Florida healthcare organizations that rely on offshore vendors for claims processing, billing, IT services, call center services, or other administrative functions face a convergence of regulatory pressure that did not exist even a year ago. In March 2026, the Florida Office of Insurance Regulation (OIR) suspended a third-party administrator for routing sensitive Medicare Advantage data to unlicensed entities in India and the Philippines. That enforcement action, grounded in the Florida Insurance Code, is the most visible signal of a broader trend: Florida is building out multiple, overlapping regulatory frameworks that constrain how and where patient data may be handled outside the continental United States. This post examines the three frameworks providers need to understand, where they overlap, and where they diverge.
Framework 1: The Florida Insurance Code and the Mirra Health Enforcement Action
The most immediate development is the OIR’s Immediate Final Order against Mirra Health Care, LLC, issued March 23, 2026 (OIR Index: 2026-25, Case No. 402554-26), pursuant to Section 626.891(3), Florida Statutes.
Mirra Health, a Brooksville-based third-party administrator originally licensed in 2012, performed core administrative services for three Florida domestic health maintenance organizations regulated under Chapter 641, Florida Statutes. The OIR’s investigation determined that Mirra Health had unilaterally delegated claims-processing and other functions to four unlicensed offshore entities: Data Marshall, BluOne India, LLP (“BluOne”), HOM India Private Limited (“HOM”), and Saibervet, LLC (“Saibervet”). BluOne had provided claims processing services from July 20, 2017, until March 1, 2024, when HOM, BluOne’s wholly owned subsidiary, assumed the renewal agreement. Saibervet began providing services on June 4, 2025. Mirra Health communicated to the Office in writing that it did not know the effective date of its contract with Data Marshall, and its agreements with Data Marshall, HOM, and Saibervet lacked expiration dates.
In total, Mirra Health provided the offshore entities with access to the sensitive claims and enrollment data of 23,119 Florida Medicare Advantage enrollees, the substantial majority of whom were enrolled in special needs plans: Chronic Condition Special Needs Plan (C-SNP) participants with severe or disabling chronic conditions as defined in 42 C.F.R. § 422.2, Dual Eligible Special Needs Plan (D-SNP) participants entitled to both Medicare and Medicaid, and Institutional Special Needs Plan (I-SNP) participants who require services in long-term care skilled nursing facilities or intermediate care facilities for individuals with intellectual disabilities.
The OIR’s Conclusions of Law identified several specific violations:
- Missing statutory cancellation provisions. Section 641.234(3), Florida Statutes, requires HMO administrative service agreements to contain a provision mandating “that the contract shall be canceled upon issuance of an order by the Office of Insurance Regulation pursuant to this section.” None of Mirra Health’s agreements contained this language.
- Failure to produce contracts during examination. Mirra Health failed to produce its contract with Data Marshall when requested, violating Section 626.884, Florida Statutes.
- Incompetence and untrustworthiness. The Office concluded that Mirra Health’s actions demonstrated the company is “not competent or trustworthy, as required by sections 626.8805(5), .891(2)(e),” Florida Statutes.
The order found that Mirra Health’s practices created “ongoing, unauthorized exposure of sensitive claims and enrollment data to foreign entities beyond the Office’s regulatory reach and without any contractual mechanism for immediate termination, thereby depriving the Office and the Florida HMOs of the ability to protect these vulnerable residents.” The suspension took effect on the thirty-first day after execution for a period not to exceed one year. Mirra Health was permitted to continue services through the thirtieth day to minimize disruption and was required to send written notice by certified mail and electronic mail to each Florida HMO within ten days.
Importantly, the order did not find that offshore delegation is categorically prohibited under the Insurance Code. The violations were the unauthorized nature of the delegation, the absence of required contractual provisions, and the failure to cooperate with the examination. An administrator that properly obtains written HMO approval, includes the cancellation provisions required by Section 641.234(3), and maintains complete contractual records would be in a materially different position.
Framework 2: The Florida Electronic Health Records Exchange Act (Section 408.051, Florida Statutes)
Separate from the Insurance Code, Florida imposes an independent data localization requirement on healthcare providers through Section 408.051(3), Florida Statutes, enacted through Chapter 2009-172, Laws of Florida, and substantively amended by Chapter 2023-33, Laws of Florida. This statute requires that any health care provider using certified electronic health record technology ensure that all patient information stored in an offsite physical or virtual environment, including through a third-party or subcontracted computing facility or an entity providing cloud computing services, is “physically maintained in the continental United States or its territories or Canada.”
“Health care provider” under Section 408.051(2)(d) encompasses every entity and individual regulated by AHCA, including hospitals (Chapter 395, Florida Statutes), ambulatory surgical centers (Part I of Chapter 395), nursing homes (Part II of Chapter 400), assisted living facilities (Part I of Chapter 429), home health agencies (Part III of Chapter 400), health care clinics (Part X of Chapter 400), hospices (Part IV of Chapter 400), home medical equipment providers (Part VII of Chapter 400), and clinical laboratories, among others. The definition also includes practitioners licensed under Chapters 458 (medicine), 459 (osteopathic medicine), 460 (chiropractic), 464 (nursing), 465 (pharmacy), 466 (dentistry), and other professional practice acts within the Florida Department of Health’s Division of Medical Quality Assurance. As a condition of AHCA licensure, applicants must submit an affidavit under penalty of perjury attesting to compliance with Section 408.051(3), and must remain in compliance or face disciplinary action by the Agency.
