Texas HB 300 for Medical Practices: Training, Audits, and What Differs from HIPAA

The Texas Medical Records Privacy Act (Texas Health & Safety Code Chapter 181), known as HB 300, layers a broader covered-entity definition, a mandatory 90-day training cadence, a 15-business-day EHR access deadline, and Texas Attorney General enforcement on top of HIPAA. The single biggest divergence: HB 300's "covered entity" reaches anyone who comes into possession of a Texas resident's PHI, not just HIPAA-regulated providers and plans.

What HB 300 actually requires

HB 300 took effect September 1, 2012 and is codified at Texas Health & Safety Code Chapter 181. It defines "covered entity" at § 181.001 as any person who, for commercial, financial, or professional gain, monetary fees, or dues, "engages, in whole or in part, in the practice of assembling, collecting, analyzing, using, evaluating, storing, or transmitting protected health information." That sweeps in entities HIPAA does not — IT contractors, attorneys, marketing firms, cloud-storage providers, even some employers handling employee health data.

Core HB 300 obligations:

• Training within 90 days of hire under § 181.101 — every workforce member who handles PHI must complete training specific to the practice's PHI policies and to relevant state and federal law. Retraining at least every two years and within a reasonable time after a material change in policy. The training log must be retained for six years.
• Electronic health record access within 15 business days under § 181.102 — a covered entity that uses an EHR must provide an electronic copy on a patient's written request within 15 business days; HIPAA permits 30.
• Authorization for electronic disclosure under § 181.154 — separate written authorization is required before re-disclosing electronic PHI to a third party, with specific content elements.
• Sale of PHI prohibition under § 181.153 — broader than HIPAA's marketing prohibition; covers any sale of PHI unless an enumerated exception applies.
• Notice when authorization is required under § 181.152 — covered entities must inform patients of the customary disclosures the practice will make.
• Breach notification via Texas Business & Commerce Code § 521.053 — patient notice within 60 days of determination; AG notice required within 30 days of determination for breaches involving 250+ Texas residents.
• Texas Attorney General enforcement with penalties up to $250,000 per violation under § 181.201(b)(3), and an annual cap of $1.5 million for repeated violations of the same nature.

Where Texas is stricter than HIPAA

This is the comparison practices need.

| Topic | HIPAA | HB 300 / Texas | Stricter | |---|---|---|---| | Covered-entity scope | Plans, clearinghouses, treatment providers (45 CFR § 160.103) | Anyone who comes into possession of PHI (Tex. H&S § 181.001) | Texas | | Workforce training cadence | Reasonable to job duties; retrain on material changes (45 CFR § 164.530(b)(2)) | Within 90 days of hire + every 2 years (Tex. H&S § 181.101) | Texas | | Training record retention | Six years from creation (45 CFR § 164.530(j)(2)) | Six years (Tex. H&S § 181.101(c)) | Tie | | EHR patient-access turnaround | 30 days (45 CFR § 164.524(b)(2)) | 15 business days (Tex. H&S § 181.102) | Texas | | Sale of PHI | Authorization required (45 CFR § 164.508(a)(4)) | Sale prohibited absent enumerated exception (Tex. H&S § 181.153) | Texas | | Breach-notice window | 60 days (45 CFR § 164.404) | 60 days for patient notice; 30 days for AG notice at 250+ residents (Tex. B&C § 521.053) | Tie on patient notice; Texas adds and front-loads AG notice | | Civil penalty cap | $2,190,294 / year per identical violation (2026 HHS-adjusted; 45 CFR § 160.404 and 45 CFR Part 102) | $1.5M / year per repeated same-nature violation (Tex. H&S § 181.201) | HIPAA cap higher but Texas runs in parallel | | Enforcement agency | HHS / OCR | Texas AG + DSHS | Texas runs in parallel with HIPAA |

In Texas, the HB 300 training requirement trips up practices that thought their HIPAA training covered it. HIPAA does not specify a 90-day or two-year cadence; HB 300 does. A practice with annual HIPAA training but no documented HB 300-specific training, no 90-day-from-hire timestamp, and no Texas-law content in the curriculum is exposed on a state audit even if its HIPAA program is otherwise solid.

