Government-in-the-Sunshine Manual
Chapter updated: 01/14/2011

What are the statutory exemptions relating to hospital and medical records?

There are many exemptions for hospital and medical records. For a more complete listing, please refer to the exemption summaries contained in Appendix D.

1. Communicable or infectious disease reports

A number of exemptions exist for communicable or infectious disease reports. E.g., s. 381.0031(4), F.S. (information submitted in public health reports to Department of Health is confidential and is to be made public only when necessary to public health); s. 384.29, F.S. (sexually transmissible diseases); s. 466.041(3), F.S. (reports of hepatitis B carrier status filed by a dentist). See Ocala Star-Banner v. State, 697 So. 2d 1317 (Fla. 5th DCA 1997) (upholding court order sealing portions of a battery prosecution case file pertaining to transmission of sexually transmissible diseases to victims due to s. 384.29, F.S., confidentiality requirements). However, notwithstanding any other provision of law to the contrary, the Department of Health, the Department of Children and Family Services, and the Agency for Persons with Disabilities may share confidential information on any individual who is or has been the subject of a program within the jurisdiction of each agency. Sections 381.0022 and 402.115, F.S. The shared information remains confidential or exempt as provided by law. Id. See AGO 98-52.

Results of screenings for sexually transmissible diseases conducted by the Department of Health in accordance with s. 384.287, F.S., may be released only to those persons specified in the exemption. Section 384.287(5), F.S. A person who receives the results of a test pursuant to this section, which results disclose human immunodeficiency virus (HIV) infection and are otherwise confidential pursuant to law, shall maintain the confidentiality of the information received and the identity of the person tested as required by s. 381.004, F.S.; violation of this subsection is a first degree misdemeanor. Section 384.287(6), F.S.

Notification to an emergency medical technician, paramedic or other person that a patient they treated or transported has an infectious disease must be done in a manner to protect the confidentiality of patient information and shall not include the patient's name. Section 395.1025, F.S.

There are strict confidentiality requirements for test results for HIV infection; such information may be released only as expressly prescribed by statute. See s. 381.004, F.S. Any person who violates the confidentiality provisions of s. 381.004, F.S., and s. 951.27, F.S., is guilty of a first degree misdemeanor. Section 381.004(6)(b), F.S. And see s. 381.004(6)(c), F.S., establishing felony penalties for disclosure in certain circumstances. Thus, information received by the clerk of court indicating that an individual has complied with an order to be tested for HIV and the attendant test results "would appear to be confidential and should be maintained in that status." AGO 00-54. Cf. Florida Department of Corrections v. Abril, 969 So. 2d 201 (Fla. 2007) (an entity that negligently violates a patient’s right of confidentiality in disclosing the results of HIV testing may be held responsible in a negligence action).

HIV tests performed on persons charged with certain offenses may not be disclosed to any person other than the defendant, and upon request, the victim or the victim's legal guardian, or if the victim is a minor, the victim's parent or legal guardian, and to public health agencies pursuant to s. 775.0877, F.S., except as expressly authorized by law or court order. If the alleged offender is a juvenile, the test results shall also be disclosed to the parent or guardian. Section 960.003, F.S. See also s. 951.27, F.S. (limited disclosure of infectious disease test results, including HIV testing pursuant to s. 775.0877, F.S., of inmates in county and municipal detention facilities, as provided in statute).

2. Emergency medical services

With limited exceptions, s. 401.30(4), F.S., provides, in relevant part, that "[r]ecords of emergency calls which contain patient examination or treatment information are confidential and exempt from the provisions of s. 119.07(1) and may not be disclosed without the consent of the person to whom they pertain." Such records may be released only in certain circumstances and only to the persons and entities specified in the statute. AGO 86-97. Thus, a city commissioner is not authorized to review records of an emergency call by the city's fire-rescue department when those records contain patient examination and treatment information, except with the consent of the patient. AGO 04-09. See Lee County v. State Farm Mutual Automobile Insurance Company, 634 So. 2d 250 (Fla. 2d DCA 1994), upholding the county's right to require the patient's notarized signature on all release forms, to ensure that these confidential records are not improperly released. And see AGO 09-30 (entire record of emergency call containing patient examination and treatment information which is maintained as required by s. 401.30[1], F.S., is confidential and exempt; reports containing statistical data, required by the Department of Health, are public records and must be made available for inspection and copying following redaction of any patient-identifying information).

However, s. 401.30(4), is not violated by the city attorney, or an attorney under contract to the city, and other city officials having access to the city fire-rescue department's records of emergency calls that contain patient information when such access is granted to such individuals in carrying out their official duties to advise and defend, or assess the liability of, the city in a possible or anticipated claim against the city arising out of the provision of such care. AGO 95-75. And see AGO 08-20 (s. 401.30[4], F.S., permits emergency medical services transportation licensee to release records of emergency calls including patient’s name, address, and pertinent medical information to local law enforcement agency that does not provide regulatory or supervisory responsibility over licensee).

