Florida's Healthcare AI Laws: What Passed, What Died Twice in 2026, and What Binds a Clinic Anyway

No, and it is not for lack of trying. Checked on the Florida Senate's bill tracker in September 2026.

Florida has enacted five statutes that mention artificial intelligence, and none of them concerns a clinic. Chapter 2024-126 requires a disclaimer on political advertising made with generative AI (section 106.145). Chapter 2024-118 created the Government Technology Modernization Council and asked it for a code of ethics for AI in state government (section 282.802). Chapter 2025-133 requires platforms to take down altered sexual depictions within 48 hours. Chapter 2026-20 raises the penalty for AI generated child sexual abuse material. Chapter 2026-66 moved the council to a new department. That is the whole enacted list.

Everything that would have reached healthcare died. The Artificial Intelligence Bill of Rights passed the Senate as CS/SB 482 in March 2026 and as SB 2-D in the April special session, 35 to 2 and 37 to 1, and the House declined to hear it both times, with the Speaker taking the public position that AI should be regulated federally. The human review of claim denials bill, CS/CS/HB 527, passed the House 108 to 0 and died in Senate Rules. The pattern is a Senate and Governor who want a state AI statute and a House that does not, and the 2027 session starts from the same place.

What that means for a buyer is that Florida's healthcare AI law is the general law applied to a new tool. The specific provisions that bite are the offshore storage ban, which catches cloud AI vendors more often than people expect, the all party recording statute, the Patient's Bill of Rights, and two privacy statutes. Those are below. For how Florida compares with states that did legislate, the state by state map and the healthcare AI law checker put it alongside Texas, Colorado and California.

It matters because it describes the standard the Governor and the Attorney General already believe applies, and because it will be refiled.

The December 4, 2025 proposal and the bills that followed it carried three healthcare items. A notice to consumers when interacting with AI, aimed at company chatbots. A prohibition on entities providing licensed therapy or mental health counselling through artificial intelligence, which the Governor's release said could be expanded to AI imitating a licensed professional. And a rule that AI cannot be used as the sole determination in adjusting or denying a claim, with insurers required to detail their use of AI and allow the Office of Insurance Regulation to inspect the model. CS/SB 482 as passed by the Senate added the chatbot and minors provisions: companion chatbot platforms would have had to prohibit a minor from holding an account without parental consent and provide periodic notifications that the user was talking to a bot, in new sections 501.9981 to 501.9987, effective July 1, 2026.

None of that is law. But look at what each item maps to in states that did legislate. The therapy prohibition is Nevada's AB 406 and Illinois's Wellness and Oversight for Psychological Resources Act. The sole determination rule is California's SB 1120 and Washington's E2SSB 5395. The chatbot notice is Utah, Texas and New York. A multi state organisation is building these controls anyway, and a Florida only organisation that builds them is doing nothing wasted. A behavioural health practice in particular should treat the therapy prohibition as the standard now: AI for notes, scheduling and billing, a licensed human for the therapeutic act.

The other reason it matters is enforcement posture. The Attorney General opened a criminal investigation into OpenAI on April 21, 2026 and sued OpenAI and its chief executive under FDUTPA on June 1, 2026, alleging the company marketed ChatGPT to the public including children while concealing serious risks. Florida's consumer protection office has decided it does not need an AI statute to act on AI harms. A provider whose chatbot misrepresents what it is, or whose vendor mishandles patient data, is inside the same statute.

Because it is the one Florida statute that reaches a cloud AI vendor directly, it is sworn to under penalty of perjury, and most vendor contracts do not mention it.

Section 408.051(3), added by chapter 2023-33 and effective July 1, 2023, reads: in addition to the requirements in 45 CFR part 160 and subparts A and C of part 164, a health care provider that utilizes certified electronic health record technology must ensure that all patient information stored in an offsite physical or virtual environment, including through a third party or subcontracted computing facility or an entity providing cloud computing services, is physically maintained in the continental United States or its territories or Canada. The subsection applies to all qualified electronic health records stored using any technology that can allow information to be electronically retrieved, accessed or transmitted.

Section 408.810(14) then requires a licensee to sign an affidavit at initial application and on every renewal attesting under penalty of perjury to compliance with section 408.051(3), and makes non compliance grounds for disciplinary action by the Agency for Health Care Administration.

Apply that to an ambient scribe, an AI phone agent or a prior authorization agent. Each takes patient information out of the EHR and into a vendor's environment. If any part of that environment, including a model inference endpoint, a transcription subprocessor, a backup region or a support team's access path, sits outside the continental United States, its territories or Canada, the licensee's affidavit is wrong. The statute does not distinguish storage from processing in a way a vendor can rely on: virtual environment and any technology that can allow information to be electronically retrieved covers a transient inference call on a server in Ireland.

