Your HIPAA Breach Clock Says 60 Days. Florida Law Says 30.

Ask most practice owners how long they have to notify patients after a data breach, and you'll get a confident answer: 60 days. That's HIPAA's number, and it's the one every breach-response template, cyber insurance policy, and IT vendor plasters across their materials. It's also the wrong number if your patients live in Florida — which, if you're reading this, they do.

Florida's own breach notification law gives you 30 days, not 60. Half the runway you thought you had, and the clock doesn't ask whether you were busy running a practice at the time.

What the law actually says

The Florida Information Protection Act, tucked into Florida Statute 501.171, requires notifying affected Florida residents without unreasonable delay and no later than 30 days after you determine a breach occurred. A one-time, 15-day extension exists, but it requires a written good-cause request to the Florida Attorney General's office before the original 30 days runs out — not something you want to be drafting at day 29.

FIPA also reaches further than HIPAA's definition of protected health information. It covers a Florida resident's name combined with medical or health insurance information, financial account credentials, or simply a username and password for an online account. That last category is easy to miss: if a patient portal login gets exposed and nobody actually views a chart, HIPAA might not even consider it a reportable event. FIPA still does.

There's more structure underneath the deadline. If 500 or more Florida residents are affected, you have to notify the Attorney General's office within that same 30-day window. If more than 1,000 individuals get notified at once, the nationwide consumer reporting agencies need to hear from you too. And if a vendor or business associate is the one who discovers the breach, they're required to tell you within 10 days of finding it — which eats into your 30 before you've even started drafting notices.

Why it matters

Here's the trap: being HIPAA-compliant on notification doesn't automatically make you FIPA-compliant. If you're a HIPAA-covered entity and you notify individuals the way HIPAA requires, Florida does treat that as satisfying FIPA — but only if you also get a copy of that notice to the Attorney General's office on time, and only if you actually hit the 30-day clock rather than HIPAA's more forgiving 60. Most incident response plans, including ones sold by national vendors, are written to the federal standard because it's the one everyone's heard of. Build your plan around 60 days and you'll miss Florida's deadline by the time you're still gathering facts.

The penalties are not symbolic. The Department of Legal Affairs can pursue $1,000 per day for the first 30 days a required notice is late, then $50,000 for each additional 30-day period, up to $500,000 per breach. That's before you count the reputational cost of a late notice showing up in the news instead of a timely one showing up in a patient's mailbox.

What this means if you're a South Florida practice

FIPA is a state law, so it applies the same way whether your practice is in Boca Raton, Fort Lauderdale, Miami, or — as we extend our HIPAA-focused support into Martin and St. Lucie County — Stuart or Port St. Lucie. There's no "small practice" carve-out and no grace period for a solo office figuring out its incident response plan for the first time mid-breach. The 500-resident Attorney General threshold sounds large until you remember that a single practice's active patient panel can run well past that number.

The practical risk isn't malice or negligence — it's the natural instinct to spend the first few weeks after a breach investigating quietly before saying anything. That instinct is reasonable under HIPAA's 60-day window. Under Florida law, by week four you should already have notices in the mail.

Practical takeaways

• Rebuild your incident response plan around a 30-day clock, not HIPAA's 60 — if your plan or your IT vendor's plan only cites the federal deadline, it needs an update.

• Pre-draft notification letter templates now, while there's no pressure, so you're filling in details under deadline rather than writing from scratch.

• Know your numbers in advance: how many Florida residents are in your active patient panel, since that determines whether the 500-person Attorney General notice and the 1,000-person credit bureau notice apply to you.

• Treat exposed portal or account credentials as reportable under FIPA even when no clinical record was actually viewed.

• Update vendor and business associate contracts to commit to the statutory 10-day notification window to you, not vague language like "promptly" or "as soon as practicable."

• If you determine notice isn't required because harm is unlikely, document that reasoning in writing and keep it on file for five years — FIPA expects you to be able to produce it.

None of this requires a bigger budget or a new vendor. It requires knowing which clock is actually running, because the one most practices have in their heads is thirty days too generous.