Florida suspends offshoring firm
Florida regulators suspended a health administrator for unlawfully offshoring sensitive claims data, signalling sharper state‑level enforcement on data residency and stronger demands from carriers and TPAs for US‑based, auditable data workflows. (bankinfosecurity.com)
Florida Insurance Commissioner Mike Yaworsky signed an emergency order dated March 24, 2026, immediately suspending Mirra Health Care LLC’s certificate of authority for up to one year. (floir.gov) The Office of Insurance Regulation’s investigation found Mirra disclosed claims and enrollment information for 23,119 Florida Medicare Advantage enrollees to offshore contractors. (hipaajournal.com) State filings say Mirra engaged four unlicensed service providers located in India and the Philippines to perform claims-processing functions and supplied those firms with the data necessary to carry out the work. (hipaajournal.com) The OIR concluded Mirra transferred the data without the prior authorization required under its HMO contracts and described the company’s practices as presenting an “imminent threat to the public health, safety, and welfare.” (floir.gov) Florida’s prohibition on offshore storage and access for certain patient records traces to Senate Bill 264, which went into effect July 1, 2023 and limits where specified health information may be stored or accessed. (manatt.com) Regulatory and industry trends show a parallel push for auditable, traceable claims workflows—vendors and consultants are marketing “audit-ready” claims platforms while CMS moved to stricter data-validation and enforcement policies in 2026, reinforcing why state regulators are scrutinizing offshore arrangements. ( ) Florida regulators have enforced licensure and subcontracting rules before: a May 2025 regulatory analysis cited an HMO fine of $10,000 for contracting with an unlicensed TPA, providing a recent enforcement precedent for the OIR’s action. (polsinelli.com)
