HIPAA Compliance in Texas: State-Specific Requirements Explained

HIPAA Overview

HIPAA establishes nationwide standards for safeguarding Protected Health Information (PHI). The Privacy Rule governs who may use and disclose PHI, the Security Rule requires administrative, physical, and technical safeguards for electronic PHI, and the Breach Notification Rule sets duties to notify after certain security incidents.

Covered entities—health plans, healthcare providers, and clearinghouses—and their Business Associates must follow HIPAA. You must apply the minimum necessary standard, maintain role-based access, conduct risk analyses, and execute written Business Associate Agreements that bind vendors and subcontractors to HIPAA-level protections.

HIPAA’s preemption framework allows stricter state laws to control. In Texas, several provisions are more protective than federal baselines, so you must layer Texas-specific requirements onto your federal compliance program.

Texas-Specific HIPAA Laws

Texas builds on HIPAA through a network of state statutes and rules that elevate privacy expectations. The centerpiece is the Texas Medical Privacy Act, which broadens who is regulated and tightens timelines and documentation around PHI uses and disclosures.

Texas generally requires workforce training on privacy and security within a short window after hire and periodically thereafter. Authorizations must be specific and understandable, and marketing or sale of PHI is restricted. Where Texas imposes stricter rules—such as shorter response times or expanded coverage—those state rules govern your operations in Texas.

Texas Medical Privacy Act

The Texas Medical Privacy Act applies to traditional HIPAA covered entities and, more broadly, to organizations and individuals that create, receive, obtain, maintain, use, or transmit PHI about Texas residents. That reach includes many contractors and vendors, not just classic Business Associates.

Key duties include providing patient access to records on a faster timeline than federal law, documenting privacy training, and honoring tighter limits on certain disclosures, including rules related to marketing and any sale of PHI. Texas also expects clear notices and records of disclosures so you can demonstrate compliance during investigations or audits.

Patient Access and Authorizations

Texas commonly requires delivery of requested medical records within 15 business days of receiving a proper request—stricter than HIPAA’s 30-day outer limit. Authorizations must be precise about what PHI is disclosed, to whom, for what purpose, and for how long, with special care when disclosures relate to marketing or remuneration.

Training and Documentation

You should provide role-based privacy and security training shortly after onboarding and at regular intervals, keep signed acknowledgments, and update training when laws, systems, or job duties change. Thorough documentation is central to demonstrating good-faith compliance under Texas standards.

Enforcement Bodies in Texas

Federal HIPAA enforcement is led by the U.S. Department of Health and Human Services Office for Civil Rights. In Texas, the Attorney General enforces state privacy statutes, seeking injunctions and Civil Penalties when appropriate. State Health Services enforcement actions and oversight by licensing boards complement these efforts.

Multiple Texas regulators may be involved depending on your license and activities, including the Department of State Health Services, the Health and Human Services Commission, and professional boards such as the Medical, Nursing, Pharmacy, and Dental Boards. Parallel investigations are possible if an incident implicates both federal and state law.

Breach Notification Requirements

Under the HIPAA Breach Notification Rule, you must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured PHI. Notice to HHS is also required, and if 500 or more residents of a state are affected, you must notify prominent media outlets serving that jurisdiction.

Texas law likewise requires notification to affected residents as quickly as possible and no later than 60 days after determining a breach. If a breach affects 250 or more Texas residents, you must also notify the Texas Attorney General within 60 days. When both HIPAA and Texas rules apply, follow the stricter or more specific standard and meet every applicable recipient and timing requirement.

What to Include and How to Decide

Notifications typically describe what happened, the types of PHI involved, steps you are taking, and how individuals can protect themselves. A documented risk assessment—considering the nature of PHI, the unauthorized recipient, whether PHI was actually viewed, and mitigation—helps determine if an incident rises to a “breach” requiring notice.

Penalties and Fines

HIPAA civil money penalties scale by culpability, from reasonable-cause violations to willful neglect, with per-violation amounts that can reach five figures and annual caps that can reach into the millions. HIPAA’s Criminal Penalties—enforced by the Department of Justice—apply when PHI is wrongfully obtained or disclosed, with potential fines and imprisonment depending on intent and gain.

Texas adds state Civil Penalties for violations of the Texas Medical Privacy Act, with higher exposure for knowing or intentional conduct and for prohibited actions such as selling PHI. Criminal Penalties may apply under state law for certain unlawful disclosures or related conduct. Aggravating and mitigating factors (e.g., cooperation, prompt remediation, and prior history) influence penalty outcomes in both federal and state actions.

Healthcare Entities Covered

Beyond HIPAA’s covered entities, Texas brings many additional organizations under its privacy umbrella if they handle PHI about Texas residents. Examples include hospitals and clinics, telehealth providers, pharmacies, health plans and TPAs, billing services, IT and cloud vendors, data analytics firms, and other Business Associates and subcontractors.

If you create, receive, maintain, or transmit PHI in Texas—even if healthcare is not your core business—you should assess applicability of the Texas Medical Privacy Act. Align policies, BAAs, technical safeguards, and incident response plans with both HIPAA and Texas requirements to ensure end-to-end compliance.

Conclusion

Texas overlays HIPAA with stricter timelines, broader coverage, and added enforcement. Build your program to federal standards, then tighten it for Texas: accelerate access and notification timelines, expand training and documentation, scrutinize marketing or sale-related disclosures, and prepare for both federal and state oversight.

FAQs

What additional privacy protections does Texas law provide beyond HIPAA?

Texas expands who is regulated, requires faster responses to patient record requests (commonly 15 business days), mandates timely role-based training, and restricts marketing and the sale of PHI. These state rules sit on top of HIPAA, so the stricter Texas standard controls when both apply.

How does Texas enforce HIPAA compliance?

HIPAA is enforced federally by HHS OCR, but Texas enforces its own privacy laws through the Attorney General, State Health Services enforcement activity, and professional licensing boards. Depending on the incident, you may face coordinated federal and state investigations.

What are the breach notification requirements in Texas?

You must notify affected individuals as quickly as possible and no later than 60 days after determining a breach. If 250 or more Texas residents are affected, notify the Texas Attorney General within 60 days as well. When HIPAA also applies, meet HIPAA’s Breach Notification Rule requirements, including HHS and, for large events, media notice.

What penalties exist for HIPAA violations in Texas?

Federally, HIPAA imposes tiered Civil Penalties and, for egregious conduct, Criminal Penalties. Texas adds its own Civil Penalties for violations of the Texas Medical Privacy Act and may apply Criminal Penalties for certain unlawful disclosures. Penalty amounts vary with intent, harm, and your corrective actions.