Under the Florida Information Protection Act (FIPA), Fla. Stat. §501.171, which of the following commercial entities is required to comply with Florida's breach notification rules for health-related personal information?
A. Any commercial entity that acquires, maintains, stores, or uses personal information of Florida residents, regardless of HIPAA status
B. Only entities that are HIPAA covered entities or business associates
C. Only hospitals licensed under Florida Statutes Chapter 395
D. Only entities with more than 500 employees
Show answer and reasoning
Correct answer: A. Any commercial entity that acquires, maintains, stores, or uses personal information of Florida residents, regardless of HIPAA status
- B: FIPA is not limited to HIPAA covered entities or business associates -- it applies to any covered commercial entity handling Florida residents' personal information, HIPAA status notwithstanding.
- C: Chapter 395 governs hospital records specifically; FIPA's breach-notification duty is not limited to hospitals.
- D: FIPA's obligations are not tied to employee headcount; they apply to any covered commercial entity regardless of size.
Source: Fla. Stat. §501.171(1)(g)(1)(a) (Florida Information Protection Act, 2014) — defines 'personal information' to include medical history, mental or physical condition, medical treatment/diagnosis, and health insurance policy or subscriber ID numbers, even outside HIPAA-covered entities; https://www.flsenate.gov/Laws/Statutes/2025/501.171
A Florida telehealth company determines that a data breach exposed patients' medical history information covered under FIPA. Under Fla. Stat. §501.171(4)(a), what is the outer deadline for notifying affected individuals, measured from the date the breach is determined?
A. 60 days, matching the HIPAA Breach Notification Rule
B. 90 days if fewer than 500 individuals are affected
C. 30 days, without unreasonable delay
D. There is no fixed deadline under Florida law
Show answer and reasoning
Correct answer: C. 30 days, without unreasonable delay
- A: This is the federal HIPAA Breach Notification Rule deadline (45 CFR §164.404), not Florida's; FIPA is stricter.
- B: FIPA's 30-day deadline does not vary based on the number of individuals affected; the 500-person threshold instead triggers a separate duty to notify the Florida Attorney General.
- D: FIPA affirmatively sets a 30-day outer deadline in §501.171(4)(a); it is not open-ended.
Source: Fla. Stat. §501.171(4)(a) — individual breach notification 'without unreasonable delay,' but no later than 30 days after determination of a breach; https://www.flsenate.gov/Laws/Statutes/2025/501.171
Under Fla. Stat. §501.171(3)(a), if a covered entity needs additional time beyond the standard 30-day window to notify the Florida Department of Legal Affairs of a breach involving 500 or more Florida residents, what must it do?
A. Nothing; a 15-day extension is automatic
B. File a federal HHS extension request
C. Wait until the following fiscal year to report
D. Present good cause in writing to the Department within the original 30-day window to receive up to 15 additional days
Show answer and reasoning
Correct answer: D. Present good cause in writing to the Department within the original 30-day window to receive up to 15 additional days
- A: The extension is not automatic; the statute conditions it on a written good-cause showing made within the original window.
- B: FIPA is a state law enforced by the Florida Department of Legal Affairs/Attorney General, not HHS; there is no federal extension mechanism under this statute.
- C: The statute ties the extension to the 30-day breach-notice window, not to any fiscal-year cycle.
Source: Fla. Stat. §501.171(3)(a) — Department of Legal Affairs notice deadline with possible 15-day extension for good cause shown in writing; https://www.flsenate.gov/Laws/Statutes/2025/501.171
Under Fla. Stat. §501.171(3)(a), at what threshold must a covered entity notify the Florida Department of Legal Affairs about a breach involving health-related personal information?
A. Any breach, regardless of the number of individuals affected
B. When the breach affects 500 or more individuals in Florida
C. When the breach affects 5,000 or more individuals nationwide
D. Only when the breach involves Social Security numbers
Show answer and reasoning
Correct answer: B. When the breach affects 500 or more individuals in Florida
- A: The Attorney General notice duty in §501.171(3)(a) is expressly conditioned on the 500-Florida-resident threshold, not on every breach.
- C: The statute's threshold is 500 Florida residents, not 5,000 individuals nationwide.
- D: The AG-notice threshold applies to breaches of 'personal information' generally, which includes medical history and health insurance data, not only SSNs.
Source: Fla. Stat. §501.171(3)(a) — Attorney General/Department of Legal Affairs notification required when a breach affects 500 or more individuals in Florida; https://www.flsenate.gov/Laws/Statutes/2025/501.171
Under Fla. Stat. §501.171(9)(b), what is the maximum total civil penalty a covered entity can face for failing to timely notify individuals of a breach, before any other damages?
A. $1,000 per day for the first 30 days, then $50,000 per subsequent 30-day period, capped at $500,000 per breach
B. $50,000 total, regardless of how long notification is delayed
C. $1,000 per day indefinitely, with no cap
D. A flat $10,000 fine per violation
Show answer and reasoning
Correct answer: A. $1,000 per day for the first 30 days, then $50,000 per subsequent 30-day period, capped at $500,000 per breach
- B: $50,000 is the per-30-day-period penalty after the initial 30 days, not the overall cap.
- C: The statute imposes a hard cap; penalties are not unlimited.
- D: $10,000 does not appear in the statute's penalty structure; the actual mechanism is tiered and capped at $500,000.
Source: Fla. Stat. §501.171(9)(b) — civil penalties of $1,000/day for the first 30 days, then $50,000 per subsequent 30-day period, capped at $500,000 per breach; https://www.flsenate.gov/Laws/Statutes/2025/501.171
