Texas Healthcare Compliance.
Texas HB 300 broadens HIPAA in three notable ways: a wider definition of covered entity that catches Texas businesses HIPAA itself would not, mandatory biennial training, and a stricter 15-business-day patient access window for electronic records. The breach statute also imposes a 60-day clock plus AG notice. Practices in Texas need a state-specific HB 300 training cadence and an EHR-access workflow tuned to the 15-business-day clock.
At a glance
60days
Tex. Bus. & Com. Code § 521.053 requires notice without unreasonable delay and no later than 60 days from determination. AG notice required when >250 Texas residents affected. TX HB 300 amends the Texas Medical Records Privacy Act to impose training and access-restriction requirements stricter than HIPAA in several respects.
Texas Attorney General
- Texas Medical Records Privacy Act / HB 300Tex. Health & Safety Code §§ 181.001 et seq.
Broader definition of 'covered entity' than HIPAA (includes any entity that handles PHI in Texas, not just providers/plans/clearinghouses); biennial training requirement; expanded patient rights to access electronic records within 15 business days.
- Texas Identity Theft Enforcement and Protection ActTex. Bus. & Com. Code § 521
60-day individual notice from determination; AG notice when >250 residents affected; covers personal information.
- HIPAA Privacy, Security, and Breach Notification Rules45 CFR Parts 160 & 164
The federal baseline that all U.S. covered entities and business associates meet. HHS Office for Civil Rights (OCR) enforces.
How Texas goes further than HIPAA.
The breach window in Texas aligns with HIPAA’s 60-day individual-notice deadline. State-law overlays here are mostly about who else gets notified, what the personal- information definition covers, and whether any named statute (CMIA, BIPA, MHMDA, HB 300, 201 CMR 17.00, SHIELD) adds substantive duties. Notice flows through Texas Attorney General in addition to HHS/OCR federally.
Related compliance guides
- State Compliance
Texas HB 300 for Medical Practices: Training, Audits, and What Differs from HIPAA
8 min read - Emergency Response
HIPAA Breach Notification: The 60-Day Window Step-by-Step
7 min read - Compliance Foundations
Annual HIPAA Training Curriculum (What to Cover + How to Document)
10 min read - Compliance Foundations
HIPAA Right of Access Requests (45 CFR § 164.524): Respond Inside 30 Days
11 min read
Turn this overlay into a defensible SRA.
Texas's overlay layers on top of HIPAA's federal floor. The free SRA readiness check walks a small practice through discovery, threat model, controls, and gap analysis, then assembles the review-ready binder — policies, training logs, BAAs, and a breach playbook tuned to the 60-day clock and the Texas Attorney General notification path.
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- ComplianceTexas HB 300 for Medical Practices: Training, Audits, and What Differs from HIPAATexas HB 300 (Health & Safety Chapter 181) vs HIPAA: broader covered entities, mandatory 90-day training, 15-day EHR access, $1.5M/year AG penalty cap.
- ComplianceAnnual HIPAA Training Curriculum (What to Cover + How to Document)A 2026 annual HIPAA training curriculum for small healthcare practices — eight required modules under 45 CFR 164.530(b) and 45 CFR 164.308(a)(5), with documentation templates.
- ComplianceHIPAA Breach Notification: The 60-Day Window Step-by-StepFrom discovery you have 60 calendar days to notify individuals, HHS, and possibly media. Here is the procedure that actually protects the practice.
- ComplianceHIPAA Right of Access Requests (45 CFR § 164.524): Respond Inside 30 DaysA 2026 HIPAA right-of-access procedure citing 45 CFR § 164.524, the 30-day window, OCR Right of Access Initiative settlements ($3,500–$240,000 through 2025), and the patient response packet.
- RegulationCalifornia Confidentiality of Medical Information Act (CMIA, Cal. Civ. Code 56-56.37)California state law providing broader patient confidentiality protections than HIPAA for medical information held by providers, contractors, and certain employers.
- RegulationColorado Privacy Act (CPA, C.R.S. § 6-1-1301 et seq.)Colorado comprehensive consumer privacy law with consumer rights, controller/processor obligations, universal opt-out mechanism requirement, and an AG enforcement framework with HIPAA carve-outs.
- RegulationConnecticut Data Privacy Act (CTDPA, Public Act 22-15)Connecticut comprehensive consumer data privacy law with consumer rights, controller/processor obligations, and an AG enforcement framework — with substantial healthcare carve-outs.
- RegulationFlorida Information Protection Act (FIPA, Fla. Stat. § 501.171)Florida data breach notification and information security law requiring covered entities to maintain reasonable security and to notify affected individuals and the AG of breaches within 30 days.
Last reviewed May 23, 2026.
This page is a research aid for compliance teams. It does not certify compliance with any state or federal law, provide legal advice, replace counsel, or guarantee an audit outcome. State statutes are amended frequently — verify citations and links against the cited primary sources before acting. The practice remains responsible for adopting and maintaining its compliance program.