Reports to the Department of Health from service providers that cover statistical data are public except that the names of patients and other patient-identifying information contained in such reports are confidential and exempt from s. 119.07(1), F.S. Section 401.30(3), F.S.

3. Hospital records

a. Public hospitals

Like other governmental agency records, public hospital records are subject to disclosure in the absence of a statutory exemption. AGO 72-59. For example, the court in Tribune Company v. Hardee Memorial Hospital, No. CA 91-370 (Fla. 10th Cir. Ct. August 19, 1991), held that a settlement agreement entered in a lawsuit against the public hospital alleging that the hospital had swapped babies was a public record. The court held that the agreement was subject to disclosure despite a confidentiality provision contained within the agreement and claims by the hospital that it constituted work product.

In recent years, however, an increasing number of exemptions have been created for hospital records. A discussion of exemptions follows:

(1) Employee evaluations and personal identification information

Section 395.3025(9), F.S., authorizes hospitals to prescribe the content of limited access employee records which are not available for disclosure for 5 years after such designation. Such records are limited to evaluations of employee performance, including records forming the basis for evaluation and subsequent actions. See Times Publishing Company v. Tampa General Hospital, No. 93-03362 (Fla. 13th Cir. Ct. May 27, 1993) (s. 395.3025[9] exemption does not apply to list of terminated hospital employees; hospital ordered to allow newspaper to inspect list and personnel files of those persons named in list after "limited access" documents have been removed).

Home addresses, telephone numbers, and photographs of certain hospital employees, as well as specified personal information about the spouses and children of such employees, are also confidential. See ss. 395.3025(10) and (11), F.S.

All personal identifying information contained in records provided by physicians licensed under Ch. 458 or 459 in response to physician workforce surveys required as a condition for license renewal and held by the Department of Health is confidential and exempt, except as otherwise provided. Section s. 458.3193, F.S. (also published as s. 459.0083, F.S.)

(2) Proprietary business records

The following public hospital records and information are confidential and exempt from disclosure: contracts for managed care arrangements under which the public hospital provides health care services and any documents directly relating to the negotiation, performance, and implementation of such contracts; certain strategic plans; trade secrets as defined in s. 688.002; and documents, offers, and contracts (not including managed care contracts) that are the product of negotiations with nongovernmental entities for the payment of services when such negotiations concern services that are or may reasonably be expected to be provided by the hospital's competitors, provided that if the hospital's governing board is required to vote on the documents. This exemption expires 30 days prior to the date of the meeting when the vote is scheduled to take place. Section 395.3035(2), F.S. Cf. AGO 92-56, concluding that the exemptions must be strictly construed.

(3) Quality assurance records

Quality assurance or improvement records are generally confidential and not subject to disclosure. See, e.g., s. 394.907(7), F.S. (community mental health centers and facilities); s. 397.419(5) (substance abuse service providers); s. 401.425(5), F.S. (emergency medical services); s. 641.55(5)(c), F.S. (health maintenance organizations). See also s. 395.0193(7), F.S. (records of peer review panels, committees, governing bodies, or agent thereof, of hospitals or ambulatory surgical centers which relate to disciplinary proceedings against staff not subject to s. 119.07[1], F.S.); s. 395.0197(7), F.S. (adverse incident report submitted to the Agency for Health Care Administration shall not be available to the public); s. 395.4025(12), F.S. (patient care quality assurance reports made pursuant to enumerated statutes shall be held confidential by the Department of Health or its agent); and s. 400.119(1) and (2)(b), F.S. (specified incident reports and records of meetings of a risk management and quality assurance committee of a long-term care facility are confidential). But see Art. X, s. 25, Fla. Const., and s. 381.028, F.S., authorizing patients to have access to any records made or received in the course of business by a health care facility or provider relating to any adverse medical incident. And see Florida Hospital Waterman, Inc. v. Buster, supra (amendment creating Art. I, s. 25, Fla. Const., was intended to apply to existing records).

b. Private hospitals/private organizations operating public hospitals

A private organization leasing the facilities of a public hospital is acting on behalf of a public agency and thus constitutes an agency subject to open records requirements in the absence of statutory exemption. See Memorial Hospital-West Volusia, Inc. v. News-Journal Corporation, 729 So. 2d 373 (Fla. 1999). See also s. C.2., of this manual, discussing the applicability of the Public Records Act to private organizations providing services to public agencies.

