Sends automated texts, in Texas

Tex. Util. Code §§ 55.121-.138 · Read the law's page

• Before using an automated dial announcing device to make a call that originates or terminates in Texas, obtain a Public Utility Commission permit, renewed annually, and, before using it to play a recorded message on connection, give written notice of the device to each telecommunications utility over whose system it will be used.
• Do not use the device for random or sequential number dialing when it plays a recorded message on connection, for a solicitation call terminating in Texas before noon or after 9 p.m. on a Sunday or before 9 a.m. or after 9 p.m. on a weekday or Saturday, or for a collection call at an hour the federal Fair Debt Collection Practices Act prohibits.
• Make the device disconnect within five seconds after either party ends the call, or, if it cannot, have a live operator introduce the call and receive the called person's oral consent before the message begins.
• State the nature of the call, your identity, and the number you are calling from within the first 30 seconds of the recorded message, add the pay-per-call disclosures where the call promotes such a service, and keep a solicitation message shorter than 30 seconds unless the device can recognize an answering machine and end the call within 30 seconds.
• These duties do not reach a call relating to an emergency or an approved public-service program, a school locating a truant student, a municipality's public-health, safety, or welfare call, or an organization calling its own member.
• Notify the commission by certified mail at least 48 hours before changing the device's telephone number or physical address.

Tex. Health & Safety Code ch. 181 · Read the law's page

• Train your employees on state and federal law concerning protected health information as necessary for their duties, within 90 days of hire, have each sign a statement verifying completion, and keep the statement until the sixth anniversary of signing (Tex. Health & Safety Code sec. 181.101).
• If you are a health care provider using an electronic health records system capable of fulfilling the request, provide a person's electronic health record in electronic form within 15 business days of a written request, unless the person agrees to accept another form (Tex. Health & Safety Code sec. 181.102(a)).
• Prominently post on your Internet website and at any facility detailed instructions for a consumer to request health care records, contact your disciplinary or licensing authority and file a consumer complaint, unless you only process claims or data for another covered entity (Tex. Health & Safety Code sec. 181.105).
• Do not reidentify or attempt to reidentify an individual who is the subject of protected health information without the individual's consent or authorization if required (Tex. Health & Safety Code sec. 181.151).
• Obtain clear and unambiguous permission in written or electronic form before you use or disclose protected health information for a marketing communication, unless an exception in section 181.152(a) applies, and honor a request to be removed from a mailing list within 45 days (Tex. Health & Safety Code sec. 181.152).
• Do not disclose an individual's protected health information to any other person in exchange for direct or indirect remuneration, except as section 181.153 allows (Tex. Health & Safety Code sec. 181.153).
• Notify an individual whose protected health information is subject to electronic disclosure, and do not electronically disclose it to any person without a separate authorization for each disclosure unless section 181.154(c) applies (Tex. Health & Safety Code sec. 181.154).

Tex. Bus. & Com. Code sec. 521.052 · Read the law's page

• This binds any business that collects or maintains sensitive personal information (an individual's name combined with a Social Security number, driver's license or government-issued identification number, or a financial account, credit, or debit card number together with any required access code; or information that identifies an individual and relates to the individual's physical or mental health, health care, or payment for health care) in the regular course of business; a financial institution as defined by 15 U.S.C. § 6809 is exempt.
• Implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect that sensitive personal information from unlawful use or disclosure. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Destroy or arrange for the destruction of customer records containing sensitive personal information no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or indecipherable through any means.
• There is no private right of action for a violation of this duty; only the attorney general may enforce it, seeking a civil penalty of $2,000 to $50,000 per violation and injunctive relief under Section 521.151.

