(1) A clinical record shall be maintained for each patient. The record shall include data pertaining to admission and such other information as may be required under rules of the department. A clinical record is confidential and exempt from the provisions of s. 119.07(1). Unless waived by express and informed consent, by the patient or the patient’s guardian or guardian advocate or, if the patient is deceased, by the patient’s personal representative or the family member who stands next in line of intestate succession, the confidential status of the clinical record shall not be lost by either authorized or unauthorized disclosure to any person, organization, or agency. (2) The clinical record shall be released when:(a) The patient or the patient’s guardian or legal custodian authorizes the release. The guardian, guardian advocate, or legal custodian shall be provided access to the appropriate clinical records of the patient. The patient or the patient’s guardian, guardian advocate, or legal custodian may authorize the release of information and clinical records to appropriate persons to ensure the continuity of the patient’s health care or mental health care. A receiving facility must document that, within 24 hours of admission, individuals admitted on a voluntary basis have been provided with the option to authorize the release of information from their clinical record to the individual’s health care surrogate or proxy, attorney, representative, or other known emergency contact.
(b) The patient is represented by counsel and the records are needed by the patient’s counsel for adequate representation.
(c) The court orders such release. In determining whether there is good cause for disclosure, the court shall weigh the need for the information to be disclosed against the possible harm of disclosure to the person to whom such information pertains.
(d) The patient is committed to, or is to be returned to, the Department of Corrections from the Department of Children and Families, and the Department of Corrections requests such records. These records shall be furnished without charge to the Department of Corrections.
(3) Information from the clinical record may be released in the following circumstances:(a) When a patient has communicated to a service provider a specific threat to cause serious bodily injury or death to an identified or a readily available person, if the service provider reasonably believes, or should reasonably believe according to the standards of his or her profession, that the patient has the apparent intent and ability to imminently or immediately carry out such threat. When such communication has been made, the administrator may authorize the release of sufficient information to provide adequate warning to the person threatened with harm by the patient.
(b) When the administrator of the facility or secretary of the department deems release to a qualified researcher as defined in administrative rule, an aftercare treatment provider, or an employee or agent of the department is necessary for treatment of the patient, maintenance of adequate records, compilation of treatment data, aftercare planning, or evaluation of programs.
For the purpose of determining whether a person meets the criteria for involuntary services or for preparing the proposed services plan pursuant to s. 394.4655 or s. 394.467, the clinical record may be released to the state attorney, the public defender or the patient’s private legal counsel, the court, and to the appropriate mental health professionals, including the service provider under s. 394.4655 or s. 394.467, in accordance with state and federal law.
(4) Information from the clinical record must be released when a patient has communicated to a service provider a specific threat to cause serious bodily injury or death to an identified or a readily available person, if the service provider reasonably believes, or should reasonably believe according to the standards of his or her profession, that the patient has the apparent intent and ability to imminently or immediately carry out such threat. When such communication has been made, the administrator must authorize the release of sufficient information to communicate the threat to law enforcement. A law enforcement agency that receives notification of a specific threat under this subsection must take appropriate action to prevent the risk of harm, including, but not limited to, notifying the intended victim of such threat or initiating a risk protection order. A service provider’s authorization to release information from a clinical record when communicating a threat pursuant to this section may not be the basis of any legal action or criminal or civil liability against the service provider.
(5) Information from clinical records may be used for statistical and research purposes if the information is abstracted in such a way as to protect the identity of individuals.
(6) Information from clinical records may be used by the Agency for Health Care Administration, the department, and the Florida advocacy councils for the purpose of monitoring facility activity and complaints concerning facilities.
(7) Clinical records relating to a Medicaid recipient shall be furnished to the Medicaid Fraud Control Unit in the Department of Legal Affairs, upon request.
(8) Any person, agency, or entity receiving information pursuant to this section shall maintain such information as confidential and exempt from the provisions of s. 119.07(1). (9) Any facility or private mental health practitioner who acts in good faith in releasing information pursuant to this section is not subject to civil or criminal liability for such release.
(10) Nothing in this section is intended to prohibit the parent or next of kin of a person who is held in or treated under a mental health facility or program from requesting and receiving information limited to a summary of that person’s treatment plan and current physical and mental condition. Release of such information shall be in accordance with the code of ethics of the profession involved.
(11) Patients must have reasonable access to their clinical records, unless such access is determined by the patient’s physician or the patient’s psychiatric nurse to be harmful to the patient. If the patient’s right to inspect his or her clinical record is restricted by the facility, written notice of such restriction must be given to the patient and the patient’s guardian, guardian advocate, attorney, and representative. In addition, the restriction must be recorded in the clinical record, together with the reasons for it. The restriction of a patient’s right to inspect his or her clinical record expires after 7 days but may be renewed, after review, for subsequent 7-day periods.
(12) Any person who fraudulently alters, defaces, or falsifies the clinical record of any person receiving mental health services in a facility subject to this part, or causes or procures any of these offenses to be committed, commits a misdemeanor of the second degree, punishable as provided in s. 775.082 or s. 775.083. 
