Texas medical privacy act and HIPAA: what Texas adds

Who this is for. Small therapy, medical and dental practices in Texas that already use HIPAA as their baseline. It covers the Texas rules that most often change day-to-day work; it is not a full survey of Texas law, and it does not cover licensing-board rules, mental health records under Health and Safety Code chapter 611, or minors’ consent — see “Decide with an attorney” below. Checked against the official text on October 17, 2026; kit references are to our 1.0 release. The kit itself does not change: this page tells you what to adapt in your copy.

Who the Texas law covers

HIPAA covers health plans, clearinghouses, providers that conduct standard transactions electronically, and their business associates. Texas defines a covered entity more broadly: any person who, for commercial, financial or professional gain, for fees or dues, or on a nonprofit or pro bono basis, engages with real or constructive knowledge in assembling, collecting, analyzing, using, evaluating, storing or transmitting protected health information — including business associates, schools, health researchers, clinics, providers and anyone who maintains a website — any person who comes into possession of PHI, and their employees, agents and contractors who handle it (Tex. Health & Safety Code 181.001(b)(2)). Chapter 181 then exempts some entities and activities, fully or in part (subchapter B, 181.051–181.060). A practice outside HIPAA, for example one that never bills insurance electronically, can still be covered in Texas.

Texas requires HIPAA covered entities to comply with HIPAA, and covered entities under its own definition to comply with chapter 181, subject to those exemptions (181.004).

