Texas Medical Records Privacy Requirements That Go Beyond HIPAA: What Providers Need to Know

Overview of Texas Medical Records Privacy Act

Texas Health and Safety Code Chapter 181—often called the Texas Medical Records Privacy Act—adds state-specific rules that go beyond HIPAA. If you handle health information about a Texas resident, these requirements likely apply to you even if your organization is located outside Texas.

Covered Entities Definition Texas

Texas defines a “covered entity” broadly to include any individual or organization that creates, receives, obtains, maintains, uses, or transmits Protected Health Information (PHI). This captures traditional providers and plans, but also many vendors, apps, and nonclinical businesses that touch PHI in any way.

What “more stringent than HIPAA” means

When Texas law is more protective of patient privacy than HIPAA, you must follow Texas law. In practice, this affects timelines, consent details, training obligations, and how you disclose or monetize PHI.

This overview is for general information and is not legal advice.

Prohibition on PHI Sales

Texas generally prohibits selling PHI for remuneration. Limited exceptions exist—for example, payments to business associates for services, sale or transfer in a practice acquisition, public health reporting, research with valid authorization, or disclosures for treatment and payment.

When authorization is required, it must clearly describe what PHI is being disclosed, to whom, for what purpose, and that the disclosure involves remuneration. Texas treats disguised “marketing” arrangements as sales of PHI, exposing you to state enforcement and civil penalties.

Patient Access and Consent Requirements

Texas accelerates access: you must provide requested records within 15 business days of receiving a written request, absent a valid, documented basis for denial. You may charge only cost-based fees permitted by Texas rules, and you may not charge to let a patient simply inspect their record.

Electronic Health Records (EHR) Access

On request, provide an electronic copy of PHI maintained electronically if it is readily producible. If not, offer a mutually agreeable format. Use secure transmission; if a patient insists on unencrypted email after being warned of risks, document the patient’s preference.

Authorizations and special situations

Texas requires detailed, readable authorizations identifying the specific PHI, recipients, and purpose. For minors and sensitive services, honor applicable state consent and confidentiality rules that may give the patient—rather than a parent—control over specific records.

Retention Periods for Medical Records

Texas sets Medical Records Retention Requirements by setting minimum timeframes that vary by setting:

• Physicians: retain adult records for at least seven years from the date of last treatment; for minors, retain until the patient is 21 or seven years from last treatment, whichever is longer.
• Hospitals: retain adult records for at least 10 years from the date of last treatment; for minors, retain until the patient is at least 20 or 10 years from last treatment, whichever is longer.

Longer retention may be required by payer contracts, federal program rules, litigation holds, or research obligations. Maintain a written retention and destruction schedule that aligns with these layers.

Compliance and Training Obligations

Texas requires documented privacy compliance tailored to your operations. This includes governance, workforce training, vendor oversight, timely breach response, and proof you are meeting state-specific rules in addition to HIPAA.

Mandatory Privacy Training Texas

Provide role-based privacy training to each workforce member within 60 days of hire and at least once every two years thereafter. Training must reflect the employee’s job duties and cover both HIPAA and Texas requirements. Keep signed or electronic acknowledgments and training materials.

Program essentials

• Appoint privacy and security leads, perform risk assessments, and maintain policies on minimum necessary access, data sharing, and disposal.
• Execute business associate agreements that expressly require compliance with Texas Health and Safety Code Chapter 181 when PHI of Texas residents is involved.
• Use access controls, audit logs, encryption, and incident response playbooks that specify Texas notification pathways and timelines.

Texas Identity Theft Enforcement and Protection Act

The Texas Identity Theft Enforcement and Protection Act (also called the Identity Theft Enforcement Act) applies to “sensitive personal information,” which includes certain health information when combined with identifiers. It requires reasonable safeguards, secure disposal, and prompt breach notification.

If a breach affects 250 or more Texas residents, you must notify the Texas Attorney General, in addition to notifying affected individuals. Notices must be made without unreasonable delay and no later than 60 days after determining a breach occurred, unless law enforcement requests a delay.

Differences Between HIPAA and Texas Laws

• Scope: Texas Health and Safety Code Chapter 181 reaches a broader Covered Entities Definition Texas than HIPAA, extending to many third parties that handle PHI.
• Access timelines: Texas requires fulfillment within 15 business days; HIPAA allows up to 30 days with one 30‑day extension.
• Sales and marketing: Texas more directly prohibits sale of PHI, with narrow exceptions and stricter authorization content for remunerated disclosures.
• Training: Texas mandates duty-specific Mandatory Privacy Training Texas within 60 days of hire and biennially, with documentation.
• Retention: Texas sets explicit minimum retention periods; HIPAA does not prescribe medical record retention timeframes for providers.
• Breach response: Both require prompt notice, but Texas adds Attorney General notification for larger incidents and enforces state-level security and disposal rules under the Identity Theft Enforcement Act.
• Enforcement: Texas authorizes state civil penalties and investigations independent of federal HIPAA enforcement, increasing your risk profile.

Conclusion

Texas medical records privacy requirements go beyond HIPAA in scope, speed, and enforcement. If you handle PHI for Texas residents, build your program to Texas standards first, then layer HIPAA on top. This dual‑track approach reduces risk and speeds compliant care and EHR access.

FAQs

What additional privacy protections does Texas law provide beyond HIPAA?

Texas expands who is regulated, shortens access deadlines, tightens consent and sales-of-PHI rules, mandates duty-specific training with documentation, sets record retention minimums, and adds separate breach and security obligations under state law, including Attorney General reporting for larger incidents.

How long must medical records be retained under Texas law?

Physicians must keep adult records at least seven years from the last treatment and minor records until age 21 or seven years from the last treatment, whichever is longer. Hospitals must keep adult records at least 10 years and minor records until at least age 20 or 10 years from the last treatment, whichever is longer.

What are the requirements for patient access to electronic health records in Texas?

You must provide access within 15 business days and, if PHI is maintained electronically, furnish an electronic copy if readily producible. Use secure transmission or document the patient’s informed choice of an unencrypted method.

Are there penalties for unauthorized sale of PHI in Texas?

Yes. Texas generally prohibits selling PHI, and violations can trigger state civil penalties and enforcement actions, separate from HIPAA liability. Authorizations for any remunerated disclosures must meet strict content requirements and fall within narrow exceptions.