Texas practices must follow federal HIPAA plus extra Texas rules. Give patients electronic records within 15 business days. Train new staff within 90 days of hire. If a breach affects 250 or more Texans, notify the Attorney General within 30 days after you determine it happened. Keep electronic health records in the U.S. Tell patients when AI helps diagnose.
Texas healthcare providers follow two rule sets: federal HIPAA and state health privacy laws that are stricter in many ways than federal rules. Texas covered entities and business associates need to know where the laws differ and where they agree.
Texas Quick Take
HIPAA is the base rule. Texas adds more duties.
- Train new staff within 90 days of hire.
- Give patients their electronic records within 15 business days.
- Report larger breaches to the Texas Attorney General within 30 days.
- Check vendor contracts.
- Keep electronic health records stored in the United States.
- If you use AI to help diagnose or plan treatment, tell patients.
- Keep proof of each step.
This guide covers HB 300, Senate Bill 1188, Texas breach notice rules, Attorney General enforcement, and practical compliance steps for Texas providers.
Federal HIPAA in Texas: The Baseline
HIPAA’s Privacy Rule, Security Rule, and Breach Notification Rule apply to covered entities and business associates in Texas. This is true regardless of size or specialty. These federal rules set the basic standards for how covered entities must handle, secure, and disclose protected health information (PHI).
Texas does not have one health privacy law that copies HIPAA. Instead, Texas adds rules through several focused laws. When Texas law is stricter than HIPAA, the stricter rule controls.
Plain-English Texas Checklist
Start with HIPAA. Add Texas rules on top. Keep training records. Review record requests fast.
Track every vendor that handles PHI. Make sure each vendor has a signed BAA. Check where data is stored. Keep electronic health records in the United States. Texas law has no patient-consent exception.
If AI helps diagnose or plan treatment, tell the patient. If a breach affects 250 or more Texas residents, prepare the AG notice right away. Keep dates, notices, and proof in one file.
Texas State Health Privacy Laws
Texas Medical Records Privacy Act (HB 300 / Chapter 181)
House Bill 300, codified in Chapter 181 of the Texas Health and Safety Code, is the centerpiece of Texas health privacy law. Passed in 2011 and effective since 2012, it is commonly called the Texas Medical Records Privacy Act (TMRPA). HB 300 is significant for two reasons: it covers a broader range of entities than federal HIPAA, and it imposes stricter rules in several operational areas.
Who HB 300 covers: Federal HIPAA applies only to covered entities (healthcare providers, health plans, clearinghouses) and their business associates. HB 300 applies to any person or entity that assembles, collects, analyzes, uses, evaluates, stores, or transmits PHI, a definition broad enough to capture data analytics firms, app developers, health IT vendors, and third-party administrators that fall outside HIPAA’s scope. If your organization touches PHI belonging to a Texas resident, HB 300 likely applies.
SB 1188 (2025): Health Data Security and AI Rules
Senate Bill 1188 passed in 2025 and took effect on September 1, 2025. It created Chapter 183 of the Texas Health and Safety Code. It covers three areas that HIPAA does not fully cover:
- Safeguards for electronic records: Covered entities must use reasonable and appropriate administrative, physical, and technical safeguards for electronic health records. In plain words, that means people, building, and computer protections. Only staff who need the records for treatment, payment, or health care operations may access them. This is similar to the HIPAA Security Rule, but Texas can enforce it on its own.
- Ban on overseas data storage: Electronic health records must be physically kept in the United States or a U.S. territory. That includes records your cloud company or other vendors hold for you. Patient consent does not create an exception. This rule covers records stored on or after January 1, 2026.
- AI disclosure: A health care practitioner who uses AI to help diagnose must tell patients. This includes AI that suggests a diagnosis or a course of treatment. The practitioner must also review every record the AI creates.
Texas Identity Theft Enforcement and Protection Act (TITEPA)
The Texas Identity Theft Enforcement and Protection Act is in Chapter 521 of the Business and Commerce Code. It governs breach notices for sensitive personal information, including health information. SB 768 (2023) changed Chapter 521. If a breach affects 250 or more Texas residents, you must notify the Texas Attorney General. You have 30 days after you determine the breach occurred. This is stricter than HIPAA’s 60-day notice rule for mid-to-large breaches.
