If your business is in Texas, federal rules like HIPAA are not the whole story. Two Texas laws reach further, and they catch companies that assume they are out of scope.
HB 300: Texas medical privacy reaches more than HIPAA does
HIPAA applies to “covered entities”, meaning health plans, clearinghouses and most providers, and to their business associates. The Texas Medical Records Privacy Act, substantially expanded by House Bill 300, uses a much broader definition of a covered entity. In broad terms it can apply to any business that collects, uses, stores or transmits protected health information about Texas residents, not only healthcare providers.
HB 300 also adds obligations HIPAA does not have, including a requirement to train employees on state and federal privacy law, and its own penalties, enforced by the Texas Attorney General and state licensing agencies.
Who should look closely: any Texas business that handles health information, including employers, benefits administrators, billing companies, software vendors and IT providers, even if it has never considered itself a healthcare company.
The Texas Data Privacy and Security Act
The Texas Data Privacy and Security Act (TDPSA) took effect on July 1, 2024. Unlike most state privacy laws, it has no revenue or data-volume threshold. Instead, it generally applies to businesses that operate in Texas or sell to Texas residents and that are not small businesses as defined by the U.S. Small Business Administration.
Covered businesses must, among other things:
- publish a clear privacy notice;
- honor consumer requests to access, correct, delete and port their data, and to opt out of sale, targeted advertising and certain profiling;
- get consent before processing sensitive data, such as health, precise location, biometric data or data about children;
- carry out data protection assessments for higher-risk processing; and
- have contracts in place with the vendors that process personal data for them.
Even SBA-defined small businesses are not entirely exempt: they still need consent before selling sensitive personal data. The Texas Attorney General enforces the law.
What to do about it
- Work out what data you hold about Texas residents, especially health and other sensitive data, and where it lives.
- Check which laws apply to you. Being outside HIPAA does not mean being outside HB 300, and being small does not automatically mean being outside the TDPSA.
- Train your staff, write down your policies, and make sure your vendors are under contract.
We help Texas companies map their data and put the safeguards and paperwork in place. If you are not sure where you stand, book a 30-minute call. More on the Texas rules on our Texas page.
This article is general information, not legal advice. For decisions about your legal obligations, talk to a lawyer.