Section 395.3036, F.S., however, provides that records of a private corporation that leases a public hospital or other public health care facility are confidential and exempt from disclosure when the public lessor complies with the public finance accountability provisions of s. 155.40(5), F.S., with respect to the transfer of any public funds to the private lessee and when the private lessee meets at least three of five criteria set forth in the exemption. See Indian River County Hospital District v. Indian River Memorial Hospital, Inc., 766 So. 2d 233 (Fla. 4th DCA 2000) (nonprofit corporation leasing hospital from hospital district is exempt from the open government laws). And see Baker County Press, Inc. v. Baker County Medical Services, Inc., 870 So. 2d 189 (Fla. 1st DCA 2004), upholding the constitutionality of the exemption. Cf. Memorial Hospital-West Volusia, Inc. v. News- Journal Corporation, 927 So. 2d 961 (Fla. 5th DCA 2006) (private corporation that purchased hospital from public hospital authority not subject to Public Records Act) and s. 155.40(8), F.S., describing and construing the term "complete sale" as applied to a purchase of a public hospital by a private entity.

4. Patient records

Patient records are generally protected from disclosure. For example, patient records in hospitals or ambulatory surgical centers licensed under Ch. 395, F.S., are confidential and may not be disclosed without the consent of the patient, or the patient's legal representative, except as provided in the statute. Section 395.3025(4), (5), (7) and (8), F.S. And see s. 400.022(1)(m), F.S. (nursing home residents' medical and personal records); s. 400.611(3), F.S. (hospice); and s. 383.32(3), F.S. (birth centers). See State v. Johnson, 814 So. 2d 390 (Fla. 2002) (state attorney's subpoena power under s. 27.04, F.S., cannot override notice requirements of s. 395.3025(4)(d), F.S., which provides for disclosure of confidential patient records upon issuance of subpoena and upon proper notice to the patient or the patient's legal representative). Cf. s. 408.051(3), F.S., permitting a health care provider to release or access an identifiable health record of a patient without the patient’s consent for use in the treatment of the patient for an emergency medical condition, as defined in s. 395.002(8), F.S., when the health care provider is unable to obtain the patient’s consent or the consent of the patient representative due to the patient’s condition or the nature of the situation requiring immediate medical attention.

Patient medical records made by health care practitioners may not be furnished to any person other than the patient, his or her legal representative or other health care practitioners and providers involved in the patient's care and treatment without written authorization except as provided by ss. 440.13(4)(c) and 456.057, F.S. Section 456.057(7)(a), F.S.

The recipient of patient records, if other than the patient or the patient's representative, may use such information only for the purpose provided and may not disclose any information to any other person or entity, unless expressly permitted by the written consent of the patient. See ss. 395.3025(7)(hospital patient records) and 456.057(12), F.S. (health care practitioner patient records). Thus, predeath medical records in the possession of the medical examiner are not subject to public inspection. Church of Scientology Flag Service Org., Inc. v. Wood, No. 97-688CI-07 (Fla. 6th Cir. Ct. February 27, 1997).

Patient clinical records are also protected. See, e.g., s. 393.13(4)(i)1., F.S. (central client records of persons with developmental disabilities); s. 394.4615(1), F.S. (clinical records of persons subject to "The Baker Act"); s. 397.501(7), F.S. (individuals receiving services from substance abuse service providers); s. 916.107(8), F.S. (forensic clients). Such records maintain their confidentiality even when disclosed to another agency such as the clerk of the circuit court. AGO 91-10. And see Sarasota Herald-Tribune v. Department of Children and Families, No. 2001-CA-002445 (Fla. 2d Cir. Ct. April 8, 2002) (confidentiality of clinical record is maintained even though Department of Children and Families may have filed portions of the records in court proceedings throughout the state; department has no authority to waive confidentiality of clinical records).

Except as provided in the exemption, all personal identifying information, contained in records relating to an individual's personal health or eligibility for health-related services held by the Department of Health is confidential and exempt. Section 119.0712(1), F.S. And see s. 119.0713(2), F.S. (personal identifying information contained in records relating to a person's health held by local governmental entities for purposes of determining eligibility for paratransit services under the Americans with Disabilities Act); and s. 408.7056(14), F.S. (subscriber-­identifying information contained in records held by the subscriber assistance panel, Department of Financial Services, or state health care agency). Cf. AGO 01-69 (documents submitted to the statewide provider and managed care organization claim dispute resolution program pursuant to s. 408.7057, F.S., found to be subject to disclosure after redaction of patient-identifying information)

Certain identification and location information of a patient or patient's agent, a health care practitioner, a dispenser, an employee of the practitioner who is acting on behalf of and at the direction of the practitioner; a pharmacist, or a pharmacy, that is contained in Department of Health records under the electronic prescription drug monitoring program for monitoring the prescribing and dispensing of controlled substances are confidential and exempt from disclosure. Section 893.0551(2), F.S.

5. Anatomical gifts donor records

The Agency for Health Care Administration and the Department of Highway Safety and Motor Vehicles must jointly contract for the operation of an anatomical gifts donor registry. Section 765.5155(2), F.S. Information held in the donor registry which identifies a donor is confidential and exempt but may be disclosed to certain specified individuals including procurement organizations certified by the Agency for Health Care Administration and persons engaged in bona fide research. Section 765.51551(1), F.S.