What Texas adds — and where to change the kit

Topic	What Texas requires	How it differs from HIPAA	What to do	Where in the kit
Staff training (181.101)	Train employees on state and federal law on PHI as their duties require, no later than 90 days after hire; retrain within a reasonable time after a material change in that law that affects their duties, and no later than one year after the change takes effect. Each employee signs a statement (paper or electronic) verifying they completed the training, kept for six years from signing	HIPAA requires training “within a reasonable period” and documentation, with no fixed deadline and no signed statement	Keep the kit’s earlier deadlines — privacy training within your set number of days and before working on one’s own, security training before access to ePHI; 90 days is only Texas’s outer limit. Add Texas law to the session content. In Texas the signed completion statement is mandatory: record the date, what the training covered and where the statement is kept. A signed policy acknowledgment does not replace it	POL-TRAINING, “Training on our privacy policies” and “Recording training” — add the Texas statement; TRN-SESSION — add Texas topics; FRM-TRAIN-LOG — date and content; FRM-ACK is marked recommended because HIPAA does not require it, but in Texas add “I completed training on state and federal law on protected health information on [date]” and treat that signature as required, or keep a separate signed statement; REG-STATE-LAW, new row “Texas training (181.101)”
Electronic copy of an EHR (181.102)	A provider whose electronic health record system can fulfil the request provides an electronic copy within 15 business days of a written request, unless the person agrees to another form; denials follow the federal access exceptions (45 CFR 164.524)	HIPAA allows 30 calendar days, with one 30-day extension	Track the applicable Texas deadline separately. The kit’s automatic deadline and overdue checks use federal HIPAA timing and do not implement the Texas deadline — and a federal extension does not extend the Texas one. Do not overwrite formula cells	FRM-ACCESS-GUIDE, “Before you use this form”; REG-ACCESS-LOG, Requests — add a “Texas due date (15 business days)” column after the last column and check it yourself; REG-STATE-LAW, “Patient access: deadline and copy fees”
Notice of electronic disclosure (181.154(a))	Notify individuals that their PHI is subject to electronic disclosure. A general notice is enough, posted in one of these places: your place of business, your website, or anywhere individuals are likely to see it	No separate notice in HIPAA	Post a one-line notice. We recommend both the office, next to your Notice of Privacy Practices, and the website; the law needs one	FRM-NPP-GUIDE, posting step; POL-WEB; REG-STATE-LAW, new row “Texas notices to post”
Authorization for electronic disclosure (181.154(b)–(d))	A separate authorization for each electronic disclosure of PHI — written, electronic, or oral if you document it in writing — except disclosures to another covered entity (under the Texas or Insurance Code definition) for treatment, payment, health care operations or certain insurance or HMO functions, and disclosures otherwise authorized or required by state or federal law. The attorney general publishes a standard form; other forms that comply are allowed	HIPAA needs an authorization only where the Privacy Rule requires one, and then always signed	Before an electronic disclosure outside treatment, payment or operations with another covered entity, check whether another law authorizes or requires it; if not, get an authorization for that disclosure. Documented oral authorization can satisfy this Texas provision, but not a disclosure for which HIPAA requires a signed authorization under 45 CFR 164.508	FRM-AUTH-GUIDE, “Before you use this form”; POL-PRIVACY; REG-STATE-LAW, new row “Texas electronic disclosures”
Marketing (181.152; definition 181.001(b)(4))	Texas has its own definition of marketing. Clear and unambiguous written or electronic permission is required to use or disclose PHI for any marketing communication, except a face-to-face communication, a promotional gift of nominal value, a communication necessary to administer a patient-assistance or prescription-drug savings or discount program, and a communication made at the individual’s oral request — which needs clear and unambiguous oral permission and must stay within its scope. Mailed marketing goes in an envelope showing only names and addresses, states the sender’s name and a toll-free number and explains how to opt out; opt-outs are honored within 45 days	HIPAA defines marketing differently and requires an authorization with narrower exceptions; no envelope or opt-out rules of this kind	Check each communication against both definitions. These Texas exceptions do not waive a HIPAA authorization requirement: apply both laws. Add the mailing rules to any marketing mail	FRM-AUTH-MKT and its guide; REG-STATE-LAW, “Testimonials, photos and names in marketing”
Disclosures for remuneration (181.153)	A covered entity may not disclose PHI for direct or indirect remuneration, except to another covered entity for treatment, payment, health care operations or certain insurance or HMO functions — where the remuneration for the insurance or HMO function may not exceed the reasonable costs of preparing or transmitting the PHI — or as otherwise authorized or required by law	HIPAA allows a sale of PHI with an authorization that states the remuneration	Do not disclose PHI for payment outside these exceptions; route any arrangement that involves payment for PHI to your attorney	POL-PRIVACY; REG-STATE-LAW, new row “Texas: disclosures for remuneration”
Posted instructions (181.105, from September 1, 2025)	Post prominently, on your website and at your facilities, instructions for requesting records, contacting your licensing or disciplinary authority, and filing a consumer complaint with the attorney general. An entity that performs claims processing, data processing, data analysis, utilization review or billing on behalf of another covered entity that provides direct care to consumers is exempt	No such duty in HIPAA	Write the three instructions and post them in the office and on your website	FRM-COMPLAINT-GUIDE (already flags this); POL-WEB; REG-STATE-LAW, “Texas notices to post”
Breach notification (Tex. Bus. & Com. Code 521.053)	Texas has its own trigger: a “breach of system security” — unauthorized acquisition of computerized data that compromises sensitive personal information, which includes health information (521.002). Notify affected individuals without unreasonable delay and no later than 60 days after you determine the breach occurred. If at least 250 Texas residents are involved, notify the attorney general through its online form as soon as practicable and no later than 30 days after that determination. If you are required to notify more than 10,000 people at one time, also notify the nationwide consumer reporting agencies, without unreasonable delay, of the timing, distribution and content of the notices. Texas allows its own law-enforcement delay (521.053(d)), which expressly concerns the notices under subsections (b) and (c); do not assume it extends the attorney-general deadline under subsection (i)	HIPAA’s breach test, its 60 days from discovery and its notice to HHS are separate; a HIPAA low-probability-of-compromise conclusion or a HIPAA law-enforcement delay does not decide the Texas duty	Assess the Texas breach separately from the HIPAA one. Record the HIPAA discovery date and the Texas determination date separately. Do not wait for day 30 or day 60 — the deadlines are outer limits	POL-INCIDENT, “Notifications”; BRK, “State breach laws checked, and their deadlines”; REG-INCIDENT; REG-STATE-LAW, “State breach notification law”
AI disclosure in health care services (HB 149, Bus. & Com. Code 552.051, from January 1, 2026)	When an AI system is used in relation to health care services or treatment, provide a clear, conspicuous, plain-language disclosure of that use to the recipient or their personal representative no later than the date the service or treatment is first provided. In an emergency, provide it as soon as reasonably possible	No AI rule in HIPAA	Treat it as its own checkpoint, separate from 183.005 — it is not limited to diagnostic AI and can reach note-taking and other AI tools used in care	REG-STATE-LAW, “AI note-taking and ambient scribes…”

Texas EHR rules (Health and Safety Code chapter 183, SB 1188)

SB 1188 generally applies chapter 183 to electronic health records prepared on or after September 1, 2025. Its storage-location requirement (183.002) applies from January 1, 2026, regardless of when the record was prepared. Section 3 of the act lets an affected state agency delay implementing a provision while it obtains a federal waiver or authorization it considers necessary; this is not an automatic extension for practices.

