Law / United States / 
Texas
Texas Medical Records Privacy Act: duties of covered entities that handle protected health information
Tex. Health & Safety Code ch. 181
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights, Prohibition, Governance
- Audit expectation
- none
As of .
What it requires
- Train your employees on state and federal law concerning protected health information as necessary for their duties, within 90 days of hire, have each sign a statement verifying completion, and keep the statement until the sixth anniversary of signing (Tex. Health & Safety Code sec. 181.101).
- If you are a health care provider using an electronic health records system capable of fulfilling the request, provide a person's electronic health record in electronic form within 15 business days of a written request, unless the person agrees to accept another form (Tex. Health & Safety Code sec. 181.102(a)).
- Prominently post on your Internet website and at any facility detailed instructions for a consumer to request health care records, contact your disciplinary or licensing authority and file a consumer complaint, unless you only process claims or data for another covered entity (Tex. Health & Safety Code sec. 181.105).
- Do not reidentify or attempt to reidentify an individual who is the subject of protected health information without the individual's consent or authorization if required (Tex. Health & Safety Code sec. 181.151).
- Obtain clear and unambiguous permission in written or electronic form before you use or disclose protected health information for a marketing communication, unless an exception in section 181.152(a) applies, and honor a request to be removed from a mailing list within 45 days (Tex. Health & Safety Code sec. 181.152).
- Do not disclose an individual's protected health information to any other person in exchange for direct or indirect remuneration, except as section 181.153 allows (Tex. Health & Safety Code sec. 181.153).
- Notify an individual whose protected health information is subject to electronic disclosure, and do not electronically disclose it to any person without a separate authorization for each disclosure unless section 181.154(c) applies (Tex. Health & Safety Code sec. 181.154).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Tex. Health & Safety Code sec. 181.201(b): the attorney general may seek civil penalties against a covered entity that may not exceed $5,000 for each violation that occurs in one year committed negligently, $25,000 for each such violation committed knowingly or intentionally, or $250,000 for each violation in which the covered entity knowingly or intentionally used protected health information for financial gain. Under section 181.201(c) a court that finds a pattern or practice may assess a civil penalty not to exceed $1.5 million annually.
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 1,500,000
- Per violation unit
- Violation
- Per violation amount
- 250,000
Who enforces it
Enforcement body
Texas attorney general, who may institute an action for injunctive relief and an action for civil penalties against a covered entity (Tex. Health & Safety Code sec. 181.201(a), (b)).
What this law does
A covered entity is any person who, for commercial, financial or professional gain or on a cooperative, nonprofit or pro bono basis, engages in whole or in part in assembling, collecting, analyzing, using, evaluating, storing or transmitting protected health information, comes into possession of it, obtains or stores it under the chapter, or is an employee, agent or contractor of such a person insofar as it handles protected health information.
Except for Subchapter D, chapter 181 does not apply to a covered entity as defined by section 602.001 of the Insurance Code, an entity established under Article 5.76-3 of the Insurance Code, or an employer. Each covered entity must provide training on state and federal law concerning protected health information to its employees, and an employee must complete the training not later than the 90th day after being hired.
A health care provider using an electronic health records system capable of fulfilling the request must provide a person's electronic health record in electronic form not later than the 15th business day after receiving the person's written request, unless the person agrees to accept another form.
A covered entity must prominently post on its Internet website and at any facility detailed instructions for a consumer to request health care records, contact the disciplinary or licensing authority and file a consumer complaint. A person may not reidentify or attempt to reidentify an individual who is the subject of any protected health information without the individual's consent or authorization if required under chapter 181 or other state or federal law.
A covered entity must obtain clear and unambiguous permission in written or electronic form to use or disclose protected health information for any marketing communication, except for the listed face-to-face, nominal gift, patient assistance program and oral request communications. A covered entity may not disclose an individual's protected health information to any other person in exchange for direct or indirect remuneration, except as section 181.153 allows.
A covered entity must provide notice to an individual whose protected health information is subject to electronic disclosure. Except as section 181.154(c) provides, a covered entity may not electronically disclose an individual's protected health information to any person without a separate authorization from the individual or the individual's legally authorized representative for each disclosure.
The attorney general may institute an action for injunctive relief to restrain a violation of chapter 181. The attorney general may institute an action for civil penalties against a covered entity, which may not exceed $5,000 for each violation in one year committed negligently, $25,000 for each such violation committed knowingly or intentionally, or $250,000 for each violation in which the covered entity knowingly or intentionally used protected health information for financial gain.
A court that finds violations of chapter 181 have occurred with a frequency that constitutes a pattern or practice may assess a civil penalty not to exceed $1.5 million annually. A violation of chapter 181 by a covered entity that is licensed by an agency of this state is subject to investigation and disciplinary proceedings, including probation or suspension by the licensing agency. Chapter 181 was added by Acts 2001, 77th Legislature, chapter 1511, effective .
Section 5(b) of the 2001 Act that added chapter 181 provides that a covered entity shall comply with the requirements of chapter 181 not later than . Section 181.001 was amended by Acts 2011, 82nd Legislature, chapter 1126 (House Bill 300), effective . Section 181.105 was added by Acts 2025, 89th Legislature, chapter 650 (House Bill 4224), effective .
Section 181.101 was added by Acts 2011, 82nd Legislature, chapter 1126 (House Bill 300), effective . Section 181.102 was added by Acts 2011, 82nd Legislature, chapter 1126 (House Bill 300), effective . Section 181.153 was added by Acts 2011, 82nd Legislature, chapter 1126 (House Bill 300), effective . Section 181.154 was added by Acts 2011, 82nd Legislature, chapter 1126 (House Bill 300), effective . Section 181.201 was amended by Acts 2011, 82nd Legislature, chapter 1126 (House Bill 300), effective .
When LexLint raises it
When your app profile says your app sends automated outreach or handles health records.