The Agency for Health Care Administration has draft language out for a new rule, 59A-35.112, called Data Breach Transparency. It would require licensed health care providers to report an "information technology incident" to AHCA within 24 hours of reasonably believing one may have occurred, using a new form submitted through the Agency's adverse incident reporting system. It would also require covered providers to maintain a written continuity plan covering data backup, restoration, and how patient care keeps running. On request, providers would have to hand over the police report, the forensics report, their internal policies, the list of data disclosed, and the contingency plan itself (AHCA draft text).
For comparison: the federal HIPAA Breach Notification Rule gives covered entities up to 60 days. Same event. Two very different clocks.
The thesis
Twenty-four hours from suspicion is not a transparency deadline. It is a paperwork deadline — and it will produce a filing cabinet of incomplete, defensive, hedged reports that tell regulators and patients very little about what actually happened.
Consider what a provider actually knows 24 hours after something looks wrong. Usually this: a workstation is behaving strangely, or a vendor sent an alert, or someone clicked something. What they almost never know yet is scope — which systems, which records, whether protected health information was accessed or merely exposed, whether it was exfiltrated or encrypted in place. That determination is the entire substance of a breach report, and it is the product of forensic work that takes days, not hours.
A deadline that lands before the facts do doesn't buy transparency. It buys a form.
So the rational response to a 24-hour clock is not faster investigation. It is defensive over-reporting: file on everything that twitches, describe it in the vaguest terms the form allows, and amend later. That is not a hypothetical failure mode — it is what short-fuse reporting regimes reliably produce. And the regulator ends up with more filings and less signal.
And it will not land evenly
Here is the part that gets least attention. A hospital system has a security operations center, an incident response retainer, and a general counsel who has run this drill. It will meet a 24-hour deadline without breaking stride. A three-nurse home health agency in Hialeah has a practice manager, an EMR vendor, and a phone number for the person who set up the router.
Both are AHCA-licensed. Both are covered. Only one of them has an answer to the question "who files at 2 a.m. on a Sunday?" A uniform 24-hour rule is formally neutral and practically regressive: it imposes the same clock on organizations with wildly different capacity to stop it, and the penalty for missing it falls hardest on the providers with the thinnest margins. The Home Care Association of Florida has already filed formal comments on the proposal — which is what a sector does when it can read the operational bill coming.
The honest counterpoint
AHCA is not wrong about the problem. Under the 60-day federal standard, patients have routinely learned months after the fact that their records were sold, and the interval between compromise and notice has been where a great deal of real harm happens. Waiting for perfect forensic certainty has, in practice, been a very comfortable place for organizations to sit.
And the continuity-plan requirement is, frankly, overdue. A written plan for data backup, restoration, and keeping patient care running through an outage should not be a regulatory innovation in 2026 — it should be the floor. Most of the objection to this rule is about the clock. Almost none of it is about the plan, and that tells you the plan is right.
What a better version looks like
Split the clock. A short initial notice — "something happened, here is who to call" — inside 24 or 72 hours, then a substantive report at 10 or 14 days once scope is known. Notify fast, characterize accurately.
Scale by capacity. Tiered timelines by facility size, the way most regulatory burdens already are, so a small agency isn't held to a hospital's response infrastructure.
Make the first filing a safe harbor. An initial report that turns out to be a false alarm should carry no penalty, or every provider will learn to wait until they're sure — which defeats the entire purpose.
Publish a template continuity plan. If the state wants every licensed provider to have one, giving them a usable starting point costs AHCA almost nothing and would raise the floor immediately.
WHERE THIS ACTUALLY STANDS
59A-35.112 is a proposed rule, still in development following the public rulemaking process. It is not in effect, and the text can change before it is. Nothing here is a compliance instruction — verify the current status and language directly with AHCA before changing your procedures.
Where FHC stands
We do HIPAA consulting and risk management consulting, so our bias is on the table: rules like this create work for people who do what we do. That is exactly why we'd rather argue for a version that improves security than one that improves documentation. If you don't currently have a written continuity plan, or you can't name the person who files at 2 a.m., that gap is worth closing whether or not this rule survives. Message us and we'll talk it through.
This is an opinion piece reflecting FHC's perspective. It is general information, not legal advice. Consult qualified counsel regarding your obligations under Florida and federal law.
Sources
59A-35.112 Data Breach Transparency — draft text, Florida Agency for Health Care Administration
Notice of Development of Rulemaking: 59A-35.112 — AHCA
Florida's Proposed Data Breach Transparency Rule — Fox Rothschild, Health Care Law Matters
Florida Considers Rule to Improve Healthcare Data Breach Transparency — HIPAA Journal
HCAF Submits Comments on AHCA's Proposed Data Breach Transparency Rule — Home Care Association of Florida