Tex. Bus. & Com. Code ch. 302 · Read the law's page

• Before making a telephone solicitation (a call or other transmission, a text message included) from a location in Texas or to a purchaser in Texas, register each business location with the Texas Secretary of State on a verified registration statement with a $200 filing fee and $10,000 in security (a bond, letter of credit, or certificate of deposit), renew annually, and file a quarterly addendum listing the salespeople who solicited for you.
• The chapter does not apply to, among others, a person offering qualified securities, a publicly traded corporation registered with the Securities and Exchange Commission or the State Securities Board or its subsidiary or agent, an insurance licensee on an Insurance Code transaction, a supervised financial institution or its affiliate, an educational institution or 501(c)(3) nonprofit, a seller of newspaper, magazine or cable subscriptions, a food seller, a sale to a business buying for resale or manufacturing, a seller soliciting a former or current customer under the same business name for at least two years, a seller who only arranges a later face-to-face sales presentation, a retailer operating a store under the same name for at least two years where most of its business is at the store, or an isolated transaction.
• Before completing a telephone-solicited sale, give the purchaser the disclosures section 302.202 requires, post the registration certificate at the business location, and do not refer to your compliance with the chapter.
• Do not require a credit card or checking account number as a condition of receiving an item you represent as free.

Tex. Bus. & Com. Code ch. 304 · Read the law's page

• Do not make a telemarketing call (an unsolicited call, text message included, to solicit a sale of a consumer good or service, credit for one, or information for either) to a number more than 60 days after it appears on the Texas no-call list.
• The chapter does not apply to a call made by a consumer in response to a solicitation or general advertising, a call in connection with an established business relationship (a voluntary two-way communication about a consumer good or service, not terminated) or a recently terminated one, a call to a business (other than by facsimile) that has not asked not to be called, a debt-collection call, or a qualifying state licensee's call that ends in a face-to-face presentation.
• When you make a facsimile solicitation from Texas, include in at least 12-point type your complete name and street address and a toll-free or local number answered by a person on weekdays from 9 a.m. to 5 p.m. or that automatically deletes the recipient's number; on a stop request, send a written acknowledgment within 24 hours and make no further transmission to that number.
• In making a telemarketing call, do not block your number, interfere with or circumvent a caller identification service, fail to provide caller identification information you are capable of providing, or transmit misleading caller identification information; you may substitute the name and number of the person on whose behalf you call.

Tex. Bus. & Com. Code ch. 542 (secs. 542.001-542.004) · Read the law's page

• This chapter applies only to a business entity with fewer than 250 employees that owns or licenses computerized data including sensitive personal information, as those terms are defined by Section 521.002.
• It is a safe harbor, not a duty: if such an entity is sued over a breach of system security and demonstrates that, at the time of the breach, it had implemented and maintained a cybersecurity program meeting Section 542.004's requirements, the claimant may not recover exemplary damages from it. A qualifying program must contain administrative, technical, and physical safeguards; conform to a named industry-recognized cybersecurity framework (the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53/53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, the ISO/IEC 27000-series, the HITRUST Common Security Framework, the Secure Controls Framework, SOC 2, or a similar framework); and be scaled by headcount: simplified measures such as password policies and employee training below 20 employees, the CIS Controls Implementation Group 1 from 20 to 99 employees, and full conformance with a named framework from 100 to 249 employees.
• The chapter creates no duty to adopt a program and no cause of action of its own; it only removes exemplary-damages exposure for a qualifying entity that already has one at the time of a breach.

Tex. Bus. & Com. Code sec. 501.001 · Read the law's page

• Unless you are a government, do not intentionally communicate or make an individual's social security number available to the public, display it on a card or device required to access a product or service, or print it on mailed material unless state or federal law requires it or the mail is an application or form of a kind section 501.001(f) lists (Tex. Bus. & Com. Code sec. 501.001(a)(1), (2), (5), (f)).
• Unless you are a government, do not require an individual to transmit the individual's social security number over the Internet unless the connection is secure or the number is encrypted, and do not require it for access to a website unless a password, personal identification number or other authentication device is also required (Tex. Bus. & Com. Code sec. 501.001(a)(3), (4)).
• If an individual asks you in writing to stop using the individual's social security number in a manner section 501.001(a) prohibits, comply within 30 days of receiving the request, without a fee (Tex. Bus. & Com. Code sec. 501.001(d)).