Mental Health Records: Texas Health and Safety Code Chapter 611
Mental health records in Texas receive an additional layer of protection under Chapter 611 of the Texas Health and Safety Code. Sharing mental health treatment information usually requires specific written consent. Texas consent rules are more detailed than HIPAA’s general authorization rules (an authorization is a signed permission form). Behavioral health providers must follow both frameworks at the same time.
How HB 300 Expands HIPAA’s Reach in Texas
Broader Definition of “Covered Entity” Under HB 300
Because HB 300 defines covered entity broadly, a vendor gets its own duties under state law too. Under HIPAA, a vendor that handles PHI for you is a business associate. It signs a business associate agreement (BAA) with you. It is also directly responsible for parts of HIPAA, such as the Security Rule. A health data analytics company may be a business associate under HIPAA and a covered entity under HB 300. If so, it must follow HB 300 itself, not only through a contract.
Stricter PHI Access Timelines: 15 Business Days vs. HIPAA’s 30 Days
HIPAA gives covered entities 30 days to respond to a patient’s request for access to their health records (with one 30-day extension). HB 300 is faster. Say a patient asks in writing for their electronic record. If your electronic health records system can produce it, you must give it to them in electronic form within 15 business days. The Texas law does not list an extension. Texas providers should set up their process to meet the 15-business-day deadline every time.
Mandatory Training Within 90 Days of Hire
HIPAA requires workforce training when policies change and “as necessary and appropriate”, a flexible but vague standard. HB 300 is more specific. New employees must finish training within 90 days of hire. Sometimes a state or federal privacy law changes in a big way (a material change) that affects an employee’s job. That employee must be retrained within a reasonable time, and no later than one year after the change takes effect. Training must cover both state and federal law on PHI, as needed for each person’s job.
Each employee must sign a statement, on paper or electronically, saying they finished training. Keep each signed statement for six years.
Consent Rules for Marketing Uses of PHI
Under HIPAA, some marketing that uses PHI is allowed if the patient signs an authorization (a permission form). HB 300 is stricter. For any marketing message that uses or shares PHI, you need clear and unambiguous permission from the patient, in writing or electronic form. Clear and unambiguous means it leaves no doubt. There are a few narrow exceptions, such as messages given face to face. Texas providers who use PHI for marketing should check that their permission forms meet HB 300’s rules.
Texas Breach Notice Rules
SB 768 (2023): 30-Day AG Notice for Breaches Affecting 250+ Texans
Effective September 1, 2023, SB 768 amended Business and Commerce Code §521.053. If a breach affects at least 250 Texas residents, you must notify the Texas Attorney General within 30 days after you determine the breach occurred. This runs concurrently with (and is stricter than) HIPAA’s 60-day rule. For breaches affecting fewer than 250 Texans, the AG notice is not required, but you must still notify affected residents “without unreasonable delay.” The outside limit is 60 days after you determine the breach occurred.
Notice to Patients
Texas requires notice to affected individuals within 60 days. Notice may be written. It may be electronic if the person agreed to electronic messages. You may use substitute notice if regular notice would cost more than $250,000, if more than 500,000 people are affected, or if contact details are missing. Substitute notice means reaching people another way, such as email, a website post, or notice in statewide media. The notice content is similar to HIPAA, but it must also meet Texas Section 521.053.
Coordinating Federal HIPAA and Texas Timelines
For any breach that affects 250 or more Texas residents, the effective deadline is 30 days. That is the Texas AG deadline, not HIPAA’s 60-day limit. Covered entities should write down the date they determined the breach occurred. Send the AG notice by day 30. Send patient notices no later than day 60. Breach response plans must reflect both timelines explicitly.
SB 1188 (2025): What Texas Healthcare Providers Must Know
Health Data Security Rules
Chapter 183 of the Texas Health and Safety Code was created by SB 1188. It requires covered entities to protect electronic health records with reasonable and appropriate administrative, physical, and technical safeguards. It also limits access to staff who need the records for treatment, payment, or health care operations. The law does not list every technical control. If you already follow the HIPAA Security Rule, including how you handle security incidents, you have a strong base. Some providers are left out of Chapter 183, such as licensed nursing facilities, assisted living facilities, and home and community support services agencies.
Ban on Overseas Data Storage
SB 1188 requires covered entities to keep electronic health records physically stored in the United States or a U.S. territory. That includes records kept by cloud companies and other outside computer vendors. Patient consent does not create an exception. The rule applies to records stored on or after January 1, 2026.