Topic	What Texas requires	How it differs from HIPAA	What to do	Where in the kit
Where electronic health records are kept (183.002, SB 1188; from January 1, 2026)	Electronic health records under your control that contain patient information must be physically maintained in the United States or a U.S. territory — including records stored by a third-party or subcontracted computing facility or a cloud provider.	No location rule in HIPAA	Ask each EHR, cloud, backup and IT vendor where the data is stored and record the answer. This is a storage-location rule; whether remote access from abroad is affected is a question for your attorney	REG-VENDOR, Notes — “data stored in the U.S.: confirmed [date]”; RA-WB, “ePHI inventory” and “Risk register”; POL-VENDOR; REG-STATE-LAW, new row “Texas: EHR data location”
AI in diagnosis (183.005, SB 1188)	A practitioner may use artificial intelligence for diagnostic purposes, including recommendations on a diagnosis or a course of treatment, if acting within the scope of their license, the particular use is not otherwise restricted or prohibited by law, and they disclose that use to patients; they must review AI-created records under Texas Medical Board standards	No AI rule in HIPAA	If AI tools help with diagnosis or treatment recommendations, tell patients and review the records they create	REG-STATE-LAW, “AI note-taking and ambient scribes…”; POL-TELEHEALTH
Minors’ records (183.006, SB 1188)	The EHR system must allow a minor’s parent, managing conservator or guardian immediate and complete access to the minor’s electronic health record, except parts to which access is restricted by state or federal law or a court order	HIPAA defers to state law on parents’ access	Check the statute’s definition of a minor, who counts as the parent or managing conservator, and which parts of the record are restricted — for example confidential services the minor consented to — before you set up access. Don’t simply open full portal proxy access	POL-MINORS, “Our state’s rules”; FRM-ACCESS-GUIDE; REG-STATE-LAW, “Minors”
Metabolic health and diet; credit and voter information (183.003, 183.004)	The EHR must offer a way to record communications between covered entities about metabolic health and diet in treating chronic disease or illness (183.003). Do not collect, store or share credit-score or voter-registration-status information in the EHR (183.004)	No such rules in HIPAA	Ask your EHR vendor how its Texas configuration handles both, and remove any credit or voter fields your forms or integrations feed into the record	REG-VENDOR, Notes; REG-STATE-LAW, new row “Texas: EHR configuration (chapter 183)”
Biological sex fields (183.007, 183.008)	The EHR must include separate fields for biological sex, as determined from observation recorded at birth, and for a sexual development disorder, and clinical decision-support algorithms must use the appropriate field; other fields for sex or gender identity are not prohibited (183.007). The biological-sex field may be changed only to correct a clerical error, or in the case the statute describes of a diagnosed sexual development disorder, with additional documentation (183.008)	No such rules in HIPAA	Ask your EHR vendor how these fields and change limits are implemented; take questions to your vendor and your attorney rather than changing clinical data yourself	REG-VENDOR, Notes; REG-STATE-LAW, “Texas: EHR configuration (chapter 183)”

When you change a policy for Texas, record the change and its approval in POL-INDEX, “Keeping them current”.

Penalties

The attorney general may seek an injunction and civil penalties under chapter 181: up to $5,000 per violation each year if negligent, $25,000 if knowing or intentional, $250,000 if PHI was knowingly or intentionally used for financial gain, and up to $1.5 million a year for a pattern or practice; a lower, conditional cap applies in some cases (181.201(b-1)). Courts weigh the entity’s compliance history, its training and security, and its efforts to correct the problem. Licensing boards can also discipline (181.201, 181.202). For a covered entity licensed by a state agency, the attorney general may seek civil penalties only on that agency’s referral (181.201(e)).

By type of practice

• Therapy: mental health records also fall under Health and Safety Code chapter 611, which has its own confidentiality and access rules; check it before using FRM-ACCESS and the disclosure sections of POL-PRIVACY as written.
• Medical: the 15-business-day electronic access rule applies to most practices with a modern EHR; check your licensing board’s retention and copy-fee rules.
• Dental: the same access, training and posting rules apply; check the dental board’s rules on record retention and on advertising with patient photos.

Decide with an attorney

• Specific disclosures where it is unclear whether another law “authorizes” them under 181.154(c)(2). Treatment, payment and operations with another covered entity and disclosures a law requires are listed exceptions; the open questions are narrower routes HIPAA only permits.
• Minors: who may consent to care and who may see the record (Family Code and chapter 183), and how parental access fits with confidential services a minor consented to.
• EHR fields and change limits under 183.007–183.008.
• AI disclosure under both 183.005 and HB 149.
• Mental health records under chapter 611, and duty-to-warn situations.
• A breach affecting Texans and residents of other states — each state’s law may apply.
• Whether Texas law reaches a practice outside Texas that treats Texans by telehealth.

Record each decision in REG-STATE-LAW with the source and the date.