Under the Florida Information Protection Act (FIPA), Fla. Stat. §501.171, which of the following commercial entities is required to comply with Florida's breach notification rules for health-related personal information?
A. Any commercial entity that acquires, maintains, stores, or uses personal information of Florida residents, regardless of HIPAA status
B. Only entities that are HIPAA covered entities or business associates
C. Only hospitals licensed under Florida Statutes Chapter 395
D. Only entities with more than 500 employees
Source: Fla. Stat. §501.171(1)(g)(1)(a) (Florida Information Protection Act, 2014) — defines 'personal information' to include medical history, mental or physical condition, medical treatment/diagnosis, and health insurance policy or subscriber ID numbers, even outside HIPAA-covered entities; https://www.flsenate.gov/Laws/Statutes/2025/501.171
A Florida telehealth company determines that a data breach exposed patients' medical history information covered under FIPA. Under Fla. Stat. §501.171(4)(a), what is the outer deadline for notifying affected individuals, measured from the date the breach is determined?
A. 60 days, matching the HIPAA Breach Notification Rule
B. 90 days if fewer than 500 individuals are affected
C. 30 days, without unreasonable delay
D. There is no fixed deadline under Florida law
Source: Fla. Stat. §501.171(4)(a) — individual breach notification 'without unreasonable delay,' but no later than 30 days after determination of a breach; https://www.flsenate.gov/Laws/Statutes/2025/501.171
Under Fla. Stat. §501.171(3)(a), if a covered entity needs additional time beyond the standard 30-day window to notify the Florida Department of Legal Affairs of a breach involving 500 or more Florida residents, what must it do?
A. Nothing; a 15-day extension is automatic
B. File a federal HHS extension request
C. Wait until the following fiscal year to report
D. Present good cause in writing to the Department within the original 30-day window to receive up to 15 additional days
Source: Fla. Stat. §501.171(3)(a) — Department of Legal Affairs notice deadline with possible 15-day extension for good cause shown in writing; https://www.flsenate.gov/Laws/Statutes/2025/501.171
Under Fla. Stat. §501.171(3)(a), at what threshold must a covered entity notify the Florida Department of Legal Affairs about a breach involving health-related personal information?
A. Any breach, regardless of the number of individuals affected
B. When the breach affects 500 or more individuals in Florida
C. When the breach affects 5,000 or more individuals nationwide
D. Only when the breach involves Social Security numbers
Source: Fla. Stat. §501.171(3)(a) — Attorney General/Department of Legal Affairs notification required when a breach affects 500 or more individuals in Florida; https://www.flsenate.gov/Laws/Statutes/2025/501.171
Under Fla. Stat. §501.171(9)(b), what is the maximum total civil penalty a covered entity can face for failing to timely notify individuals of a breach, before any other damages?
A. $1,000 per day for the first 30 days, then $50,000 per subsequent 30-day period, capped at $500,000 per breach
B. $50,000 total, regardless of how long notification is delayed
C. $1,000 per day indefinitely, with no cap
D. A flat $10,000 fine per violation
Source: Fla. Stat. §501.171(9)(b) — civil penalties of $1,000/day for the first 30 days, then $50,000 per subsequent 30-day period, capped at $500,000 per breach; https://www.flsenate.gov/Laws/Statutes/2025/501.171
