1. United States
2. Fla.
3. Letter

I am writing to respectfully urge you to consider introducing or supporting legislation that strengthens patient data privacy and cybersecurity protections in the State of Florida by restricting offshore access to electronic medical records (EMRs). While the federal Health Insurance Portability and Accountability Act (HIPAA) sets a baseline for protecting patient data, it does not prohibit offshore entities from accessing sensitive health information—as long as they follow standard safeguards. Unfortunately, this leaves a significant gap in enforcement and accountability, particularly when data crosses national borders beyond the reach of U.S. regulators or courts. Several states—including Texas, New Jersey, and North Carolina—have recognized these risks and enacted stricter policies to ensure EMRs and other health data are not accessed, stored, or processed by vendors or employees located outside the United States. These actions help to: Prevent cybersecurity risks and foreign breach vulnerabilities Maintain U.S. jurisdiction over sensitive medical data Protect Medicaid and public health data handled by state contractors Strengthen public trust in Florida's healthcare system Preserve healthcare data jobs within the U.S. I respectfully request that Florida adopt similar safeguards, whether through legislation, procurement requirements, or administrative rules issued by the Agency for Health Care Administration (AHCA). Specifically, I recommend policies that: Prohibit offshore access, processing, or storage of patient health data for all vendors working with state health programs or healthcare systems operating under Florida licensure. Require full disclosure when third-party contractors or business associates use offshore personnel or data centers. Mandate domestic data residency for all EMRs and protected health information related to Florida patients. In an era of growing digital threats and international cybersecurity incidents, Floridians deserve the assurance that their most sensitive health information is protected under U.S. law and oversight. Thank you for your time and consideration of this important matter. I would welcome the opportunity to discuss this further or assist in developing model language based on best practices from other states.