Texas Medical Records Privacy Act

Health · Data security · Marketing

Texas's health privacy law, strengthened by H.B. 300 (2011), reaches anyone who handles protected health information, not just HIPAA covered entities. It requires workforce privacy training, electronic record access within 15 business days, and consent for marketing uses, and it bans the sale of PHI and reidentification and requires notice and authorization for electronic disclosures.

Where: Texas
Citation: Tex. Health & Safety Code ch. 181 (181.001-181.207)
Status: In force
In force since: 2001-09-01
Last amended: 2025-09-01
Enforced by: Texas Attorney General; Health and Human Services Commission and licensing agencies (audits, discipline)
People can sue: No
Penalties: Attorney general injunctions and civil penalties up to $5,000 (negligent), $25,000 (knowing or intentional), or $250,000 (knowing use of PHI for financial gain) per violation per year; licensing discipline and exclusion from state programs (181.201-181.203).
Applies to: 'Covered entities' defined far more broadly than HIPAA: any person who, for gain or on a nonprofit or pro bono basis, assembles, collects, analyzes, uses, stores, or transmits protected health information, anyone who comes into possession of PHI, and their employees, agents, and contractors (181.001(b)(2))
Partial exemptions for HIPAA-covered and other listed entities except for the reidentification, marketing, sale, and electronic disclosure rules in Subchapter D (181.051)

What a privacy notice must say

Give general notice when PHI is subject to electronic disclosure, and obtain a separate authorization for each electronic disclosure unless an exception applies.Tex. Health & Safety Code 181.154

Rights it gives people

Health care providers with capable EHR systems must give a person their electronic health record within 15 business days of a written request.Tex. Health & Safety Code 181.102

Practices it requires

Train employees on state and federal PHI law within 90 days of hire and after material legal changes; keep signed training acknowledgments for six years.Tex. Health & Safety Code 181.101
Do not reidentify or attempt to reidentify the subject of PHI without required consent or authorization.Tex. Health & Safety Code 181.151
Obtain clear written or electronic permission before using or disclosing PHI for marketing, with limited exceptions; mailed marketing must include opt-out information.Tex. Health & Safety Code 181.152
Do not disclose PHI for direct or indirect remuneration except to other covered entities for treatment, payment, operations, or insurance functions, or as law allows.Tex. Health & Safety Code 181.153

Sources

Checked against these sources on 2026-09-24 by research agent (Claude), primary sources.

Unverified: The 2025 amendment (H.B. 4224, eff. Sept. 1, 2025) was identified from the chapter's credit line; its content was not reviewed.

Research reference, not legal advice.