This matters if your cloud vendor, EHR platform, or backup provider uses overseas data centers. Texas healthcare organizations should review their vendor agreements and data processing addenda (the contract terms about how a vendor handles your data). Confirm where your data is stored. If any electronic health records are stored overseas, move them to the United States.
AI Deployment Restrictions in Healthcare
SB 1188 lets a health care practitioner use AI to help diagnose, including AI suggestions on a diagnosis or course of treatment. Three conditions apply. The practitioner must act within the scope of their license. No other law can bar the use. The practitioner must review every record the AI creates, using Texas Medical Board standards.
A practitioner who uses AI this way must tell patients. Organizations using AI tools should update patient notices and intake forms before the tools go live.
Texas HIPAA Penalties and Enforcement
HB 300 Penalty Structure (Up to $250,000 Per Violation)
HB 300 sets separate state penalties for breaking Chapter 181. The Attorney General files the lawsuit, and a court sets the penalty. For negligent (careless) violations, the penalty can be up to $5,000 per violation each year. For knowing or intentional violations, it can be up to $25,000 per violation each year. It can reach $250,000 per violation when PHI is knowingly or intentionally used for financial gain. If violations happen often enough to be a pattern or practice (a habit), a court may order up to $1.5 million a year.
These penalties are separate from federal HIPAA civil money penalties imposed by HHS OCR.
Federal OCR Enforcement in Texas
HHS Office for Civil Rights investigates HIPAA complaints and conducts compliance audits in Texas the same as in any other state. Federal HIPAA civil money penalties range from $145 to $2,190,294 per violation. The amount depends on how much the organization was at fault. The cap for identical violations in one calendar year is $2,190,294 (2025 inflation-adjusted amounts). Texas providers may face two investigations after a breach: OCR at the federal level and the AG at the state level. Each can lead to separate penalties.
Texas AG Enforcement Authority
The Texas Attorney General has legal power to investigate and enforce violations of HB 300 (Chapter 181), the breach notice rules under Chapter 521, and, effective Sept. 1, 2025, Chapter 183 (SB 1188). The AG may go to court to seek civil penalties and court orders that stop a violation. For Chapter 183, state licensing agencies can also discipline a covered entity that breaks the chapter three or more times.
HIPAA Compliance for Texas Healthcare Providers
Texas Hospitals and Health Systems
Large health systems operating across multiple Texas regions must ensure that their programs address HB 300’s training rules at the system level: tracking new-hire training within 90 days and retraining after material (major) changes in law for every workforce member. Their breach response plans must incorporate the 30-day AG notice trigger, and practitioners who use AI for diagnosis must tell patients, as SB 1188 requires.
Texas Dental Practices
Dental practices are HIPAA covered entities and HB 300 covered entities. The 15-business-day patient record access timeline applies to electronic dental records. Dental practices using third-party billing companies, patient communication platforms, or imaging vendors must ensure those vendors have signed BAAs (HIPAA) and that those vendors independently comply with HB 300 as covered entities in their own right, not merely as business associates.
Texas Community Health Centers and FQHCs
Federally Qualified Health Centers in Texas receive federal funding and are subject to both HIPAA and HB 300. An FQHC may connect to a health information exchange (HIE), a network for sharing patient records. Each connection is a place where HB 300 applies. FQHCs should confirm that HIE agreements cover federal and Texas privacy rules. Workforce training should also cover HB 300.
Texas Telehealth Providers
Telehealth platforms operating in Texas must comply with HB 300 regardless of where the platform company is incorporated. If the platform handles PHI of Texas residents, it is likely a covered entity under HB 300. Telehealth platforms may use cloud services with servers overseas. That makes the SB 1188 U.S.-only storage rule important for them. The rule applies to records stored on or after January 1, 2026. Platform operators should check their cloud setup and vendor agreements now.
Texas HIPAA Compliance Checklist
- Confirm whether your organization meets HB 300’s broad covered entity definition (not just HIPAA’s)
- Update patient record access workflows to meet the 15-business-day HB 300 timeline for electronic records
- Train every new workforce member within 90 days of hire. Retrain after material (major) changes in law. Keep signed training statements for six years.
- Review and update BAAs: confirm all vendors are independently HB 300-compliant
- Update breach response plan to trigger Texas AG notice at 30 days for 250+ person breaches
- Check cloud and vendor infrastructure for overseas storage; move any electronic health records stored outside the U.S.
