Texas has some of the strictest health privacy rules in the country. On top of HIPAA, practices must follow the Texas Medical Records Privacy Act (Health and Safety Code Chapter 181, expanded by HB 300) and the state breach notification law in the Business and Commerce Code.
AT A GLANCE
| Laws | Texas Medical Records Privacy Act, Health and Safety Code ch. 181 (HB 300); Identity Theft Enforcement and Protection Act, Bus. and Com. Code ch. 521 |
|---|---|
| Who it covers | Chapter 181 defines "covered entity" more broadly than HIPAA, reaching many organizations that handle protected health information |
| Staff training | Within 90 days of hire, and within a year of any material change in law that affects their duties. Signed completion statements kept for six years |
| Electronic records | Provide a patient's electronic health record within 15 business days of a written request, if you use an EHR that can |
| Notice to individuals | No later than 60 days after determining a breach occurred. The breach law covers health information |
| Attorney general | Within 30 days if 250 or more Texas residents are affected, through the AG's online form |
| Penalties | Chapter 181: up to $5,000 per negligent violation, $25,000 per knowing violation, $250,000 for use for financial gain, up to $1.5 million a year for a pattern or practice. Chapter 521: $2,000 to $50,000 per violation, plus up to $100 per person per day for late notice, capped at $250,000 per breach |
02
Read more in our article Why HIPAA compliant isn't enough in Texas.
HOW WE HELP
HIPAA and Texas training
Self-paced training that covers HIPAA and Texas law, with signed completion records.
Learn more →HIPAA risk assessment
The documented risk analysis both HIPAA and Texas regulators expect to see.
Learn more →Incident response planning
Meet the 30-day Texas AG deadline and the HIPAA timeline without scrambling.
Learn more →FAQ
Most likely. Chapter 181 defines covered entities broadly, including anyone who collects, uses, stores or transmits protected health information, so most practices and many of their vendors are covered.
Within 90 days of hire, and again within a year of any material change in state or federal privacy law that affects their duties. Keep signed completion statements for six years.
Notify affected individuals within 60 days of determining the breach occurred. If 250 or more Texans are affected, notify the attorney general within 30 days.
Up to $5,000 per negligent violation, $25,000 per knowing or intentional violation, $250,000 when PHI is used for financial gain, and up to $1.5 million a year for a pattern or practice of violations.
Sources: Tex. Health and Safety Code 181.101 · Tex. Health and Safety Code 181.201 · Perkins Coie: Texas breach chart. This page is general information about the law as of November 2026, not legal advice. Statutes change, so confirm current requirements with your attorney.
Take the free HIPAA risk assessment, or ask us about Texas training requirements.
