CYBER DENTAL 2.0
(954) 639-7049

Florida data-breach notification for dental practices

HIPAA has a clock. FIPA has a clock. A Hialeah office can be on both. Map them with counsel; do not pick the friendlier one in a panic.

Journal · Legal, Plain English · F·05 | Last reviewed: October 1, 2026 | 4 min read | By CyberDental Group LLC, Hialeah, Florida

Short answer: A breach at a Florida dental practice can trigger two laws at once. HIPAA generally requires individual notice without unreasonable delay and no later than 60 days after discovery. Florida's section 501.171 generally sets a 30-day individual-notice deadline after a breach is determined and a 30-day Department of Legal Affairs deadline when 500 or more Floridians are affected. But Florida also has a federal-regulator notice provision that may deem compliant federal notice sufficient for its individual-notice requirement. Counsel should map both laws to the specific incident before setting deadlines.

At a glance
HIPAA (individuals) Without unreasonable delay; no later than 60 days after discovery
HIPAA (HHS) 500+ individuals: contemporaneous with individual notice; fewer than 500: annual log within 60 days after year end
HIPAA (media) 500+ residents of a state or jurisdiction: notify prominent media
FIPA (individuals) Generally no later than 30 days after determination; assess the federal-regulator notice provision and statutory exceptions with counsel
FIPA (Dept. of Legal Affairs) 500+ individuals in Florida: within 30 days
FIPA (vendors) Third-party agents must notify the covered entity within 10 days
Statute Fla. Stat. § 501.171

General information, not legal advice. A suspected breach should involve qualified privacy counsel and your cyber-insurance carrier immediately. Confirm current statutory text before relying on this summary.

Why can one breach trigger two laws?

A Florida dental practice is both a HIPAA covered entity and an entity that holds "personal information" of Floridians under the Florida Information Protection Act (FIPA), Fla. Stat. § 501.171. Each statute has its own definition of a breach, its own clock and its own recipients. Complying with one does not automatically satisfy the other.

What does HIPAA require?

Under the Breach Notification Rule, after discovering a breach of unsecured PHI:

  • Individuals: notify without unreasonable delay and no later than 60 days after discovery. The 60 days is an outer limit, not a target.
  • HHS: for breaches affecting 500 or more individuals, notify HHS at the same time as individuals (and within 60 days); for fewer than 500, log it and report to HHS within 60 days after the end of the calendar year.
  • Media: for breaches affecting more than 500 residents of a state or jurisdiction, notify prominent media outlets.
  • Business associates must notify the covered entity without unreasonable delay and within 60 days; contracts commonly require far shorter timelines.

What does FIPA require?

For a breach of security of personal information in electronic form (which includes health information, health insurance numbers and certain identifiers):

  • Individuals: notice as expeditiously as practicable, no later than 30 days after determination of a breach or reason to believe a breach occurred, with limited extensions available for good cause and for law-enforcement requests.
  • Florida Department of Legal Affairs: notice when 500 or more individuals in Florida are affected, also within 30 days, with specified content (a synopsis of events, number of Floridians affected, services offered and a contact person), and further information on request.
  • Consumer reporting agencies: notice when more than 1,000 individuals are notified at one time.
  • Third-party agents (such as an MSP or vendor holding the data) must notify the covered entity within 10 days of determining a breach.
  • Interaction with HIPAA: subsection (4)(g) deems individual notice under a covered entity's primary or functional federal regulator's rules compliant with Florida's individual-notice requirement. A timely copy of that notice to the Department of Legal Affairs is deemed compliant with subsection (3). Whether and how this provision applies to a HIPAA-covered dental practice should be assessed with counsel; it is not safe to assume either that 30 days always controls or that federal notice removes every Florida obligation.
  • Penalties: civil penalties of up to $1,000 per day for the first 30 days of violation, $50,000 for each subsequent 30-day period up to 180 days, and up to $500,000 beyond that, per breach.
  • Security duty: FIPA also requires reasonable measures to protect personal information and to dispose of it properly.

What does a side-by-side timeline look like?

Day Event
0 Breach discovered / determined
10 FIPA: vendor must notify practice if vendor discovered it
30 FIPA: individuals notified; Legal Affairs notified if 500+ Floridians
60 HIPAA outer limit for individual notice; HHS and media notice if 500+

This is a conservative planning example, not a universal legal timeline. The statutes use different trigger dates, Florida has a federal-regulator notice provision, and the facts may invoke exceptions or permitted delays. Calendar every potentially applicable deadline with privacy counsel, and aim to notify promptly rather than treating an outer limit as a target.

What should a practice do in the first hours?

  1. Contain: isolate affected systems; do not wipe them. See If it is ransomware.
  2. Call your IT provider, privacy counsel and cyber-insurance carrier.
  3. Preserve evidence and start a timeline.
  4. Determine what data and how many people were affected, with forensic help.
  5. Run both analyses (HIPAA and FIPA) with counsel, and calendar the earlier deadline.
  6. Notify as required, and document everything.

What should be in place beforehand?

An incident response plan, BAAs with short breach-reporting windows (see Business associate agreements for dental practices), logging and backups that make investigation possible, and an after-hours path to your IT provider. See When should a dentist call IT after hours?.

Frequently asked questions

How long does a Florida dental practice have to notify patients of a breach?

Florida generally requires individual notice without unreasonable delay and no later than 30 days after determining a breach. HIPAA has a 60-day outer limit after discovery. Florida's federal-regulator notice provision may deem HIPAA-compliant individual notice sufficient for Florida purposes; have counsel determine the applicable route and deadlines for the incident.

Do I have to notify the Florida Attorney General's office?

FIPA requires notice to the Florida Department of Legal Affairs when 500 or more Floridians are affected, within 30 days. Consult counsel for the specifics.

Does my IT vendor have to tell me about a breach?

Under FIPA, a third-party agent that holds personal information must notify the covered entity within 10 days of determining a breach. Under HIPAA, business associates must notify without unreasonable delay and within 60 days; contracts often require shorter timelines.

What are the penalties under Florida's breach law?

Civil penalties can reach $1,000 per day for the first 30 days, $50,000 per subsequent 30-day period up to 180 days, and up to $500,000 beyond that, per breach.

Sources and further reading

Related in the Journal

About CyberDental

CyberDental Group LLC is a dental-exclusive managed IT and cybersecurity provider headquartered in Hialeah, Florida. Founded in 2016 by Mr. Dimitri Lopez, it supports 1,000+ licensed dental practices, has completed 250+ dental office IT build-outs, and operates a dental-only HelpDesk. Plans are priced per location: Remote $350/month, Priority $650/month, Ultimate $1,200/month; Concierge is quoted for multi-location groups and DSOs. CyberDental signs a Business Associate Agreement (BAA) with every practice it serves.

CALL TEXT