on 4 November, 2026
HIPAA and Florida Privacy Law for Medical Office Copiers
A copier that scans, copies or faxes patient records holds ePHI, so the HIPAA Security Rule applies, and Florida's s. 501.171 adds a 30-day breach clock. Here is what each requires at the machine.
A copier or multifunction printer that copies, scans or faxes patient records stores electronic protected health information, so the HIPAA Security Rule applies to it the same way it applies to a laptop or a server. In Florida, the Florida Information Protection Act (section 501.171 of the Florida Statutes) adds a duty to take reasonable measures to protect personal information, a disposal requirement and a 30-day breach notice deadline. This guide covers both for medical and dental offices in Tampa Bay and across Florida; it is general information, not legal advice, so confirm your obligations with healthcare counsel.
Why is an office copier a HIPAA issue?
The Federal Trade Commission's guide to digital copier data security explains that the hard drive in a digital copier stores data about the documents it copies, prints, scans, faxes or emails. In a medical office, that means referrals, lab results, insurance cards and intake forms. The FTC also notes that deleting files or reformatting the drive does not actually remove the data.
The U.S. Department of Health and Human Services (HHS) has already brought an enforcement case over it. In August 2013, its Office for Civil Rights announced a $1,215,780 settlement with a health plan that returned multiple photocopiers to a leasing agent without erasing the hard drives, a disclosure affecting up to 344,579 individuals. OCR's investigation indicated the plan had not included the ePHI on those copier drives in its risk analysis and had no policies for returning the drives. HHS still lists the FTC's copier guidance, under the title "Safeguarding Electronic Protected Health Information on Digital Copiers," on its Security Rule guidance page.
Which HIPAA Security Rule standards apply to copiers and fax?
Five parts of the Security Rule (45 CFR Part 164, Subpart C) map directly onto a copier, MFP or fax server.
| Standard | Citation | What it means at the copier |
|---|---|---|
| Risk analysis (required) | 164.308(a)(1)(ii)(A) | Include every copier and MFP drive that holds ePHI |
| Device and media controls | 164.310(d)(1) | Policies for hardware holding ePHI coming into and leaving the office, including disposal and re-use (both required) |
| Access control | 164.312(a)(1) | Unique user IDs (required); automatic logoff and encryption (addressable) |
| Audit controls | 164.312(b) | Record and examine activity, such as job and access logs |
| Transmission security | 164.312(e)(1) | Protect scan-to-email and network fax in transit; encryption is addressable |
Under the device and media controls standard, disposal and media re-use are both labeled "Required." Accountability (keeping a record of hardware movements and who is responsible) and making a backup copy before equipment is moved are "Addressable."
Addressable does not mean optional. Under 45 CFR 164.306(d)(3), a practice must assess whether each addressable item is reasonable and appropriate, implement it if so, and if not, document why and put an equivalent alternative in place when that is reasonable.
What does HHS say about disposal and the copier technician?
HHS's disposal guidance says the Security Rule requires policies for the final disposition of ePHI and the hardware it is stored on, and procedures to remove ePHI before media is reused. For electronic media, HHS gives three example methods: clearing (overwriting with non-sensitive data), purging (degaussing) and destroying the media. It points to NIST Special Publication 800-88 for sanitization practices, and it says workforce members involved in disposal must be trained on the practice's procedures.
HHS's business associate guidance is just as specific. Its examples of a business associate include a technician who services a covered entity's electronic equipment that stores PHI, naming a copier, where the service involves disclosure of PHI to the technician, such as maintenance on the hardware components where PHI is stored. In that situation, 45 CFR 164.308(b) requires the practice to obtain satisfactory assurances, documented in a written contract or other arrangement (a business associate agreement), that the provider will safeguard the information.
Has the HIPAA Security Rule update been finalized?
Not as of November 2026. HHS's Office for Civil Rights issued a proposed rule on December 27, 2024, and it was published in the Federal Register on January 6, 2025, with comments due March 7, 2025. It would be the first update to the Security Rule since 2013, and HHS says it would require written policies that are reviewed, tested and updated regularly.
No final rule has been published in the Federal Register. The federal government's current regulatory agenda lists the update as a long-term action with final action projected for July 2027. HHS states that the current Security Rule remains in effect during the rulemaking, so plan to today's rule and watch for changes.
What does Florida's Information Protection Act add?
Section 501.171 applies to businesses that acquire, maintain, store or use personal information, and its definition of personal information includes a person's name combined with medical history, condition, treatment or diagnosis, or with a health insurance policy or subscriber number. Information that is encrypted or otherwise rendered unusable is excluded from the definition.
- Reasonable measures: every covered entity and third-party agent must take reasonable measures to protect and secure electronic personal information.
