Patient and personnel records; copies; examination.

(1) Any licensed facility shall, upon written request, and only after discharge of the patient, furnish, in a timely manner, without delays for legal review, to any person admitted therein for care and treatment or treated thereat, or to any such person’s guardian, curator, or personal representative, or in the absence of one of those persons, to the next of kin of a decedent or the parent of a minor, or to anyone designated by such person in writing, a true and correct copy of all patient records, including X rays, and insurance information concerning such person, which records are in the possession of the licensed facility, provided the person requesting such records agrees to pay a charge. The exclusive charge for copies of patient records may include sales tax and actual postage, and, except for nonpaper records that are subject to a charge not to exceed $2, may not exceed $1 per page. A fee of up to $1 may be charged for each year of records requested. These charges shall apply to all records furnished, whether directly from the facility or from a copy service providing these services on behalf of the facility. However, a patient whose records are copied or searched for the purpose of continuing to receive medical care is not required to pay a charge for copying or for the search. The licensed facility shall further allow any such person to examine the original records in its possession, or microforms or other suitable reproductions of the records, upon such reasonable terms as shall be imposed to assure that the records will not be damaged, destroyed, or altered.

(2) This section does not apply to records maintained at any licensed facility the primary function of which is to provide psychiatric care to its patients, or to records of treatment for any mental or emotional condition at any other licensed facility which are governed by the provisions of s. 394.4615.

(3) This section does not apply to records of substance abuse impaired persons, which are governed by s. 397.501.

(4) Patient records are confidential and must not be disclosed without the consent of the patient or his or her legal representative, but appropriate disclosure may be made without such consent to:

(a) Licensed facility personnel, attending physicians, or other health care practitioners and providers currently involved in the care or treatment of the patient for use only in connection with the treatment of the patient.

(b) Licensed facility personnel only for administrative purposes or risk management and quality assurance functions.

(c) The agency, for purposes of health care cost containment.

(d) In any civil or criminal action, unless otherwise prohibited by law, upon the issuance of a subpoena from a court of competent jurisdiction and proper notice by the party seeking such records to the patient or his or her legal representative.

(e) The agency upon subpoena issued pursuant to s. 456.071, but the records obtained thereby must be used solely for the purpose of the agency and the appropriate professional board in its investigation, prosecution, and appeal of disciplinary proceedings. If the agency requests copies of the records, the facility shall charge no more than its actual copying costs, including reasonable staff time. The records must be sealed and must not be available to the public pursuant to s. 119.07(1) or any other statute providing access to records, nor may they be available to the public as part of the record of investigation for and prosecution in disciplinary proceedings made available to the public by the agency or the appropriate regulatory board. However, the agency must make available, upon written request by a practitioner against whom probable cause has been found, any such records that form the basis of the determination of probable cause.

(f) The Department of Health or its agent, for the purpose of establishing and maintaining a trauma registry and for the purpose of ensuring that hospitals and trauma centers are in compliance with the standards and rules established under ss. 395.401, 395.4015, 395.4025, 395.404, 395.4045, and 395.405, and for the purpose of monitoring patient outcome at hospitals and trauma centers that provide trauma care services.

(g) The Department of Children and Families, its agent, or its contracted entity, for the purpose of investigations of or services for cases of abuse, neglect, or exploitation of children or vulnerable adults.

(h) A local trauma agency or a regional trauma agency that performs quality assurance activities, a panel or committee assembled to assist a local trauma agency, or a regional trauma agency performing quality assurance activities. Patient records obtained under this paragraph are confidential and exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution.

(i) Organ procurement organizations, tissue banks, and eye banks required to conduct death records reviews pursuant to s. 395.2050.

(j) The Medicaid Fraud Control Unit in the Department of Legal Affairs pursuant to s. 409.920.

(k) The Department of Financial Services, or an agent, employee, or independent contractor of the department who is auditing for unclaimed property pursuant to chapter 717.

(l) A regional poison control center for purposes of treating a poison episode under evaluation, case management of poison cases, or compliance with data collection and reporting requirements of s. 395.1027 and the professional organization that certifies poison control centers in accordance with federal law.

(5) The Department of Health may examine patient records of a licensed facility, whether held by the facility or the Agency for Health Care Administration, for the purpose of epidemiological investigations. The unauthorized release of information by agents of the department which would identify an individual patient is a misdemeanor of the first degree, punishable as provided in s. 775.082 or s. 775.083.

(6) Patient records shall contain information required for completion of birth, death, and fetal death certificates.

(7)(a) If the content of any record of patient treatment is provided under this section, the recipient, if other than the patient or the patient’s representative, may use such information only for the purpose provided and may not further disclose any information to any other person or entity, unless expressly permitted by the written consent of the patient. A general authorization for the release of medical information is not sufficient for this purpose. The content of such patient treatment record is confidential and exempt from the provisions of s. 119.07(1) and s. 24(a), Art. I of the State Constitution.

(b) Absent a specific written release or authorization permitting utilization of patient information for solicitation or marketing the sale of goods or services, any use of that information for those purposes is prohibited.

(8) Patient records at hospitals and ambulatory surgical centers are exempt from disclosure under s. 119.07(1), except as provided by subsections (1)-(5).

(9) A licensed facility may prescribe the content and custody of limited-access records which the facility may maintain on its employees. Such records shall be limited to information regarding evaluations of employee performance, including records forming the basis for evaluation and subsequent actions, and shall be open to inspection only by the employee and by officials of the facility who are responsible for the supervision of the employee. The custodian of limited-access employee records shall release information from such records to other employers or only upon authorization in writing from the employee or upon order of a court of competent jurisdiction. Any facility releasing such records pursuant to this part shall be considered to be acting in good faith and may not be held liable for information contained in such records, absent a showing that the facility maliciously falsified such records. Such limited-access employee records are exempt from the provisions of s. 119.07(1) for a period of 5 years from the date such records are designated limited-access records.

(10) The home addresses, telephone numbers, and photographs of employees of any licensed facility who provide direct patient care or security services; the home addresses, telephone numbers, and places of employment of the spouses and children of such persons; and the names and locations of schools and day care facilities attended by the children of such persons are confidential and exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution. However, any state or federal agency that is authorized to have access to such information by any provision of law shall be granted such access in the furtherance of its statutory duties, notwithstanding the provisions of this subsection. The Department of Financial Services, or an agent, employee, or independent contractor of the department who is auditing for unclaimed property pursuant to chapter 717, shall be granted access to the name, address, and social security number of any employee owed unclaimed property.

(11) The home addresses, telephone numbers, and photographs of employees of any licensed facility who have a reasonable belief, based upon specific circumstances that have been reported in accordance with the procedure adopted by the facility, that release of the information may be used to threaten, intimidate, harass, inflict violence upon, or defraud the employee or any member of the employee’s family; the home addresses, telephone numbers, and places of employment of the spouses and children of such persons; and the names and locations of schools and day care facilities attended by the children of such persons are confidential and exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution. However, any state or federal agency that is authorized to have access to such information by any provision of law shall be granted such access in the furtherance of its statutory duties, notwithstanding the provisions of this subsection. The licensed facility shall maintain the confidentiality of the personal information only if the employee submits a written request for confidentiality to the licensed facility.