Where HIPAA is stricter than HB 300

HIPAA carries the heavier weight in two areas:

• Security Rule technical safeguards. The HIPAA Security Rule at 45 CFR Part 164 Subpart C prescribes the risk analysis, audit log, encryption-decision, access-control, and contingency-plan structure. HB 300 assumes safeguards exist and adopts the federal posture by reference at § 181.004; it does not add a parallel technical-control regime. Federal Security Rule violations remain the dominant exposure for systemic posture failures.
• Annual penalty cap (in absolute dollars). HIPAA's 2026 HHS-adjusted $2,190,294 annual cap per identical-violation type at 45 CFR § 160.404 (45 CFR Part 102) is higher than HB 300's $1.5M annual cap at § 181.201. For a sustained, willful failure, OCR's CMP exposure is larger than the Texas AG's. Both run in parallel on a single incident.
• Breach risk assessment methodology. HIPAA at 45 CFR § 164.402 defines the four-factor analysis that determines whether an incident is a reportable breach. Texas defers to that methodology and then imposes the additional Texas AG notification at 250+ residents.

Breach notification timeline

Texas uses two stacked statutes:

• Texas Business & Commerce Code § 521.053 — notification to affected Texas residents "as quickly as possible" and not later than 60 days after the date of determination of a breach involving sensitive personal information. Same outer window as HIPAA at 45 CFR § 164.404(b).
• AG notification at 250+ Texas residents — § 521.053(h) requires the practice to notify the Texas Attorney General "as soon as practicable" and not later than 30 days after determination when the breach involves at least 250 Texas residents. The AG publishes a notification roster.
• Out-of-state residents. § 521.053(b) extends Texas notification to non-Texas residents if the resident's home state has no breach-notice statute — uncommon today.

The encryption safe harbor at § 521.002(2) is meaningful: if the personal information was encrypted and the encryption key was not also compromised, notification under § 521.053 may not be triggered. Encryption is the highest-leverage HB 300 control.

Penalties and Texas AG enforcement

The numbers:

• Negligent violation under Tex. H&S § 181.201(b)(1) — up to $5,000 per violation per year.
• Knowing or intentional violation under § 181.201(b)(2) — up to $25,000 per violation per year.
• Knowing or intentional violation for financial gain under § 181.201(b)(3) — up to $250,000 per violation.
• Annual cap under § 181.201(c) — $1.5 million per year for pattern-or-practice violations of the same nature. Texas law does not provide for a doubled or higher annual cap.
• Licensure consequences — Texas Medical Board, Texas Board of Nursing, and DSHS may impose disciplinary action separate from monetary penalties; license revocation under § 181.202 is on the table for systemic failures.

No private right of action under HB 300. A Texas resident cannot sue under Chapter 181 itself. That said, HB 300 violations are frequently pleaded as predicates in negligence and Texas Deceptive Trade Practices Act (DTPA) claims, and the Texas DTPA does carry treble damages and attorney's fees. The litigation exposure is real but indirect.

Parallel HHS/OCR exposure runs at the same time. A single 2,000-patient breach can generate an OCR Resolution Agreement, a Texas AG settlement, and DTPA-pleaded private litigation in the same calendar quarter.

Compliance checklist for Texas practices

A Texas-specific overlay to a HIPAA program:

• HB 300 training within 90 days of hire for every workforce member with PHI access — separately documented from the HIPAA training certificate.
• Two-year HB 300 retraining cadence with calendar reminders per workforce member. Material policy changes trigger interim retraining.
• Six-year retention of every training record under § 181.101(c).
• 15-business-day EHR access protocol — a written request triggers a tracked clock; document the response date and any fee charged.
• Texas-compliant authorization form for electronic re-disclosure under § 181.154, layered with the HIPAA § 164.508 authorization.
• Sale-of-PHI prohibition enforced in vendor contracts and marketing reviews under § 181.153.
• Breach protocol triggering the § 521.053 60-day patient-notice clock and the 30-day AG-notice clock at 250+ residents.
• Encryption posture on every workstation, portable medium, and EHR-bearing device — the § 521.002(2) safe harbor is worth the engineering effort.
• Notice of customary disclosures under § 181.152 distributed alongside the HIPAA Notice of Privacy Practices.
• Out-of-state vendor mapping. Any vendor handling Texas PHI is bound by HB 300 directly. The HIPAA Business Associate Agreement at 45 CFR § 164.504(e) needs a Texas addendum binding the vendor to Chapter 181.

The d3rx compliance binder state-overlay branches on Texas specifically and produces the HB 300 training log structure, 15-day access protocol, sale-of-PHI prohibition addendum, and breach response timeline a Texas practice runs alongside its federal HIPAA backbone. It is an administrative documentation aid; the practice and its counsel remain responsible for executing the controls and responding to AG or OCR inquiries.