Florida med-spa medical records: who owns them and how to request access
For care within Florida §456.057's practitioner and setting scope, identify the records owner or custodian and request the complete existing record in writing. HIPAA may overlap only for covered entities, and other professions or facilities can follow different access rules.
For treatment within Florida §456.057’s practitioner and setting scope, identify the statutory records owner or current custodian and request the complete existing medical record in writing. The section excludes specified professions from its records-owner definition and does not apply to chapter 395 facilities; HIPAA can add an access layer only when the clinic or professional is a covered entity or business associate.12
The practical goal is continuity: know who controls the record, what exists, which format is available, when it will be furnished, what fee applies, where it goes if the clinician leaves, and how missing details are handled.
The storefront, platform, and records owner may be different entities
A med-spa visit can involve a trade name, management company, booking platform, medical practice, prescriber, treating nurse or physician assistant, laboratory, pharmacy, supervising or collaborating clinician, photography vendor, and payment processor. The business collecting money is not automatically the statutory “records owner.”
Florida §456.057 defines records ownership and control for licensed health-care practitioners within its scope and addresses owners, employees or contractors, and custodians.1 Its records-owner definition excludes enumerated professions, and the section does not apply to chapter 395 facilities; a different professional-practice or facility law may therefore control the request. Ask the clinic to provide:
- legal name and address of the records owner;
- license number and profession of the responsible practitioner;
- privacy contact if HIPAA applies;
- current records custodian and request channel;
- portal, secure email, paper, or other available formats; and
- where pharmacy, laboratory, imaging, anesthesia, or outside-facility records must be requested separately.
Do not send sensitive information to an unverified social-media account or general text line. Use the practice’s published request process and retain delivery confirmation.
Florida access and HIPAA access overlap but are not identical
Florida law requires covered licensed practitioners to timely furnish examination and treatment reports and records on request, subject to defined exceptions and copying rules. It says access may not be conditioned on payment of an unpaid treatment balance.1
HIPAA gives individuals a right to inspect or obtain copies of protected health information in a covered entity’s designated record set, which can include medical and billing records and other information used to make decisions about the person.23 HIPAA generally requires action within 30 calendar days and permits one written 30-day extension when conditions are met. Florida may be more specific or protective in a particular circumstance.
| Layer | When it may apply | Do not assume |
|---|---|---|
| Florida health-profession law | A Florida-licensed practitioner and record within the statute and applicable board rules | That every wellness business or nonmedical service falls within the same chapter |
| HIPAA Privacy Rule | A covered health plan, clearinghouse, or qualifying health-care provider conducting covered transactions, plus applicable business associates | That every clinic accepting cash is covered or that the word “HIPAA compliant” proves status |
| Profession-specific board rule | Physician, osteopathic physician, nurse, dentist, electrologist, or another profession under its own rules | That one profession's retention period controls every clinician at the address |
| Business contract or privacy policy | Portal, photography, membership, app, or vendor terms | That private terms can waive mandatory access rights |
If the clinic denies access, ask for the reason and governing provision in writing, whether review is available, and which parts can still be produced. HIPAA has narrow exclusions and reviewable or unreviewable denial categories; “our lawyer is reviewing it” is not a universal suspension of access.
Request the complete existing record, then list priority items
“Send my chart” is valid but can produce an ambiguous export. Use a date range and ask for the complete existing medical and billing record, including records used to make treatment decisions. Then add a nonexclusive priority list tailored to the service.
This is a request for items if they exist. The access statutes do not retroactively require a clinic to create every ideal product or device field. Missing documentation is itself a continuity issue; ask the responsible practitioner to clarify what can be reconstructed from invoices, inventory, labels, images, or vendor records without altering the original chart.
Format and fees should be resolved before production
Under HIPAA, a covered entity generally must provide the requested form and format if readily producible or agree on a readable alternative, and fees are limited to reasonable cost-based components allowed by the rule.23 Florida law and board rules can cap or structure copying charges for covered practitioners.
Ask for:
- electronic copy in a readable common format;
- native files for images or device reports when readily producible;
- searchable text rather than screenshots when possible;
- date range and whether records are archived off-site;
- estimated fee and calculation before fulfillment;
- secure direct transmission to another provider if desired; and
- index or explanation of systems not included in the portal export.
