Texas Medical Records Privacy Rules Beyond HIPAA: A Small Practice Guide

Texas Medical Records Privacy Law Overview

Texas pairs HIPAA with the Texas Medical Records Privacy Act (often called the Texas Medical Privacy Act), which adds state-specific duties and applies alongside federal rules. In practice, you must meet HIPAA and Texas Health and Safety Code Chapter 181 requirements where both apply. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/HS/htm/HS.181.htm))

Key Texas enhancements small practices should know:

• Training: You must train employees on state and federal privacy law within 90 days of hire, retrain after material legal changes, and keep signed training attestations for six years. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/HS/htm/HS.181.htm))
• Electronic disclosures: Except for treatment, payment, and health care operations (TPO) and other legally authorized disclosures, Texas requires a separate authorization for each electronic disclosure of PHI; the Attorney General provides a standard form. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/HS/htm/HS.181.htm))
• Consumer access to EHR: If you use an EHR capable of fulfilling requests, you must provide the record within 15 business days, typically in electronic form. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/HS/htm/HS.181.htm))
• Marketing: Using PHI for marketing generally requires clear and unambiguous permission. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/HS/htm/HS.181.htm))

Texas also obligates covered entities to post instructions—on your website and in your facility—explaining how patients can request records, contact regulators, and file complaints (effective September 1, 2025). Build this into your policies. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/HS/htm/HS.181.htm))

Patient Rights to Medical Records Access

Texas accelerates access timelines. Upon receiving a valid written request or consent, physicians must furnish records—or a summary or narrative—no later than the 15th business day. If you deny access, you must issue a signed, dated written statement explaining why and file it in the chart. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/OC/htm/OC.159.htm))

When your EHR can fulfill the request, you must deliver the record within 15 business days and, by default, in electronic format unless the patient agrees to another form. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/HS/htm/HS.181.htm))

Fees: Physicians may charge a reasonable, board-prescribed fee for copies, but certain requests—such as those tied to disability benefit claims—cannot be charged. Verify your fee schedule against board guidance before invoicing. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/OC/htm/OC.159.htm))

Enhanced Privacy Protections for Sensitive Information

Mental health information confidentiality

Mental health records kept by “professionals” (e.g., physicians, psychologists, counselors) are confidential under Texas Health and Safety Code Chapter 611. You may deny access if disclosure would harm a patient’s physical, mental, or emotional health, but you must provide a signed, dated statement documenting the reason and retain it in the record. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/hs/htm/hs.611.htm?utm_source=openai))

Substance abuse records protection

Federally assisted SUD programs must follow 42 CFR Part 2, which restricts use and disclosure beyond HIPAA. A 2024–2026 update aligns many aspects with HIPAA for TPO purposes while preserving stricter limits in legal proceedings and certain redisclosures; build consent workflows that flag and segment Part 2 records. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html?utm_source=openai))

Sensitive test results delay

For specified “sensitive test results” (e.g., a pathology or radiology report likely to show malignancy, or a test revealing a genetic marker), Texas requires a three-day hold before releasing results by electronic means through a portal or app. Plan your portal configuration and release policy accordingly. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/OC/htm/OC.159.htm))

Compliance Strategies for Small Practices

Build a Texas-plus-HIPAA compliance plan

• Train new hires within 90 days; update training after legal changes; retain signed acknowledgments six years. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/HS/htm/HS.181.htm))
• Operationalize 15-business-day access: track requests, verify identity, and deliver electronic copies from your EHR when feasible. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/HS/htm/HS.181.htm))
• Use a Texas-compliant authorization process for electronic disclosures not covered by TPO, leveraging the Attorney General’s standard form. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/HS/htm/HS.181.htm))
• Post required instructions online and in-office explaining how patients can request records, contact the Texas Medical Board, and file complaints. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/HS/htm/HS.181.htm))
• Separate or flag mental health and Part 2 records; apply stricter disclosure rules and granular consent tracking. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/hs/htm/hs.611.htm?utm_source=openai))
• Document “Consent for Disclosure” and marketing permissions; do not use PHI for marketing without clear permission. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/HS/htm/HS.181.htm))

Medical Record Retention Requirements

Physician offices: Maintain records at least seven years from the date of last treatment; for minors, retain until age 21 or seven years from last treatment—whichever is longer. Confirm retention in your policy and ensure continued access during the entire period. ([regulations.justia.com](https://regulations.justia.com/states/texas/title-22/part-9/chapter-163/subchapter-a/section-163-2/?utm_source=openai))

Hospitals (for context): Hospitals may dispose of medical records only on or after the 10th anniversary of a patient’s last treatment (or on/after the patient’s 20th birthday for minors, whichever is later). If you also operate a licensed facility, ensure your retention schedule reflects this longer rule. ([law.justia.com](https://law.justia.com/codes/texas/health-and-safety-code/title-4/subtitle-b/chapter-241/subchapter-e/section-241-103/?utm_source=openai))

Special cases: Texas law authorizes the board to set longer periods for certain record types—for example, forensic medical exam records from sexual assault victims must be preserved much longer. Check specialty rules before destruction. ([law.justia.com](https://law.justia.com/codes/texas/occupations-code/title-3/subtitle-b/chapter-153/subchapter-a/section-153-003/?utm_source=openai))

Breach Notification Procedures

Texas Business & Commerce Code §521.053 applies to computerized “sensitive personal information.” If a breach occurs, you must notify affected individuals without unreasonable delay and no later than the 60th day after determining a breach occurred, subject to limited law-enforcement delay. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm))

Attorney General notice: If 250 or more Texas residents are affected, you must also notify the Texas Attorney General as soon as practicable and not later than 30 days after determining the breach. Maintain documentation of your assessment, notices sent, and remedial steps. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm))

Key takeaways for small practices

• Meet Texas’s faster timelines (15 business days for access; up to 60 days for breach notifications to individuals) and added duties (90‑day training, separate e‑disclosure consent). ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/OC/htm/OC.159.htm))
• Retain records at least seven years (longer for minors), and verify longer periods for special record types or facility settings. ([regulations.justia.com](https://regulations.justia.com/states/texas/title-22/part-9/chapter-163/subchapter-a/section-163-2/?utm_source=openai))
• Apply stricter protections to mental health and substance use records; configure your systems and consents accordingly. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/hs/htm/hs.611.htm?utm_source=openai))

FAQs.

What are the additional privacy requirements for Texas medical records beyond HIPAA?

Texas’s Medical Records Privacy Act layers on: employee training within 90 days of hire with six‑year recordkeeping; separate authorization for most electronic disclosures outside TPO; faster access to EHR (15 business days); and limits on using PHI for marketing without clear permission. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/HS/htm/HS.181.htm))

How soon must Texas practices provide patients access to their medical records?

For paper or general records, physicians must respond no later than the 15th business day after receiving a valid written request or consent; for EHR capable of fulfilling the request, provide an electronic copy within 15 business days unless the patient agrees to another format. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/OC/htm/OC.159.htm))

What special protections exist for mental health and substance abuse information?

Mental health records are confidential under Chapter 611, with access limits when disclosure would harm the patient and required written justification for any denial. Federally assisted SUD programs must follow 42 CFR Part 2, which imposes stricter consent and redisclosure controls than HIPAA in several contexts. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/hs/htm/hs.611.htm?utm_source=openai))

What are the breach notification requirements unique to Texas?

For breaches of computerized sensitive personal information, notify affected individuals without unreasonable delay and within 60 days of determining a breach. If 250+ Texans are affected, report to the Attorney General within 30 days as well. ([tcss.legis.texas.gov](https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm))