessment — 24 questions, about eight minutes, no call required. You get a scored report showing where your HIPAA foundation stands, including whether your incident response plan could realistically hit a 30-day clock. If you are further along than you thought, we will tell you that too.