Insight
Texas Health Records and Foreign Cloud Access
Storage location, authorized access, and vendor diligence under SB 1188.
SB 1188 took effect September 1, 2025. Its transition provision applies §183.002 to electronic-health-record storage on or after January 1, 2026, regardless of when the record was prepared. The section addresses three separate matters: physical location, authorized access, and safeguards. A domestic hosting contract answers only part of the inquiry.
Who and what is covered
The law borrows its definition of covered entity from the Texas Medical Records Privacy Act (§181.001) and adds that the term includes a health care practitioner, while excluding specified long-term care and home-services facilities (enrolled SB 1188, §183.001(2)). The definition is broad: it reaches anyone who assembles, collects, analyzes, uses, evaluates, stores, or transmits protected health information, not only providers and plans.
Location, access, and safeguards are separate duties
Section 183.002 imposes three different requirements, and it helps to keep them apart.
| Duty | Requirement | Statutory distinction |
|---|---|---|
| Physical location, §183.002(a) | Covered records containing patient information must be physically maintained in the United States or a U.S. territory | Includes third-party, subcontracted, and cloud storage |
| Authorized access, §183.002(b) | Access must be needed for employment duties relating to treatment, payment, or health care operations | Texas residents' information, other than open data |
| Safeguards, §183.002(c) | Reasonable and appropriate administrative, physical, and technical safeguards | Protect confidentiality, integrity, and availability |
The access duty carries an employment limitation the other two do not: the information must be accessible only to individuals who require it to perform duties within the scope of the individual's employment related to treatment, payment, or health care operations. And the location and access duties cover different records: subsection (a) addresses covered records containing patient information, while subsection (b) expressly concerns Texas residents' information other than open data.
Offshore access is a separate question
The statutory text does not make every foreign viewing session permissible merely because the database is hosted domestically. A download, cache, replica, support tool, or other retained copy can raise storage questions, and access and safeguards must also satisfy the statute. Consider a hypothetical: a vendor hosts the primary record in Texas but permits support staff abroad to download copies into a ticketing system. The entity must investigate the downloaded copies' location and retention as well as the staff's authorized role; the primary database's location alone does not answer those questions.
Penalties
The Attorney General may seek an injunction and civil penalties (§183.011). The ceilings rise with intent: up to $5,000 for each negligently committed violation occurring in a single year, up to $25,000 for each knowing or intentional violation occurring in a single year, and up to $250,000 for each violation in which the entity knowingly or intentionally used protected health information for financial gain. Licensing agencies may also investigate (§183.009) and may take disciplinary action, including license, registration, or certification suspension or revocation, against a covered entity that violates the chapter three or more times (§183.010).
What vendor diligence must now ask
The localization rule falls hardest on contracts. A covered entity should be able to answer four questions for each system that holds patient records:
- In which countries is the primary copy stored?
- Where do backups, replicas, caches, and disaster-recovery copies go?
- Who has remote access, from where, and for what purpose?
- Can the vendor commit in writing to U.S.-only storage and notice before any change?
Global cloud providers may route backups and support access across borders; verify the actual configuration rather than assuming one. The contract, not the marketing page, should settle the question.
A separate federal layer
Texas §183.002 addresses storage location, authorized access, and safeguards. The DOJ program separately regulates covered transactions that enable countries of concern or covered persons to access government-related data or bulk U.S. sensitive personal data. A vendor arrangement may require analysis under both regimes.
Sources
- SB 1188, enrolled text, §§1 through 4 (including the §2(b) transition rule)
- Tex. Health & Safety Code ch. 183, §§183.001, 183.002, 183.011