What to ask for, in writing: the list of every region and subprocessor that touches patient information, including model providers; a contractual commitment to US, territory or Canada residency for storage and processing; notice before any change; and an audit right. A vendor that says it cannot confirm where its model provider runs inference has answered the question. Our vendor questions list includes the residency question because Florida makes it a licensure matter rather than a preference.

Prior consent from everyone in the room or on the call, and a straight answer when a patient asks who or what is providing a service.

Section 934.03(2)(d) makes it lawful to intercept a wire, oral or electronic communication when all of the parties to the communication have given prior consent to such interception. Absent that, interception is a felony of the third degree under section 934.03(4)(a), and section 934.10 gives the recorded person a civil action. Section 934.02(2) defines an oral communication as one uttered by a person exhibiting an expectation that it is not subject to interception under circumstances justifying that expectation, and a consultation room or a call to a clinic is the paradigm case. Florida is stricter than Texas here, which is one party consent, and matches Washington and Massachusetts.

• Ambient scribes. Consent must be prior and from every party, so the accompanying relative counts. Ask at the start of the visit, record the answer in the note, and make it easy to decline. A signed general consent at registration is helpful evidence but it is not consent from the family member who was not there when it was signed.
• AI phone agents. The agent's opening line must state that the call is recorded and obtain consent before any clinical content. Continuing the call after a clear announcement is generally treated as consent, but a caller who objects must be offered a non recorded route, which usually means a human.
• Vendor retention. A recording made lawfully can still create exposure if it is retained or reused beyond what the patient consented to. Confirm audio retention periods and training use in the contract.

Section 381.026(4)(b)1 adds a duty people forget: a patient has the right to know the name, function and qualifications of each health care provider who is providing medical services to the patient, and 381.026(4)(b)3 gives the right to information concerning diagnosis, planned course of treatment, alternatives, risks and prognosis. An AI agent that presents itself as a nurse, or an intake flow that lets a patient believe a clinician reviewed a symptom triage when a model did, is in tension with that statute before any AI law exists. The safe design is the one Utah and Texas require anyway: the agent says what it is, and it never carries a clinical title.

FIPA reaches every vendor and is the one to write into the contract. The Digital Bill of Rights reaches almost no healthcare vendor, and knowing why saves an argument.

The Florida Information Protection Act, section 501.171, defines personal information to include any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional, and health insurance policy and subscriber identifiers. A covered entity must take reasonable measures to protect that data, must notify affected individuals as expeditiously as practicable and no later than 30 days after determining a breach, and must notify the Department of Legal Affairs within the same 30 days where 500 or more Floridians are affected. A third party agent that maintains the data on the covered entity's behalf, which is what an AI vendor is, must notify the covered entity within 10 days of discovery. A failure to notify is an unfair or deceptive trade practice with the penalty schedule set out above. Put the 10 day vendor notice and the 30 day clock in the business associate agreement alongside the federal 60 day rule described in our HIPAA and AI page, because Florida's clock is shorter.

The Florida Digital Bill of Rights, sections 501.701 to 501.721, looks like a consumer privacy statute and mostly is not one for healthcare. Section 501.702 defines a controller as a for profit business doing business in Florida that makes in excess of one billion dollars in global gross annual revenue and also derives half its revenue from online advertising, operates a consumer smart speaker with a virtual assistant, or operates an app store with at least 250,000 applications. Section 501.703(2)(c) then exempts a covered entity or business associate governed by the HIPAA privacy, security and breach notification regulations. A scribe or phone agent vendor under a business associate agreement is out on both counts. Where the act can matter is a very large technology company offering a consumer facing health product outside HIPAA, and for a provider the relevant point is that Florida, unlike Washington, Nevada and Connecticut, has no consumer health data act reaching the data your website, marketing tools and non patient interactions generate. That is a gap in the patient's protection, not in yours, and it is one the AI Bill of Rights proposed to close.

No Florida statute stops it as of September 2026, the bill that would have passed the House unanimously and died in the Senate, and the Office of Insurance Regulation has published nothing on AI.

Florida's prior authorization statute, section 627.42392, dates from 2016 and 2017. It requires a health insurer or HMO without an electronic prior authorization process to use the standard form approved by the Financial Services Commission, no more than two pages, and it says nothing about timelines, automated decisions or artificial intelligence. The 2026 prior authorization reform bills, HB 1015, HB 1023 and SB 1198, all died on March 13, 2026. Chapter 2024-196 (SB 892) bars denying a dental claim for a procedure that was prior authorised, effective January 1, 2025, and that is the closest Florida has come to a denial rule.