- Disposal: customer records must be disposed of when no longer retained by shredding, erasing or otherwise making the personal information unreadable.
- Notice to individuals: no later than 30 days after the determination of a breach or reason to believe one occurred, with up to 15 more days if the entity gives the Department of Legal Affairs good cause in writing within those 30 days.
- Notice to the state: breaches affecting 500 or more individuals in Florida must be reported to the Florida Department of Legal Affairs within 30 days.
- Vendors: a third-party agent that suffers a breach must notify the covered entity within 10 days.
- Credit bureaus: notice to more than 1,000 individuals at one time also triggers notice to the nationwide consumer reporting agencies.
The deadlines differ from HIPAA's, so it helps to see them side by side.
| Notice | HIPAA Breach Notification Rule | Florida s. 501.171 |
|---|---|---|
| Affected individuals | Without unreasonable delay, no later than 60 calendar days after discovery | No later than 30 days after determination of the breach |
| Regulator | HHS: at the same time as individual notice if 500 or more; within 60 days after year-end if fewer | Department of Legal Affairs within 30 days if 500 or more Floridians |
Florida treats notice given under the rules of a covered entity's primary federal regulator as compliance with its individual notice requirement, and a timely copy of that notice to the Department of Legal Affairs satisfies the state notice requirement. How that applies to a specific breach is a question for counsel. Failure to give required notice can bring civil penalties of up to $500,000 per breach.
A copier checklist for Tampa Bay medical and dental offices
Referrals, records requests and faxes move constantly between Tampa Bay's hospitals and specialty practices and the offices that refer to them, and much of that paper passes through a copier. From a two-chair dental office in St. Petersburg to a specialty group with clinics across Hillsborough and Pinellas, the same steps apply.
- Add every copier, MFP, scanner and fax to the risk analysis. This is the gap HHS cited in its photocopier settlement.
- Encrypt the drive and turn on overwrite. The FTC recommends both and advises securely overwriting the entire drive at least once a month. Encryption also matters under Florida law, which excludes encrypted information from its definition of personal information.
- Require login at the machine. Use badge or PIN authentication, unique user IDs and secure release, so printed charts and lab results wait until the right person is at the copier.
- Keep and review job logs. The audit controls standard and the Security Rule's information system activity review call for recording and reviewing activity.
- Secure scan and fax workflows. Send scans to the EHR or to encrypted destinations, not open email. Moving to cloud fax delivers inbound faxes to a controlled inbox instead of a shared output tray.
- Sign a business associate agreement with any copier service provider whose service involves disclosure of PHI, such as maintenance on the components where PHI is stored.
- Track machines in and out. Record when a copier arrives, moves or leaves, and who is responsible.
- Sanitize before return or disposal. Check whether your lease says you keep the drive or the provider overwrites it, then get a written record of sanitization tied to the serial number. Do not pull the drive yourself; the FTC warns that removing it without replacing its firmware can leave the machine inoperable.
- Train staff on disposal. HHS expects anyone involved in disposing of PHI to know the practice's procedures.
Talk to a local DEXpert
DEX Imaging is headquartered in Tampa and supports medical and dental offices across Tampa Bay, including from our St. Petersburg office. Our print security service covers drive encryption, secure overwrite and secure print release. When a machine is retired or returned, your DEX rep will ask whether you want its hard drive wiped, and DEX will wipe it for you if you do. The DEX Declaration guarantees a four-hour response to qualifying emergency service calls. Learn how DEX works with healthcare organizations and multi-location clinics, or request a quote.
Frequently asked questions
Does HIPAA require copier hard drives to be encrypted?
Under the current Security Rule, encryption is an addressable specification, so a practice must assess it and either implement it or document an equivalent alternative. The FTC recommends encrypting copier drives, and Florida's statute excludes encrypted information from its definition of personal information.
Is our copier repair technician a business associate?
HHS says a technician who services equipment that stores PHI, such as a copier, is a business associate when the service involves disclosure of PHI, for example maintenance on the components where PHI is stored. In that case the Security Rule requires a written business associate agreement.
Has the proposed HIPAA Security Rule update taken effect?
No. The proposed rule was published January 6, 2025, no final rule had been published as of November 2026, and HHS says the current rule remains in effect.
How fast must a Florida practice give breach notice?
Florida's statute sets 30 days for notice to affected individuals, and 30 days for notice to the Department of Legal Affairs when 500 or more Floridians are affected, though notice given under HIPAA's rules can count toward Florida's requirements. HIPAA's outer limit for individual notice is 60 calendar days after discovery.
Is deleting scans from the copier enough before we return it?
No. The FTC says deleting data or reformatting the drive does not actually remove it, and HHS requires procedures to remove ePHI before media is reused or disposed of.