A portal view is not necessarily the full designated record set. Portals often omit internal messages, original images, billing details, scanned consents, device files, or older records.
The record can be sent directly to another person or practice
HIPAA allows an individual to direct a covered entity to transmit a copy to a designated person or entity when the request meets the rule’s requirements.3 Florida provisions also address furnishing records and transfer. Use the recipient’s exact legal or practice name, address or secure destination, and requested scope.
For a complication or surgery consultation, send records early and keep a personal copy. A new clinician may need the exact filler, toxin, implant, device, energy settings, medication, compounder, lot, dates, images, and response—not a marketing receipt.
Authorization to disclose records to someone else is different from a patient’s own access request. Ask which process the clinic is using so an unnecessary broad release does not delay production.
Clinic closure or clinician departure requires a custodian trail
Florida §456.058 requires boards to adopt rules for disposition of records when a practitioner terminates practice, relocates, or dies, including at least a defined retention floor in those events.4 It is not a universal statement that every Florida medical record may be destroyed after two years. Applicable profession, record type, event, contract, payer, litigation hold, and other law can change retention.
Physician-specific Rule 64B8-10.002 addresses notice, custody, access, and disposition when a medical practice relocates or terminates.5 Other boards can have different rules. If a clinic closes:
- search the named practitioner’s current license address;
- check the clinic’s website, posted notice, patient notice, and Florida board records;
- ask the former practice, records custodian, management entity, and receiving practice;
- preserve evidence of each request; and
- use the applicable board or privacy complaint route if access remains unresolved.
The departure of an injector does not necessarily transfer record ownership to that person. Ask who retained legal custody.
Privacy, marketing photos, and record access are separate
Treatment consent, photography consent, marketing authorization, HIPAA authorization, and access rights answer different questions. A person may request clinical photographs that are part of the designated or medical record while separately challenging ongoing promotional use under an applicable authorization.
The privacy and photos guide explains revocation and vendor questions. Do not demand deletion of the clinical chart when the actual goal is to stop marketing; legal retention and accurate care history can require preserving the medical record.
Ask the practice to identify which photos are clinical, which were copied for marketing, where each is stored, and which authorization governs disclosure or publication.
Build a request that can be audited
- Identify the owner and custodian. Use the licensed practitioner's name, legal practice entity, current address, privacy contact, and closure or transfer notices.
- Choose the legal request path. State that the request is the patient's access request under applicable Florida law and HIPAA when the entity is covered.
- Define scope without narrowing it accidentally. Request the complete existing medical and billing record for a date range, then list priority treatment, product, device, image, consent, and communication items.
- Agree on format and fee. Ask for readable electronic files, native images when producible, an estimate, delivery method, and explanation of excluded systems.
- Track the timeline. Keep the signed request, delivery confirmation, responses, extension or denial, fee notice, files received, and missing-item follow-up.
- Send continuity records onward. Maintain a personal copy and transmit the exact material another clinician needs without relying on a portal that may later close.
The decisive request is: “Please identify the records owner and custodian and provide my complete existing medical and billing record for these dates, including the product, device, consent, photo, prescription, laboratory, adverse-event, and communication records maintained about my care.”
Sources
- Florida Statutes. Section 456.057: ownership and control of patient records; report or copies of records to be furnished. Current records-owner definition, access and copying duties, fee and unpaid-balance boundaries, confidentiality, custodian, departure, and transfer provisions for covered Florida practitioners. Accessed .
- U.S. Department of Health and Human Services. Individuals' right under HIPAA to access their health information. Current designated-record-set scope, form and format, timing, extension, fee, denial, and transmission guidance for HIPAA covered entities. Accessed .
- Code of Federal Regulations. 45 C.F.R. § 164.524: access of individuals to protected health information. Current federal regulatory text for HIPAA access, exclusions, reviewable and unreviewable denials, timing, form, transmission, and fees. Accessed .
- Florida Statutes. Section 456.058: disposition of medical records. Board-rule requirements for records disposition after a practitioner terminates practice, relocates, or dies; not a universal retention period for every record. Accessed .
- Florida Administrative Code. Rule 64B8-10.002: termination or relocation of physician practice. Physician-specific notification, retention, and disposition rules; other professions can have different board rules. Accessed .