- List the AI tools used to suggest a diagnosis or treatment. Make sure practitioners tell patients when they use them (SB 1188)
- Use reasonable administrative, physical, and technical safeguards for electronic health records. Let only staff who need the records access them (Chapter 183, SB 1188)
- Review marketing use of PHI against HB 300’s stricter consent rules
- Ensure mental health records are handled under both HIPAA and Texas Health and Safety Code Chapter 611
Frequently Asked Questions
Does Texas have its own HIPAA law?
Texas has the Medical Records Privacy Act (HB 300, codified in Chapter 181 of the Texas Health and Safety Code), which is stricter than federal HIPAA in several areas. HB 300 covers a broader range of entities than HIPAA, requires faster record access, and adds its own training and penalty rules. Patients get their electronic records within 15 business days (HIPAA allows 30 days). New staff must be trained within 90 days of hire. Civil penalties can reach $250,000 per violation when PHI is knowingly or intentionally used for financial gain.
What is SB 1188 and what does it require Texas healthcare providers to do?
SB 1188 took effect on September 1, 2025. It requires reasonable administrative, physical, and technical safeguards for electronic health records. Starting January 1, 2026, electronic health records must be stored in the United States or a U.S. territory. Patient consent does not create an exception. A practitioner who uses AI to help diagnose or suggest treatment must tell patients.
How quickly must Texas providers notify patients and the government of a data breach?
The HIPAA Breach Notification Rule requires individual notice within 60 days. For breaches affecting 250 or more Texas residents, SB 768 (2023) requires notice to the Texas Attorney General within 30 days after you determine the breach occurred. Always apply the most protective timeline: for mid-to-large breaches in Texas, that means 30 days for AG notice and 60 days for individual notice.
Who enforces HB 300 in Texas?
The Texas Attorney General has statutory enforcement authority over HB 300 (Chapter 181), the breach notice law (Chapter 521), and SB 1188 (Chapter 183). The AG can seek civil penalties up to $250,000 per violation when PHI is knowingly or intentionally used for financial gain. The AG can also ask for court orders to stop a violation. Federal HIPAA remains enforced by HHS OCR, creating dual enforcement exposure for Texas providers.
What are the penalties for HIPAA and HB 300 violations in Texas?
Texas healthcare providers face dual penalty exposure. Federal HIPAA civil money penalties can reach $2,190,294 per calendar year for identical violations (2025 inflation-adjusted amount). Texas HB 300 adds state penalties of up to $250,000 per violation when PHI is knowingly or intentionally used for financial gain. If violations form a pattern or practice (a habit), a court may order up to $1.5 million a year. Both HHS OCR and the Texas Attorney General have independent enforcement authority.
Does HB 300 apply to business associates and technology vendors?
Yes. Under federal HIPAA, business associates (vendors that handle PHI for you) sign a BAA and are directly responsible for parts of HIPAA. HB 300 goes further and makes any entity that assembles, collects, analyzes, uses, stores, or transmits PHI a direct covered entity with independent compliance obligations. This means health IT vendors, data analytics firms, and app developers handling Texas resident PHI must comply with HB 300 on their own, not just through contractual delegation.
Texas is one of the stricter states for health privacy compliance. Texas adds more than base HIPAA.
HB 300 covers more organizations. Patients get faster record access. New staff need training within 90 days of hire. SB 1188 adds rules on safeguards, U.S.-only storage, and AI disclosure.
One Guy Consulting helps Texas healthcare organizations work on both federal HIPAA and Texas law. Book a consultation to talk about where to start.
Key stat: Texas HB 300 allows the state Attorney General to seek civil penalties up to $250,000 per violation when PHI is knowingly or intentionally used for financial gain. Unlike HIPAA, which is enforced federally by OCR, Texas state enforcement creates a second, independent penalty layer that applies to the same covered entities and business associates.
Sources
- Texas HHS: HIPAA and Privacy Laws
- Texas Health and Safety Code Chapter 181 (HB 300)
- Texas Business and Commerce Code Chapter 521 (breach notice)
- Texas SB 1188 (2025), enrolled bill text
- Compliancy Group: Texas Medical Privacy and Identity Theft Protection Acts
- HHS: HIPAA for Professionals
Related Reading: Florida HIPAA Rules · Illinois HIPAA Rules · HIPAA Breach Notification Rule Compliance · California HIPAA Rules · New York HIPAA Rules · State Privacy Laws vs. HIPAA
HIPAA compliance in other states
State law stacks on top of HIPAA differently in every state. These guides cover the statutes that move the baseline where you operate.