What Is
What Is Texas Health Records Law (Chapters 181 and 183)
Two Health and Safety Code chapters govern health records in Texas alongside HIPAA.
Chapter 181, the Texas Medical Records Privacy Act. Its definition of covered entity differs from HIPAA's. HIPAA's covered entity turns on a health-care role: health plans, health care clearinghouses, and providers that transmit health information electronically in connection with a covered transaction (45 C.F.R. 160.103). The Texas test turns on what a person does with protected health information: any person who, for commercial, financial, or professional gain or on a cooperative, nonprofit, or pro bono basis, engages with real or constructive knowledge in assembling, collecting, analyzing, using, evaluating, storing, or transmitting protected health information (§181.001(b)(2)). That reaches business associates, health researchers, schools, information and computer management entities, health care facilities and providers, and persons who maintain Internet sites, and it also covers anyone who comes into possession of the information, stores it under the chapter, or handles it as an employee, agent, or contractor (§181.001(b)(2)). The chapter's exemption subchapter then narrows the reach, including partial exemptions for insurers, employers, workers' compensation, employee benefit plans, and educational records (§§181.051-181.060). A covered entity must:
- train employees on state and federal law about protected health information (§181.101);
- Under §181.102, a health care provider using an electronic-health-record system capable of fulfilling a written request must provide the requested electronic record within 15 business days, unless the person agrees to another form. The provision preserves the specified HIPAA access exceptions and grounds for denial. Other chapter 181 covered entities should not be assigned this provider-specific deadline solely because they meet the broader state definition.
- since September 1, 2025, prominently post on its website and at each facility instructions for requesting records, contacting its licensing authority, and filing a consumer complaint; §181.105 does not apply to a covered entity conducting claims processing, data processing, data analysis, utilization review, or billing on behalf of another covered entity that provides health-care services directly to consumers (§181.105(b), added by HB 4224);
- not sell protected health information, except for treatment, payment, health care operations, certain insurance functions, or as law allows (§181.153); and
- give notice and obtain authorization before electronic disclosures where the chapter requires it, and follow limits on marketing uses (§§181.152, 181.154).
The Attorney General may seek injunctions and civil penalties of up to $5,000 per violation for negligence, $25,000 for knowing or intentional violations, and $250,000 for knowingly or intentionally using protected health information for financial gain, with up to $1.5 million a year for a pattern or practice of violations. For a covered entity licensed by a Texas licensing agency, an Attorney General action for civil penalties under this section requires the agency's referral (§181.201(e)); the injunction provision is separate (§181.201(a)).
Chapter 183, added by SB 1188. SB 1188 took effect September 1, 2025, and uses chapter 181's definition of covered entity, with express exclusions for home and community support services agencies, nursing facilities, continuing care facilities, assisted living facilities, intermediate care facilities, day activity and health services facilities, and Texas home living and home and community-based services waiver providers (§183.001(2)). Its transition rule applies the storage duty to electronic-health-record storage on or after January 1, 2026, regardless of when the record was prepared: since that date, a covered entity must keep electronic health records containing patient information physically in the United States or a U.S. territory, including records held by third-party computing and cloud providers (§183.002(a)). The entity must also ensure that the electronic health record information of Texas residents, other than open data, is accessible only to individuals who require it to perform duties within the scope of their employment related to treatment, payment, or health care operations, and it must keep reasonable administrative, physical, and technical safeguards (§183.002(b), (c)). The Attorney General may seek injunctive relief and civil penalties of up to $5,000 per negligent violation or $25,000 per knowing or intentional violation occurring in a single year, and up to $250,000 for knowingly or intentionally using protected health information for financial gain (§183.011); the commission or the appropriate regulatory agency investigates credible allegations (§183.009), and a regulatory agency may take disciplinary action against a covered entity that violates the chapter three or more times (§183.010).
SB 1188 also addresses artificial intelligence and minors. A health care practitioner who uses artificial intelligence for diagnostic purposes, including recommendations on a diagnosis or course of treatment based on a patient's medical record, must disclose that use to patients; the practitioner may use the technology only while acting within the scope of the practitioner's license, when the use is not otherwise restricted or prohibited, and with review of AI-created records consistent with Texas Medical Board standards (§183.005). A separate rule, HB 149 (the Texas Responsible Artificial Intelligence Governance Act), requires providers of health care services or treatment in which a patient interacts with an AI system to give written disclosure of that interaction not later than the date of service or treatment, with an emergency exception. A covered entity must ensure its electronic health record system lets a minor's parent, managing conservator, or guardian obtain complete and unrestricted access to the minor's record immediately, unless law or a court order restricts it (§183.006). Chapter 181 gives patients no private right of action (Walters v. Blue Cross & Blue Shield of Texas, Inc., N.D. Tex. 2022); chapter 183 is enforced by the Attorney General and licensing agencies.
Pinpoint: Tex. Health & Safety Code chs. 181 and 183. Related term: Protected health information (HIPAA Privacy Rule).