This statute was not cited in the Mirra Health order, which was grounded entirely in the Insurance Code. However, Section 408.051(3) creates an independent compliance obligation that applies to a different and broader set of entities. A physician practice, hospital, or home health agency that routes patient records to an offshore cloud server could face AHCA disciplinary exposure under Section 408.051(3) even if no Insurance Code violation is implicated.
It is also worth noting what Section 408.051(3) does not restrict. The statute’s data localization requirement applies to patient information that is “stored” in an offsite environment. It does not, by its terms, prohibit offshore access to, processing of, or transmission of patient data where no offsite storage occurs. A subcontractor located outside the continental United States who accesses a U.S.-hosted system in real time, without downloading or storing patient information locally, does not necessarily implicate the statute’s geographic storage mandate. That said, the practical line between “access” and “storage” is not always clean. Temporary caching, local downloads, screen captures, and offline processing can blur the distinction.
Framework 3: AHCA’s Proposed Data Breach Transparency Rule (Proposed Rule 59A-35.112)
A third framework, still in development, reinforces the same direction. AHCA’s Proposed Rule 59A-35.112 would impose twenty-four-hour incident reporting obligations and written continuity plan requirements on virtually every AHCA-licensed provider. Relevant to offshore data, the proposed rule would independently mandate that off-site data backups not be stored outside the continental United States, paralleling the geographic restriction in Section 408.051(3) but extending it specifically to backup infrastructure. The rule also defines “data” far more broadly than HIPAA or FIPA, meaning that unauthorized offshore access to non-clinical operational data could trigger the reporting obligation. For a detailed analysis of the proposed rule’s scope, reporting timeline, continuity plan requirements, and industry feedback, see my earlier post, Florida’s Proposed Data Breach Transparency Rule: New Reporting and Continuity Planning Requirements for AHCA-Licensed Providers.
How the Three Frameworks Interact
These three regulatory threads are distinct in their legal authority, scope, and enforcement mechanism, but they point in the same direction: Florida regulators are increasingly focused on where patient data goes and who has access to it.
- The Insurance Code (Sections 626.891, 641.234, 626.884) governs administrators and their contractual relationships with HMOs. Enforcement is through the OIR. The Mirra Health action shows this framework being used aggressively in the offshore delegation context.
- Section 408.051(3) governs AHCA-licensed providers directly and restricts where patient data may be stored. Enforcement is through AHCA licensure and the affidavit requirement.
- Proposed Rule 59A-35.112 would add a reporting and continuity planning layer, including a geographic restriction on backup storage and a twenty-four-hour incident reporting clock that could be triggered by offshore data exposure.
A healthcare organization that contracts with an HMO, holds an AHCA license, and maintains data backups could be subject to all three simultaneously. No single framework covers the entire landscape, and compliance with one does not guarantee compliance with the others.
Practical Compliance Considerations
For Florida healthcare providers and administrators, the convergence of these frameworks raises several immediate priorities.
- Confirm data storage locations across all environments. Section 408.051(3) requires onshore storage of patient information. Proposed Rule 59A-35.112 would independently require onshore backup storage. Providers should verify that their EHR systems, cloud providers, claims processors, billing companies, and backup infrastructure all satisfy these geographic requirements.
- Review vendor contracts for delegation and subcontracting provisions. The Mirra Health order turned on the absence of required contractual provisions and the failure to obtain advance written approval. Providers should assess whether their vendor agreements include advance notice and consent requirements for subcontracting, the cancellation provisions required by Section 641.234(3) for HMO-related contracts, and clear restrictions on where data may be stored and processed.
- Audit payor agreements for offshore restrictions. Certain third-party payor agreements expressly prohibit offshore data transmission. A provider whose vendor uses offshore subcontractors may be in breach of payor agreements it did not know contained these restrictions.
- Map the full data-processing chain. The OIR emphasized that Mirra Health’s delegation placed data beyond regulatory reach. Providers should map their complete vendor and subcontractor chain to identify whether any downstream entities fall outside the jurisdiction of U.S. regulators.
- Distinguish storage from access. Section 408.051(3) restricts offshore storage, not necessarily real-time offshore access to U.S.-hosted systems. Organizations that use offshore personnel for non-storage functions should ensure that system configurations prevent local downloading or caching and document those controls in vendor agreements. The practical line between “access” and “storage” requires attention from both IT and legal counsel.
Conclusion
Florida is building a multi-layered regulatory framework around offshore health data that draws on the Insurance Code, the Florida Electronic Health Records Exchange Act, and forthcoming AHCA rulemaking. The Mirra Health suspension is the most visible enforcement action to date, but it is not the only source of regulatory exposure. Providers and health plans should evaluate their vendor relationships, data storage configurations, and contractual protections against all three frameworks now, rather than waiting for the next enforcement action to clarify the boundaries.
For further information regarding Florida’s offshore data compliance requirements, please contact the author at mclare@foxrothschild.com or 941-308-2676.
Mark Clare is an attorney and member of the Health Law Practice Group and the Health Care Transactions Practice Group at Fox Rothschild LLP. Mark is based in Sarasota, Florida and specializes in assisting clients with corporate, health law, and M&A matters.