CS/CS/HB 527 would have changed this. It prohibited workers' compensation carriers, insurers and HMOs from reducing a claim payment, denying a claim or denying a portion of a claim based solely on the output of an artificial intelligence or machine learning system, required human review before an AI generated denial took effect, required disclosure to the consumer when AI was used, and required carriers to keep records of AI use. It passed the House 108 to 0 on March 5, 2026 and died in Senate Rules eight days later. Its Senate companion SB 202 required that decisions to deny a claim be made by qualified human professionals and died in Banking and Insurance. Expect both back in 2027.

The Office of Insurance Regulation's list of informational memoranda, checked in September 2026, ends at OIR-23-05M from August 2023 and contains nothing on AI or the NAIC model bulletin on the use of AI systems by insurers, which Pennsylvania, Washington and Massachusetts have all adopted. Not published. So a Florida provider has no state hook for an AI denial today. What it does have is the ordinary appeal and external review rights under the Florida Insurance Code and, for Medicare Advantage, the federal rules. Instrument your prior authorization workflow to capture denial text, reviewer identity and turnaround time by plan, so that when a Florida human review rule arrives you have the baseline to enforce it against.

Nothing new, and the old rule is enough to discipline a clinician for an unreviewed AI note.

The Board of Medicine has issued no guidance, rule or position statement on the clinical use of AI. Checked September 2026. The only AI item on its site is a May 2025 notice introducing ELI, the Division of Medical Quality Assurance's own AI chat assistant for licensing enquiries. The Department of Health has published nothing directed at practitioners either.

What governs is Rule 64B8-9.003, Florida Administrative Code, Standards for Adequacy of Medical Records. A licensed physician shall maintain patient medical records in English, in a legible manner and with sufficient detail to clearly demonstrate why the course of treatment was undertaken, and the record shall contain sufficient information to identify the patient, support the diagnosis, justify the treatment and document the course and results of treatment accurately. The rule does not care who drafted the note. It cares whether the note, as signed, justifies the treatment. A scribe draft that invents a negative review of systems or drops a medication and is signed unread is an inadequate record under the rule, and inadequate records are among the most common grounds for Board discipline. The scribe checklist exists to make the review gate real.

Telehealth adds one rule. Section 456.47(3) requires a telehealth provider to document the health care services rendered using telehealth according to the same standard as used for in person services, and section 456.47(2)(a) applies the prevailing professional standard of practice for in person care. An AI intake or triage agent is not a telehealth provider under the definition, because the definition requires a licensed provider using the technology, which is a useful thing to be able to say when a vendor describes its agent as delivering care. Out of state clinicians serving Florida patients through a telehealth registration should note that the same records rule and the same offshore storage rule follow the patient.

If a complaint arrives, the Board's first question will be what the practice's written position on AI was. The AI policy template for medical practices is the fastest way to have one.

Seven items. Florida has no AI statute, so the work is applying older law precisely and preparing for the 2027 refiling.

1. Get every vendor's data residency in writing before the next licence renewal. Section 408.051(3) covers cloud processing and subprocessors, and section 408.810(14) makes you swear to it. Regions, subprocessors, model providers, backups, support access.
2. Obtain prior consent from every party before any recording. Section 934.03 is a felony statute with a private right of action. Spoken consent at the start of the visit, noted in the chart; an announcement and consent step at the top of every phone agent call; a human route for anyone who declines.
3. Make every agent say what it is and never carry a clinical title. The Patient's Bill of Rights gives patients the right to know the name, function and qualifications of who is serving them, and the Attorney General has shown under FDUTPA that misrepresentation by an AI product is actionable without an AI statute.
4. Write the FIPA clocks into the BAA. Ten days for the vendor to tell you, thirty days for you to tell patients and the Department of Legal Affairs.
5. Gate AI notes behind a real review. Rule 64B8-9.003 judges the signed record, not the drafting tool.
6. Keep AI out of the therapeutic act in behavioural health. The Governor's proposal, Nevada and Illinois all draw the line in the same place. Notes, scheduling and billing yes; therapy no.
7. Baseline your denials by plan now. When HB 527 or its successor passes, you will want a year of data on which plans denied fastest and with the least clinical reasoning.

Florida punishes the organisation that reads no AI law as no law. The offshore storage affidavit, the felony recording statute and FDUTPA are all live, and the Attorney General has decided AI harms are its business. Sorting vendor data flows, writing the consent and review controls, and aligning them with what Texas, Colorado and California require is what our AI governance and compliance engagement does, usually starting from the vendor inventory an AI readiness audit produces. Book a scoping call if the renewal affidavit is closer than you would like.